What causes "PRI must end with '>'" in crowdsecurity/crowdsec?

Ensure TCP syslog sources use octet counting (SYSLEN prefix) or correct newline framing so messages are complete before parsing.

crowdsecurity/crowdsec · error

PRI must end with '>'

Error message

PRI must end with '>'

What it means

parsePRI requires the PRI header to be closed with '>'. If the loop consumed the whole buffer without finding '>', the line is truncated or mis-framed and the parser rejects it. This catches messages cut off after the priority digits.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:70

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC5424) parseVersion() error {
	if r.buf[r.position] != '1' {
		return errors.New("version must be 1")
	}
	r.position += 2
	if r.position >= r.len {
		return errors.New("version must be followed by a space")
	}
	return nil
}

func (r *RFC5424) parseTimestamp() error {

View on GitHub (pinned to 909b515798)

Solutions

Ensure TCP syslog sources use octet counting (SYSLEN prefix) or correct newline framing so messages are complete before parsing.
Increase read buffer size if messages are being truncated at transport layer.
Log the incomplete line to identify which sender/framing is at fault.

Example fix

// before (truncated frame)
parser.Parse([]byte("<34"))
// after (complete RFC 5424 frame)
parser.Parse([]byte("<34>1 2024-01-01T00:00:00Z host app 1 - msg"))

Defensive patterns

Strategy: validation

Validate before calling

// Go: line must contain a closing '>' before end
func priClosed(line []byte) bool {
	return len(line) > 2 && bytes.IndexByte(line, '>') > 0
}

Try / catch

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "PRI must end with '>'") {
		// treat as truncated frame; buffer and wait for more data
	}
}

Prevention

For TCP syslog use octet counting so frames are never split
Check for MTU/UDP truncation on the receiving socket
Accumulate partial reads into a buffer instead of parsing each read independently

When it happens

Trigger: Calling RFC5424.Parse on a buffer ending after the digits, e.g. "<34" or "<341" — the digit loop exits at end of buffer, r.position == r.len and buf[len-1] is not '>'.

Common situations: TCP syslog without proper framing (RFC 6587 octet counting) causing truncated reads, UDP datagram truncation (MTU), or a newline-terminated stream splitting a message across reads.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fc3fe06e9def01b9. Report an issue: GitHub.