crowdsecurity/crowdsec · warning · ParseError

PRI not a number

Error message

PRI not a number

What it means

Returned by stripPRI when a character between '<' and '>' in the syslog PRI part is not an ASCII digit — the PRI value is not a number, e.g. '<ab>' or '<1x>'. The raw message is preserved in the returned ParseError for the caller to log.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:187

		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}
		}
	}

	return msg[end+1:], nil
}

func (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {
	var line string

	logger := s.logger.WithField("client", syslogLine.Client)
	logger.Tracef("raw: %s", syslogLine)

	if s.metricsLevel != metrics.AcquisitionMetricsLevelNone {
		metrics.SyslogDataSourceLinesReceived.With(prometheus.Labels{"source": syslogLine.Client, "datasource_type": ModuleName, "acquis_type": s.config.Labels["type"]}).Inc()
	}

	if s.config.DisableRFCParser {
		rest, err := stripPRI(syslogLine.Message)

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the emitter to send a numeric PRI (facility*8+severity, range 0-191)
2. If the source emits '<tag>text' style prefixes, use a different datasource or pre-transform the log
3. Inspect the raw message in the ParseError to identify the producer

Example fix

// before
<error>disk full
// after
<11>disk full  (facility 1, severity 3)

// validate PRI digits before sending
pri := 8*facility + severity
if pri < 0 || pri > 191 { /* fix emitter */ }
header := fmt.Sprintf("<%d>", pri)

When it happens

Trigger: Messages like '<abc>msg' or '< 5>msg' where the PRI body contains letters, spaces or symbols.

Common situations: A custom or broken syslog emitter writing non-numeric priority; text formats that start with angle-bracket tags (e.g. '<error>') sent to the syslog port; corruption in transit.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/54b3a60c6d874198. Report an issue: GitHub.