{"record":{"id":"0566b2ae20eb7539","repo":"stamparm/maltrail","slug":"invalid-configuration-value-for-syslog-server-endpoint","errorCode":null,"errorMessage":"invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')","messagePattern":"invalid configuration value for 'SYSLOG_SERVER' \\('(.+?)'\\)","errorType":"validation","errorClass":"ConfigError","httpStatus":null,"severity":"error","filePath":"sensor/src/config.rs","lineNumber":785,"sourceCode":"            bytes / BLOCK_LENGTH * BLOCK_LENGTH\n        };\n\n        let log_server = get_str(&raw, \"LOG_SERVER\");\n        if !log_server.is_empty() && !log_server.contains(':') {\n            bail!(\"invalid configuration value for 'LOG_SERVER' ('{log_server}')\");\n        }\n        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM\n        // collectors (issue #15164). Every one of them is validated: a typo in the second target\n        // is exactly as fatal as one in the first, and silently forwarding to one of two\n        // configured collectors is the kind of half-working that goes unnoticed for months.\n        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:\n        // the events go out unsigned and the listener accepts anything that reaches it.\n        let log_server_secret = get_str(&raw, \"LOG_SERVER_SECRET\");\n\n        let syslog_server = get_str(&raw, \"SYSLOG_SERVER\");\n        for endpoint in split_endpoints(&syslog_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')\");\n            }\n        }\n        let logstash_server = get_str(&raw, \"LOGSTASH_SERVER\");\n        for endpoint in split_endpoints(&logstash_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')\");\n            }\n        }\n        let remote_severity_regex = get_str(&raw, \"REMOTE_SEVERITY_REGEX\");\n        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {\n            bail!(\"invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')\");\n        }\n\n        let update_period = match get_u64(&raw, \"UPDATE_PERIOD\") {\n            Some(v) => v,\n            None => bail!(\"invalid configuration value for 'UPDATE_PERIOD' ('{}')\", get_str(&raw, \"UPDATE_PERIOD\")),\n        };\n","sourceCodeStart":767,"sourceCodeEnd":803,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/config.rs#L767-L803","documentation":"SYSLOG_SERVER may list several endpoints; each is split with split_endpoints and must parse as host:port via parse_host_port. If any endpoint's port part is missing (parse_host_port returns None for the port), the parser bails naming the offending endpoint.","triggerScenarios":"Configuring SYSLOG_SERVER with one or more comma-separated endpoints where at least one lacks a :port suffix, e.g. SYSLOG_SERVER=syslog1.example.com,syslog2.example.com:514 (first endpoint is invalid).","commonSituations":"Adding redundant syslog collectors where only some entries got ports; copying hostnames from DNS records; assuming syslog's traditional default port 514 is implied by the library (it is not).","solutions":["Add an explicit port to every SYSLOG_SERVER endpoint, e.g. SYSLOG_SERVER=syslog1.example.com:514,syslog2.example.com:514.","Check the exact endpoint quoted in the error message — with multiple endpoints only the invalid one is named.","Verify separator handling: ensure endpoints are properly split (no stray spaces/quotes) so host:port parsing sees the colon.","Clear the option if remote syslog is not used."],"exampleFix":"// before (config.conf)\nSYSLOG_SERVER=syslog1.example.com,syslog2.example.com:514\n\n// after (config.conf)\nSYSLOG_SERVER=syslog1.example.com:514,syslog2.example.com:514","handlingStrategy":"validation","validationCode":"let syslog_server = get_str(&raw, \"SYSLOG_SERVER\");\nfor endpoint in syslog_server.split(',') {\n    if !endpoint.trim().is_empty() && parse_host_port(endpoint.trim()).1.is_none() {\n        eprintln!(\"SYSLOG_SERVER endpoint '{endpoint}' lacks a :port\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Give every comma-separated endpoint an explicit port.","Keep a config template with ports filled in (usually :514).","Validate all endpoints after any edit that adds a collector."],"tags":["rust","configuration","syslog"],"backgroundTag":"invalid-config-value","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}