crowdsecurity/crowdsec · error

timestamp is not valid

Error message

timestamp is not valid

What it means

parseTimestamp in the RFC3164 syslog parser tries each layout in VALID_TIMESTAMPS (RFC3339 and four 'Jan 02 15:04:05 [2006]' variants) against the fixed-length slice of the message starting at the current position. If none of them parses, it returns 'timestamp is not valid'. It is thrown because RFC3164 mandates a timestamp immediately after the PRI, and without one the parser cannot position the rest of the fields.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go:100

}

func (r *RFC3164) parseTimestamp() error {
	validTs := false
	for _, layout := range VALID_TIMESTAMPS {
		tsLen := len(layout)
		if r.position+tsLen > r.len {
			continue
		}
		t, err := time.Parse(layout, string(r.buf[r.position:r.position+tsLen]))
		if err == nil {
			validTs = true
			r.Timestamp = t
			r.position += tsLen
			break
		}
	}
	if !validTs {
		return errors.New("timestamp is not valid")
	}
	if r.useCurrentYear {
		if r.Timestamp.Year() == 0 {
			r.Timestamp = time.Date(time.Now().Year(), r.Timestamp.Month(), r.Timestamp.Day(), r.Timestamp.Hour(), r.Timestamp.Minute(), r.Timestamp.Second(), r.Timestamp.Nanosecond(), r.Timestamp.Location())
		}
	}
	r.position++
	return nil
}

func (r *RFC3164) parseHostname() error {
	hostname := []byte{}
	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			r.position++
			break
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the timestamp format actually emitted by the source: run the raw syslog line through a manual time.Parse with the VALID_TIMESTAMPS layouts from pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse.go to see which one it matches.
2. If the source emits RFC5424-style ISO timestamps, use the RFC5424 parser instead of RFC3164 (or route messages accordingly in the syslog acquisition config).
3. Ensure the message passed to Parse starts exactly at '<PRI>' with no leading spaces/BOM; leading bytes shift r.position and corrupt the timestamp slice.
4. If the day is space-padded ('Feb 3'), confirm the '_2' layout slice lines up — the parser uses fixed layout lengths, so any extra/missing character breaks the match.
5. If the parser instance is reused across messages, construct a fresh one via NewRFC3164Parser per parse or reset position, since a prior failure leaves r.position advanced.

Example fix

// before: RFC5424 timestamp fed to RFC3164 parser
r.Parse([]byte("<34>2024-02-03T09:12:01Z host tag: msg")) // timestamp is not valid

// after: either RFC3164 format
r.Parse([]byte("<34>Feb  3 09:12:01 host tag: msg"))
// or use the RFC5424 parser for ISO timestamps

layouts := []string{time.RFC3339, "Jan 02 15:04:05 2006", "Jan _2 15:04:05 2006", "Jan 02 15:04:05", "Jan _2 15:04:05"}
func hasSupportedRFC3164Timestamp(msg string, priLen int) bool {
	rest := msg[priLen:]
	for _, l := range layouts {
		if len(rest) >= len(l) {
			if _, err := time.Parse(l, rest[:len(l)]); err == nil {
				return true
			}
		}
	}
	return false
}

func isRFC3164TimestampPrefix(s string) bool {
	for _, l := range []string{time.RFC3339, "Jan 02 15:04:05", "Jan _2 15:04:05"} {
		if len(s) >= len(l) {
			if _, err := time.Parse(l, s[:len(l)]); err == nil {
				return true
			}
		}
	}
	return false
}

var rpe *rfc3164.RFC3164
if err := rpe.Parse(line); err != nil {
	if strings.Contains(err.Error(), "timestamp is not valid") {
		// fall back to RFC5424 parser or store raw line for manual inspection
	}
}

When it happens

Trigger: Calling RFC3164.Parse on a message whose bytes right after '<PRI>' do not exactly match one of the supported layouts: RFC3339, 'Jan 02 15:04:05', 'Jan _2 15:04:05' (space-padded day), or their ' 2006'-year suffixed variants. Includes truncated timestamps (fewer than 15 chars remaining), ISO8601 with different offsets, and the RFC5424 'YYYY-MM-DDTHH:MM:SS' form.

Common situations: Feeding RFC5424-formatted messages (ISO timestamps with T separator) into the RFC3164 parser; receiving syslog from devices emitting 'Feb 3 09:12:01' with double spaces where the '_2' layout length does not line up; messages with the timestamp omitted entirely; a parser instance reused after a failed Parse left r.position mid-buffer.

Related errors

• tag is empty
• pid inside tag must be a number
• pid inside tag must be closed with ']'
• message is empty
• unrecognized syslog message

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a29da8cb540964d1. Report an issue: GitHub.