crowdsecurity/crowdsec · warning · ParseError

missing PRI beginning

Error message

missing PRI beginning

What it means

stripPRI expects every syslog message to start with '<' opening the PRI priority field. If the first byte is not '<' the message is not valid syslog framing, so a ParseError 'missing PRI beginning' is returned with the raw message attached.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:173

	if e.RFC3164 != nil {
		fields["rfc3164_err"] = e.RFC3164.Error()
	}

	if e.RFC5424 != nil {
		fields["rfc5424_err"] = e.RFC5424.Error()
	}

	return fields
}

func stripPRI(msg []byte) (rest []byte, err error) {
	if len(msg) < 3 {
		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}
		}
	}

	return msg[end+1:], nil

View on GitHub (pinned to 909b515798)

Solutions

1. Enable PRI framing / RFC3164 or RFC5424 mode on the sending device or forwarder
2. Send non-syslog text through a proper syslog emitter (logger, rsyslog, syslog-ng) instead of raw TCP/UDP
3. Use a file or journal datasource for plain-text logs instead of the syslog source
4. Check the raw message in the ParseError to identify the offending producer

Example fix

// before: raw text to syslog port
echo "plain message" | nc -u host 514
// after
logger -t myapp "plain message"

if !strings.HasPrefix(msg, "<") { /* route to plain-text datasource instead */ }

When it happens

Trigger: parseLine receives a message whose first byte is not '<': plain-text lines without a PRI header forwarded to the syslog datasource.

Common situations: A forwarder configured to send raw application text instead of RFC3164/5424-framed messages; JSON lines or logfmt sent directly to the syslog port; a device with 'PRI-less' syslog mode enabled.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/160eb7556b4f156c. Report an issue: GitHub.