crowdsecurity/crowdsec · warning · ParseError

missing PRI end

Error message

missing PRI end

What it means

After confirming the message starts with '<', stripPRI searches for the closing '>' that terminates the PRI field. If no '>' exists anywhere in the message the PRI is unterminated and the parser returns 'missing PRI end'.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:178

	if e.RFC5424 != nil {
		fields["rfc5424_err"] = e.RFC5424.Error()
	}

	return fields
}

func stripPRI(msg []byte) (rest []byte, err error) {
	if len(msg) < 3 {
		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}
		}
	}

	return msg[end+1:], nil
}

func (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {
	var line string

View on GitHub (pinned to 909b515798)

Solutions

1. Check for TCP truncation; ensure the sender terminates each syslog frame correctly (RFC5424 octet counting or newline framing)
2. Fix the emitting device to write the full '<PRI>' header
3. Inspect the raw message in the ParseError to identify the source of malformed data

Example fix

// before: manual framing without closing PRI
conn.Write([]byte("<13 partial"))
// after
conn.Write([]byte("<13>partial\n"))

if strings.HasPrefix(msg, "<") && !strings.Contains(msg, ">") { /* truncated; reject upstream */ }

When it happens

Trigger: A message starting with '<' but containing no '>' anywhere, e.g. '<13some text' or truncated datagrams cut mid-header.

Common situations: TCP stream truncation splitting a syslog frame; a custom emitter writing '<PRI' without closing bracket; binary garbage sent to the syslog port; MTU-related datagram truncation.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/348dc58013f15d4b. Report an issue: GitHub.