{"record":{"id":"fc3fe06e9def01b9","repo":"crowdsecurity/crowdsec","slug":"pri-must-end-with-fc3fe0","errorCode":null,"errorMessage":"PRI must end with '>'","messagePattern":"PRI must end with '>'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":70,"sourceCode":"\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == '>' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\tif c < '0' || c > '9' {\n\t\t\treturn errors.New(\"PRI must be a number\")\n\t\t}\n\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {\n\t\treturn errors.New(\"PRI must be up to 3 characters long\")\n\t}\n\n\tif r.position == r.len && r.buf[r.position-1] != '>' {\n\t\treturn errors.New(\"PRI must end with '>'\")\n\t}\n\n\tr.PRI = pri\n\treturn nil\n}\n\nfunc (r *RFC5424) parseVersion() error {\n\tif r.buf[r.position] != '1' {\n\t\treturn errors.New(\"version must be 1\")\n\t}\n\tr.position += 2\n\tif r.position >= r.len {\n\t\treturn errors.New(\"version must be followed by a space\")\n\t}\n\treturn nil\n}\n\nfunc (r *RFC5424) parseTimestamp() error {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L52-L88","documentation":"parsePRI requires the PRI header to be closed with '>'. If the loop consumed the whole buffer without finding '>', the line is truncated or mis-framed and the parser rejects it. This catches messages cut off after the priority digits.","triggerScenarios":"Calling RFC5424.Parse on a buffer ending after the digits, e.g. \"<34\" or \"<341\" — the digit loop exits at end of buffer, r.position == r.len and buf[len-1] is not '>'.","commonSituations":"TCP syslog without proper framing (RFC 6587 octet counting) causing truncated reads, UDP datagram truncation (MTU), or a newline-terminated stream splitting a message across reads.","solutions":["Ensure TCP syslog sources use octet counting (SYSLEN prefix) or correct newline framing so messages are complete before parsing.","Increase read buffer size if messages are being truncated at transport layer.","Log the incomplete line to identify which sender/framing is at fault."],"exampleFix":"// before (truncated frame)\nparser.Parse([]byte(\"<34\"))\n// after (complete RFC 5424 frame)\nparser.Parse([]byte(\"<34>1 2024-01-01T00:00:00Z host app 1 - msg\"))","handlingStrategy":"validation","validationCode":"// Go: line must contain a closing '>' before end\nfunc priClosed(line []byte) bool {\n\treturn len(line) > 2 && bytes.IndexByte(line, '>') > 0\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"PRI must end with '>'\") {\n\t\t// treat as truncated frame; buffer and wait for more data\n\t}\n}","preventionTips":["For TCP syslog use octet counting so frames are never split","Check for MTU/UDP truncation on the receiving socket","Accumulate partial reads into a buffer instead of parsing each read independently"],"tags":["syslog","rfc5424","parsing","truncated-message"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}