crowdsecurity/crowdsec · error

PRI must end with '>'

Error message

PRI must end with '>'

What it means

Validation in RFC3164 parsePRI: the buffer ended without the closing '>' of the PRI part (the last consumed character is not '>'). The priority field must be terminated by '>' before the timestamp; a truncated datagram stops here.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:77

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC3164) parseTimestamp() error {
	validTs := false
	for _, layout := range VALID_TIMESTAMPS {
		tsLen := len(layout)
		if r.position+tsLen > r.len {
			continue
		}
		t, err := time.Parse(layout, string(r.buf[r.position:r.position+tsLen]))
		if err == nil {
			validTs = true
			r.Timestamp = t
			r.position += tsLen

View on GitHub (pinned to 909b515798)

Solutions

1. Check for truncated datagrams — UDP clamping or MTU issues can cut messages short
2. Ensure the sender writes the complete '<PRI>' frame before the timestamp
3. If messages are deliberately minimal, they still need the full bracketed PRI to parse as RFC3164

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/36b4f8af37b3573d. Report an issue: GitHub.