crowdsecurity/crowdsec · error

version must be followed by a space

Error message

version must be followed by a space

What it means

After checking the version digit, parseVersion advances the position by 2 (version char + the following space) and verifies the buffer still has data. If the line ends right after the version character, there is no space/timestamp following and the parser reports the missing separator.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:83

	if pri > 999 {
		return errors.New("PRI must be up to 3 characters long")
	}

	if r.position == r.len && r.buf[r.position-1] != '>' {
		return errors.New("PRI must end with '>'")
	}

	r.PRI = pri
	return nil
}

func (r *RFC5424) parseVersion() error {
	if r.buf[r.position] != '1' {
		return errors.New("version must be 1")
	}
	r.position += 2
	if r.position >= r.len {
		return errors.New("version must be followed by a space")
	}
	return nil
}

func (r *RFC5424) parseTimestamp() error {
	timestamp := []byte{}

	if r.buf[r.position] == NIL_VALUE {
		r.Timestamp = time.Now().UTC().Round(0)
		r.position += 2
		return nil
	}

	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			break
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure complete frames reach the parser: for TCP syslog use octet counting so partial reads are not parsed.
2. Check the sender isn't emitting empty/truncated messages.
3. Log the raw incomplete line and trace which source/framing produces it.

Example fix

// before (line ends after version)
parser.Parse([]byte("<34>1"))
// after (version followed by space and timestamp)
parser.Parse([]byte("<34>1 2024-01-01T00:00:00Z host app 1 - msg"))

// Go: require more than '<PRI>1' before parsing
func hasHeaderTail(line []byte) bool {
	i := bytes.IndexByte(line, '>')
	return i > 0 && len(line) > i+3 && line[i+1] == '1' && line[i+2] == ' '
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "followed by a space") {
		// hold the fragment and wait for the rest of the frame
	}
}

When it happens

Trigger: Calling RFC5424.Parse on a message that ends after "<34>1", e.g. "<34>1" or "<34>1\n" — after position += 2, position >= r.len.

Common situations: A truncated syslog frame from a TCP stream split mid-header, an empty-ish test message, or a device emitting only the header when it has nothing to log.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• PRI must end with '>'
• EOL after timestamp
• EOL after PRI
• EOL after Version
• EOL after Timestamp

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/92aada3b1f100979. Report an issue: GitHub.