{"record":{"id":"30b09579e9f865a3","repo":"stamparm/maltrail","slug":"invalid-configuration-value-for-log-server-log-server","errorCode":null,"errorMessage":"invalid configuration value for 'LOG_SERVER' ('{log_server}')","messagePattern":"invalid configuration value for 'LOG_SERVER' \\('(.+?)'\\)","errorType":"validation","errorClass":"ConfigError","httpStatus":null,"severity":"error","filePath":"sensor/src/config.rs","lineNumber":772,"sourceCode":"                \"[!] unknown configuration option '{}' in configuration file '{}' (typo? see 'maltrail.conf' for the accepted names)\",\n                name,\n                config_file.display()\n            );\n        }\n\n        let capture_buffer_raw = get_str(&raw, \"CAPTURE_BUFFER\");\n        let capture_buffer = if capture_buffer_raw.is_empty() {\n            0\n        } else {\n            let bytes = parse_byte_size(&capture_buffer_raw).map_err(|e| {\n                ConfigError(format!(\"invalid configuration value for 'CAPTURE_BUFFER' ('{capture_buffer_raw}'): {e}\"))\n            })?;\n            bytes / BLOCK_LENGTH * BLOCK_LENGTH\n        };\n\n        let log_server = get_str(&raw, \"LOG_SERVER\");\n        if !log_server.is_empty() && !log_server.contains(':') {\n            bail!(\"invalid configuration value for 'LOG_SERVER' ('{log_server}')\");\n        }\n        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM\n        // collectors (issue #15164). Every one of them is validated: a typo in the second target\n        // is exactly as fatal as one in the first, and silently forwarding to one of two\n        // configured collectors is the kind of half-working that goes unnoticed for months.\n        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:\n        // the events go out unsigned and the listener accepts anything that reaches it.\n        let log_server_secret = get_str(&raw, \"LOG_SERVER_SECRET\");\n\n        let syslog_server = get_str(&raw, \"SYSLOG_SERVER\");\n        for endpoint in split_endpoints(&syslog_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')\");\n            }\n        }\n        let logstash_server = get_str(&raw, \"LOGSTASH_SERVER\");\n        for endpoint in split_endpoints(&logstash_server) {\n            if parse_host_port(endpoint).1.is_none() {","sourceCodeStart":754,"sourceCodeEnd":790,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/config.rs#L754-L790","documentation":"The LOG_SERVER option must be either empty or a host:port endpoint. After reading it with get_str, the parser rejects any non-empty value that does not contain a colon, because a datagram target without a port cannot be used to send events to a SIEM collector.","triggerScenarios":"Setting LOG_SERVER in the config to a bare hostname or IP without a port, e.g. LOG_SERVER=siem.example.com or LOG_SERVER=10.0.0.5, then starting the sensor.","commonSituations":"Admins pasting just the collector hostname from a runbook; assuming a default port is applied like some syslog clients do; forgetting the port when switching from another agent that defaulted to 514.","solutions":["Append a port to LOG_SERVER, e.g. LOG_SERVER=siem.example.com:514.","If you do not intend to ship events to a remote collector, remove the LOG_SERVER line or leave it empty.","If several collectors are configured, confirm every listed endpoint includes host:port (all are validated)."],"exampleFix":"// before (config.conf)\nLOG_SERVER=siem.example.com\n\n// after (config.conf)\nLOG_SERVER=siem.example.com:514","handlingStrategy":"validation","validationCode":"let log_server = get_str(&raw, \"LOG_SERVER\");\nlet ok = log_server.is_empty() || log_server.contains(':');\nif !ok { eprintln!(\"LOG_SERVER must be empty or host:port, got '{log_server}'\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write endpoints as host:port; never rely on a default port.","Validate config values with a lint script before deployment.","Document collector ports in your runbook next to the hostname."],"tags":["rust","configuration","logging"],"backgroundTag":"invalid-config-value","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}