crowdsecurity/crowdsec · error

PRI must be a number

Error message

PRI must be a number

What it means

Validation in RFC3164 parsePRI: inside the <...> brackets a non-digit character was encountered before the closing '>'. The PRI field must be a decimal number (facility*8 + severity); letters or symbols make it unparseable, so the message is rejected.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:66

}

func (r *RFC3164) parsePRI() error {
	pri := 0

	if r.buf[r.position] != '<' {
		return errors.New("PRI must start with '<'")
	}

	r.position++

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC3164) parseTimestamp() error {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the sender produces a numeric priority, e.g. <34> for facility 4 severity 2
2. Check for encoding corruption or injection inside the PRI field
3. Test the raw datagram with a reference syslog client to isolate the faulty producer

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:66 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a06e5c263643cc8d. Report an issue: GitHub.