{"record":{"id":"e5dcb4cf840a0e08","repo":"crowdsecurity/crowdsec","slug":"version-must-be-1","errorCode":null,"errorMessage":"version must be 1","messagePattern":"version must be 1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":79,"sourceCode":"\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {\n\t\treturn errors.New(\"PRI must be up to 3 characters long\")\n\t}\n\n\tif r.position == r.len && r.buf[r.position-1] != '>' {\n\t\treturn errors.New(\"PRI must end with '>'\")\n\t}\n\n\tr.PRI = pri\n\treturn nil\n}\n\nfunc (r *RFC5424) parseVersion() error {\n\tif r.buf[r.position] != '1' {\n\t\treturn errors.New(\"version must be 1\")\n\t}\n\tr.position += 2\n\tif r.position >= r.len {\n\t\treturn errors.New(\"version must be followed by a space\")\n\t}\n\treturn nil\n}\n\nfunc (r *RFC5424) parseTimestamp() error {\n\ttimestamp := []byte{}\n\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.Timestamp = time.Now().UTC().Round(0)\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\n\tfor r.position < r.len {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L61-L97","documentation":"RFC 5424 mandates the version digit '1' immediately after the PRI. parseVersion checks buf[position] == '1'; any other character (including '0' or '2') means the line is either RFC 3164 legacy format or otherwise not RFC 5424 compliant, so the parser rejects it.","triggerScenarios":"Calling RFC5424.Parse on a line like \"<34>2 ...\" or \"<34>0 ...\", or on an RFC 3164 line such as \"<34>Jan  1 00:00:00 host msg\" where the character after '>' is a month letter.","commonSituations":"Feeding legacy RFC 3164 syslog (still very common on older Linux/Unix daemons and network gear) to the RFC 5424 parser; a device with a misconfigured syslog template.","solutions":["Detect the message format first: if the character after '<PRI>' is not '1', route the line to an RFC 3164 parser instead.","Reconfigure the emitting device to RFC 5424 (syslog protocol) output, e.g. rsyslog template RSYSLOG_SyslogProtocol23Format.","Confirm the version digit follows the PRI with no extra characters."],"exampleFix":"// before (RFC 3164 line into rfc5424 parser)\nrfc5424Parser.Parse([]byte(\"<34>Jan  1 00:00:00 host sshd: msg\"))\n// after (RFC 5424 line)\nrfc5424Parser.Parse([]byte(\"<34>1 2024-01-01T00:00:00.000000Z host sshd - - - msg\"))","handlingStrategy":"validation","validationCode":"// Go: RFC 5424 requires '1' right after the PRI's '>'\nfunc isRFC5424(line []byte) bool {\n\ti := bytes.IndexByte(line, '>')\n\treturn i > 0 && i+1 < len(line) && line[i+1] == '1'\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"version must be 1\") {\n\t\t// fall back to RFC 3164 parser\n\t}\n}","preventionTips":["Detect RFC 3164 vs RFC 5424 before choosing a parser","Configure senders for RFC 5424 (e.g. rsyslog RSYSLOG_SyslogProtocol23Format)","Peek the version digit after '<PRI>' as a cheap pre-check"],"tags":["syslog","rfc5424","parsing","version-mismatch"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}