crowdsecurity/crowdsec · error

PRI must start with '<'

Error message

PRI must start with '<'

What it means

Validation in the RFC3164 syslog parser's parsePRI (called from Parse): the first character of the message is not '<'. RFC 3164 requires the PRI part to be an angle-bracket-delimited priority value at the very start of the datagram; anything else means the payload is not an RFC3164 message.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:54

}

func WithCurrentYear() RFC3164Option {
	return func(r *RFC3164) {
		r.useCurrentYear = true
	}
}

func WithStrictHostname() RFC3164Option {
	return func(r *RFC3164) {
		r.strictHostname = true
	}
}

func (r *RFC3164) parsePRI() error {
	pri := 0

	if r.buf[r.position] != '<' {
		return errors.New("PRI must start with '<'")
	}

	r.position++

	for r.position < r.len {
		c := r.buf[r.position]
		if c == '>' {
			r.position++
			break
		}
		if c < '0' || c > '9' {
			return errors.New("PRI must be a number")
		}
		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure senders emit '<PRI>TIMESTAMP HOST TAG: MSG' with the leading '<'
2. If the source emits RFC5424 or plain text, configure the syslog datasource to use the right parser/format instead of RFC3164
3. Check for a stray prefix (BOM, newline) injected before the priority by a proxy or load balancer

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:54 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/315e9b24dcbde0b8. Report an issue: GitHub.