crowdsecurity/crowdsec · error

PRI must start with '<'

Error message

PRI must start with '<'

What it means

RFC5424 messages must begin with a PRI field enclosed in angle brackets, e.g. `<165>1 ...`. parsePRI checks the first byte of the buffer and throws this error if it is not '<', meaning the input does not look like an RFC5424 syslog message at all.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:47

const NIL_VALUE = '-'

var VALID_TIMESTAMPS = []string{
	time.RFC3339,
}

const VALID_TIMESTAMP = time.RFC3339Nano

func WithStrictHostname() RFC5424Option {
	return func(r *RFC5424) {
		r.strictHostname = true
	}
}

func (r *RFC5424) parsePRI() error {
	pri := 0

	if r.buf[r.position] != '<' {
		return errors.New("PRI must start with '<'")
	}

	r.position++

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the incoming format matches the parser: RFC5424 lines look like `<165>1 2023-... host app - - msg`; if messages look like `<34>Oct 11 ...` they are RFC3164 — use the RFC3164 parser/config instead
2. Ensure no relay/load balancer strips or rewrites the PRI header before the message reaches crowdsec
3. Strip BOM or leading whitespace from the input before parsing
4. Check the syslog client configuration to make sure it emits RFC5424 (e.g. `SyslogFormat` rfc5424 in rsyslog/rsyslog template or syslog-ng flags(syslog-protocol))

Example fix

// before
rfc5424Parser.Parse([]byte("Oct 11 22:14:15 mymachine sshd: msg")) // RFC3164-style
// after
rfc5424Parser.Parse([]byte("<34>1 2023-10-11T22:14:15.003Z mymachine sshd 1234 - msg"))

func looksLikeRFC5424(msg []byte) bool {
	return len(msg) > 0 && msg[0] == '<'
}
// choose parser based on format detection before calling Parse

if err := parser.Parse(msg); err != nil {
	if strings.Contains(err.Error(), "PRI must start with '<'") {
		log.Debugf("non-RFC5424 message (missing <PRI>), dropping: %q", msg)
		return nil
	}
	return err
}

When it happens

Trigger: Calling RFC5424.Parse on a message starting with anything other than '<': an RFC3164-format line fed to the RFC5424 parser, raw text without a PRI, a message whose PRI was already stripped by an upstream relay, or leading whitespace/BOM before '<'.

Common situations: Configuring the syslog acquisition with the wrong RFC version for the incoming format (clients sending BSD-style RFC3164 lines to an RFC5424 parser), a proxy stripping the `<PRI>` header, UTF-8 BOM bytes preceding the PRI, debugging with a raw log line pasted from a file.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• pid inside tag must be closed with ']'
• PRI must be a number
• message is empty
• PRI must be up to 3 characters long
• PRI must end with '>'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/12c6b9302bfa41bc. Report an issue: GitHub.