crowdsecurity/crowdsec · error

PRI must be up to 3 characters long

Error message

PRI must be up to 3 characters long

What it means

Validation in RFC3164 parsePRI: the parsed priority value exceeds 999, i.e. the number inside <...> has more than three digits. RFC 3164 bounds PRI to at most three digits (0-191 meaningfully), so longer values are rejected as malformed.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:73

	}

	r.position++

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC3164) parseTimestamp() error {
	validTs := false
	for _, layout := range VALID_TIMESTAMPS {
		tsLen := len(layout)
		if r.position+tsLen > r.len {
			continue
		}
		t, err := time.Parse(layout, string(r.buf[r.position:r.position+tsLen]))

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to emit a valid priority computed as facility*8 + severity (max 191)
2. Look for a malformed or hand-crafted datagram with a padded/overflowed PRI field

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:73 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/84d47b1796c61ce7. Report an issue: GitHub.