{"record":{"id":"9efcf3de0d28b098","repo":"stamparm/maltrail","slug":"invalid-configuration-value-for-offline-timestamps-other","errorCode":null,"errorMessage":"invalid configuration value for 'OFFLINE_TIMESTAMPS' ('{other}')","messagePattern":"invalid configuration value for 'OFFLINE_TIMESTAMPS' \\('(.+?)'\\)","errorType":"validation","errorClass":"ConfigError","httpStatus":null,"severity":"error","filePath":"sensor/src/config.rs","lineNumber":976,"sourceCode":"                if capture_workers > 1 {\n                    FanoutMode::Source\n                } else {\n                    FanoutMode::Hash\n                }\n            } else {\n                match FanoutMode::parse(&v) {\n                    Some(m) => m,\n                    None => bail!(\"invalid configuration value for 'CAPTURE_FANOUT_MODE' ('{v}')\"),\n                }\n            }\n        };\n\n        let offline_timestamps = {\n            let v = get_str(&raw, \"OFFLINE_TIMESTAMPS\").to_ascii_lowercase();\n            match v.trim() {\n                \"\" | \"pcap\" => TimestampSource::Pcap,\n                \"wallclock\" | \"wall-clock\" | \"now\" => TimestampSource::Wallclock,\n                other => bail!(\"invalid configuration value for 'OFFLINE_TIMESTAMPS' ('{other}')\"),\n            }\n        };\n\n        let sensor_name = {\n            let v = get_str(&raw, \"SENSOR_NAME\");\n            if v.is_empty() {\n                hostname()\n            } else {\n                v\n            }\n        };\n\n        let mut cfg = Config {\n            config_file: config_file.to_path_buf(),\n            root: root.clone(),\n\n            pcap_files: Vec::new(),\n            console: false,","sourceCodeStart":958,"sourceCodeEnd":994,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/config.rs#L958-L994","documentation":"Config::load validates the OFFLINE_TIMESTAMPS key and bails with this message when the value matches none of the accepted alternatives (empty, 'pcap', 'wallclock', 'wall-clock', 'now'). It exists because a silently-misinterpreted timestamp source would corrupt offline replay timing, so any unrecognized spelling is fatal at startup.","triggerScenarios":"Setting OFFLINE_TIMESTAMPS in the config file to any string other than '', 'pcap', 'wallclock', 'wall-clock', or 'now' (case-insensitive, trimmed), e.g. 'PCAP-TIME', 'capture', 'true', or a typo like 'wallock'.","commonSituations":"Hand-edited sensor configs after copying examples from old docs; an operator choosing 'wall-clock time' with extra words; environment-specific config templates carrying a value from a different product.","solutions":["Set OFFLINE_TIMESTAMPS to one of the accepted values: 'pcap' (empty means pcap too) or 'wallclock'/'wall-clock'/'now'","Check for typos and stray characters in the value; the offending text is quoted in the error message","If you need a new source, add an arm to the match in sensor/src/config.rs rather than inventing a value"],"exampleFix":"// before\nOFFLINE_TIMESTAMPS wall-clock-time\n// after\nOFFLINE_TIMESTAMPS wallclock","handlingStrategy":"validation","validationCode":"let v = raw.get(\"OFFLINE_TIMESTAMPS\").unwrap_or(\"\").trim().to_ascii_lowercase();\nassert!(v.is_empty() || [\"pcap\",\"wallclock\",\"wall-clock\",\"now\"].contains(&v.as_str()), \"OFFLINE_TIMESTAMPS '{v}' invalid\");","typeGuard":"fn is_valid_ts_source(v: &str) -> bool {\n    matches!(v.trim().to_ascii_lowercase().as_str(), \"\" | \"pcap\" | \"wallclock\" | \"wall-clock\" | \"now\")\n}","tryCatchPattern":null,"preventionTips":["Keep a canonical config template with the accepted values documented","Lint sensor configs in CI before deployment","Copy values only from current docs, not old runbooks"],"tags":["config","rust","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}