crowdsecurity/crowdsec · error

pid inside tag must be closed with ']'

Error message

pid inside tag must be closed with ']'

What it means

RFC3164 syslog tags may embed a process ID in brackets, e.g. `sshd[1234]:`. The parser reads digits after the '[' and requires a closing ']' before the buffer ends. If input runs out while inside the bracket, parseTag throws this error.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:177

		hasPid = true
		r.position++
		for r.position < r.len {
			c = r.buf[r.position]
			if c == ']' {
				pidEnd = true
				r.position++
				break
			}
			if c < '0' || c > '9' {
				return errors.New("pid inside tag must be a number")
			}
			tmpPid = append(tmpPid, c)
			r.position++
		}
	}

	if hasPid && !pidEnd {
		return errors.New("pid inside tag must be closed with ']'")
	}

	if hasPid {
		r.PID = string(tmpPid)
	}
	return nil
}

func (r *RFC3164) parseMessage() error {
	err := r.parseTag()
	if err != nil {
		return err
	}

	if r.position == r.len {
		return errors.New("message is empty")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the tag's PID bracket is closed: emit `tag[pid]:` not `tag[pid:` in the syslog producer
2. Check the source of the log line for truncation (socket timeouts, max-line-length settings in rsyslog/syslog-ng or the acquisition reader)
3. If the tag has no PID, remove the '[' entirely — a bare '[' after the tag always starts a PID section in this parser
4. Sanitize/validate lines before parsing: reject lines that end inside a bracket

Example fix

// before
r.Parse([]byte("<34>Oct 11 22:14:15 mymachine sshd[1234"))
// after
r.Parse([]byte("<34>Oct 11 22:14:15 mymachine sshd[1234]: session opened"))

func hasUnclosedTagPid(line []byte) bool {
	i := bytes.IndexByte(line, '[')
	if i < 0 {
		return false
	}
	return !bytes.Contains(line[i+1:], []byte("]"))
}
// skip or reject lines where hasUnclosedTagPid(msg) is true before Parse

if err := parser.Parse(msg); err != nil {
	if strings.Contains(err.Error(), "must be closed with ']'") {
		log.Debugf("skipping truncated syslog line: %v", err)
		return nil
	}
	return err
}

When it happens

Trigger: Calling RFC3164.Parse on a message whose tag contains '[' but the input ends before a ']' appears, e.g. `"<34>Oct 11 22:14:15 host sshd[123"` (truncated line, no ']' or trailing content).

Common situations: Truncated syslog lines from a network socket that cut mid-packet, log shippers or tailers chopping lines at buffer boundaries, hand-crafted test messages missing the ']', or a relay that strips trailing characters.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• message is empty
• PRI must start with '<'
• timestamp is not valid
• tag is empty
• pid inside tag must be a number

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0a10f2d68efa056b. Report an issue: GitHub.