crowdsecurity/crowdsec · error

version must be 1

Error message

version must be 1

What it means

RFC 5424 mandates the version digit '1' immediately after the PRI. parseVersion checks buf[position] == '1'; any other character (including '0' or '2') means the line is either RFC 3164 legacy format or otherwise not RFC 5424 compliant, so the parser rejects it.

Solutions

1. Detect the message format first: if the character after '<PRI>' is not '1', route the line to an RFC 3164 parser instead.
2. Reconfigure the emitting device to RFC 5424 (syslog protocol) output, e.g. rsyslog template RSYSLOG_SyslogProtocol23Format.
3. Confirm the version digit follows the PRI with no extra characters.

Example fix

// before (RFC 3164 line into rfc5424 parser)
rfc5424Parser.Parse([]byte("<34>Jan  1 00:00:00 host sshd: msg"))
// after (RFC 5424 line)
rfc5424Parser.Parse([]byte("<34>1 2024-01-01T00:00:00.000000Z host sshd - - - msg"))

// Go: RFC 5424 requires '1' right after the PRI's '>'
func isRFC5424(line []byte) bool {
	i := bytes.IndexByte(line, '>')
	return i > 0 && i+1 < len(line) && line[i+1] == '1'
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "version must be 1") {
		// fall back to RFC 3164 parser
	}
}

When it happens

Trigger: Calling RFC5424.Parse on a line like "<34>2 ..." or "<34>0 ...", or on an RFC 3164 line such as "<34>Jan 1 00:00:00 host msg" where the character after '>' is a month letter.

Common situations: Feeding legacy RFC 3164 syslog (still very common on older Linux/Unix daemons and network gear) to the RFC 5424 parser; a device with a misconfigured syslog template.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• EOL after appname
• EOL after hostname
• EOL after MSGID
• EOL after PRI
• EOL after ProcID

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e5dcb4cf840a0e08. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:79

		pri = pri*10 + int(c-'0')
		r.position++
	}

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC5424) parseVersion() error {
	if r.buf[r.position] != '1' {
		return errors.New("version must be 1")
	}
	r.position += 2
	if r.position >= r.len {
		return errors.New("version must be followed by a space")
	}
	return nil
}

func (r *RFC5424) parseTimestamp() error {
	timestamp := []byte{}

	if r.buf[r.position] == NIL_VALUE {
		r.Timestamp = time.Now().UTC().Round(0)
		r.position += 2
		return nil
	}

	for r.position < r.len {

View on GitHub (pinned to 909b515798)