crowdsecurity/crowdsec · warning · ParseError

PRI too long

Error message

PRI too long

What it means

The PRI field in RFC3164/5424 is at most '<316>' style — 3 digits plus brackets, so the '>' can appear at index at most 4. If the closing '>' appears later, the PRI field is abnormally long and stripPRI rejects the message with 'PRI too long'.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:182

	return fields
}

func stripPRI(msg []byte) (rest []byte, err error) {
	if len(msg) < 3 {
		return nil, &ParseError{Reason: errors.New("message too short"), RawMessage: msg}
	}

	if msg[0] != '<' {
		return nil, &ParseError{Reason: errors.New("missing PRI beginning"), RawMessage: msg}
	}

	end := bytes.Index(msg, []byte(">"))
	if end == -1 {
		return nil, &ParseError{Reason: errors.New("missing PRI end"), RawMessage: msg}
	}

	if end > 4 {
		return nil, &ParseError{Reason: errors.New("PRI too long"), RawMessage: msg}
	}

	for i := 1; i < end; i++ {
		if msg[i] < '0' || msg[i] > '9' {
			return nil, &ParseError{Reason: errors.New("PRI not a number"), RawMessage: msg}
		}
	}

	return msg[end+1:], nil
}

func (s *Source) parseLine(syslogLine syslogserver.SyslogMessage) (string, error) {
	var line string

	logger := s.logger.WithField("client", syslogLine.Client)
	logger.Tracef("raw: %s", syslogLine)

	if s.metricsLevel != metrics.AcquisitionMetricsLevelNone {

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender to emit a compliant 1-3 digit PRI (0-191)
2. Route XML/HTML or other '<'-prefixed text to a proper datasource instead of syslog
3. Verify device firmware/config for nonstandard syslog framing

Example fix

// before: overlong pseudo-PRI
<12345678>message
// after
<134>message

// PRI body must be 1-3 digits: match '<[0-9]{1,3}>'
if matched, _ := regexp.MatchString(`^<[0-9]{1,3}>`, msg); !matched { /* invalid PRI */ }

When it happens

Trigger: A message like '<12345>msg' where '>' is at index 5 or beyond, or messages with a very long prefix starting with '<' before any '>'.

Common situations: A device emitting an extended/invalid header (e.g. including timestamp inside angle brackets); a non-syslog protocol whose text happens to start with '<' (XML, HTML) sent to the syslog port.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• timestamp is not valid
• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b5d193c136aa6dac. Report an issue: GitHub.