What causes "invalid port %d" in crowdsecurity/crowdsec?

Set a valid 'port' value (1-65535) in the syslog acquisition config, typically 514 for syslog.

invalid port %d

Error message

invalid port %d

What it means

The syslog acquisition Validate() method rejects a configuration whose listen port is not in the valid TCP/UDP range 1-65535. Port 0, negative values, and values above 65535 are all invalid for binding a UDP listener. This is a fail-fast config sanity check performed when the syslog datasource is configured.

Source

Thrown at pkg/acquisition/modules/syslog/config.go:60

		c.Mode = configuration.TAIL_MODE
	}

	if c.Addr == "" {
		c.Addr = "127.0.0.1" // do we want a usable or secure default ?
	}

	if c.Port == 0 {
		c.Port = 514
	}

	if c.MaxMessageLen == 0 {
		c.MaxMessageLen = 2048
	}
}

func (c *Configuration) Validate() error {
	if c.Port <= 0 || c.Port > 65535 {
		return fmt.Errorf("invalid port %d", c.Port)
	}

	if net.ParseIP(c.Addr) == nil {
		return fmt.Errorf("invalid listen IP %s", c.Addr)
	}

	return nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	s.config = cfg

	return nil

View on GitHub (pinned to 909b515798)

Solutions

Set a valid 'port' value (1-65535) in the syslog acquisition config, typically 514 for syslog.
If port was omitted, add the port: key under the syslog datasource stanza.
Check for YAML indentation issues that put the port field in the wrong stanza so it is not parsed.

Example fix

// before (config.yaml)
source: syslog
listen_addr: 0.0.0.0
# port missing -> defaults to 0

// after
source: syslog
listen_addr: 0.0.0.0
port: 514

Defensive patterns

Strategy: validation

Validate before calling

port := cfg.Port
if port <= 0 || port > 65535 {
    return fmt.Errorf("syslog port must be 1-65535, got %d", port)
}

Prevention

Always set an explicit port in syslog acquisition stanzas; never rely on zero-value defaults.
Validate acquisition YAML in CI before deployment.
Keep port as a quoted or plain integer consistently in YAML.

When it happens

Trigger: A syslog acquisition YAML specifies a 'port' field that is 0, negative, or greater than 65535, or omits port entirely (zero value).

Common situations: Typo in the port number in acquis.yaml; port key left out of the syslog stanza so it defaults to 0; port pasted from another tool as a string ending up unparseable; copy-pasting a config that used a named service instead of a number.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/734455c5a242535e. Report an issue: GitHub.