{"record":{"id":"c6c14274878bdde0","repo":"stamparm/maltrail","slug":"invalid-configuration-value-for-remote-severity-regex-remote","errorCode":null,"errorMessage":"invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')","messagePattern":"invalid configuration value for 'REMOTE_SEVERITY_REGEX' \\('(.+?)'\\)","errorType":"validation","errorClass":"ConfigError","httpStatus":null,"severity":"error","filePath":"sensor/src/config.rs","lineNumber":796,"sourceCode":"        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:\n        // the events go out unsigned and the listener accepts anything that reaches it.\n        let log_server_secret = get_str(&raw, \"LOG_SERVER_SECRET\");\n\n        let syslog_server = get_str(&raw, \"SYSLOG_SERVER\");\n        for endpoint in split_endpoints(&syslog_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')\");\n            }\n        }\n        let logstash_server = get_str(&raw, \"LOGSTASH_SERVER\");\n        for endpoint in split_endpoints(&logstash_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')\");\n            }\n        }\n        let remote_severity_regex = get_str(&raw, \"REMOTE_SEVERITY_REGEX\");\n        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {\n            bail!(\"invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')\");\n        }\n\n        let update_period = match get_u64(&raw, \"UPDATE_PERIOD\") {\n            Some(v) => v,\n            None => bail!(\"invalid configuration value for 'UPDATE_PERIOD' ('{}')\", get_str(&raw, \"UPDATE_PERIOD\")),\n        };\n\n        let user_whitelist = {\n            let v = get_str(&raw, \"USER_WHITELIST\");\n            if v.is_empty() {\n                None\n            } else if v.contains(',') {\n                crate::cprintln!(\"[x] configuration value 'USER_WHITELIST' has been changed. Please use it to set location of whitelist file\");\n                None\n            } else {\n                let p = normalize_path(&root, &v);\n                if !p.is_file() {\n                    bail!(\"missing 'USER_WHITELIST' file '{}'\", p.display());","sourceCodeStart":778,"sourceCodeEnd":814,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/config.rs#L778-L814","documentation":"REMOTE_SEVERITY_REGEX, when set, is compiled as a fancy regex via crate::pyre::build_fancy. If compilation fails, the config loader bails with this message echoing the bad pattern. Empty values are allowed and disable the feature.","triggerScenarios":"Configuring REMOTE_SEVERITY_REGEX with a syntactically invalid or unsupported regex (e.g. unbalanced parentheses, invalid escape like \\q, unsupported look-behind syntax) and starting the sensor.","commonSituations":"Regexes copied from other engines (PCRE-only constructs the fancy engine rejects); hand-edited patterns with a dropped bracket; quoting issues where the shell/config layer ate a backslash.","solutions":["Test the pattern in a regex validator and fix the syntax error (unbalanced groups, bad escapes).","Verify the construct is supported by the sensor's fancy regex engine (crate::pyre::build_fancy), not just by PCRE.","If the value came from a templating system, check that backslashes were not doubled or stripped during substitution.","Leave the option empty to disable remote severity filtering."],"exampleFix":"// before (config.conf)\nREMOTE_SEVERITY_REGEX=(?<=err)or\\q*\n\n// after (config.conf)\nREMOTE_SEVERITY_REGEX=(err|crit|alert)","handlingStrategy":"validation","validationCode":"let regex = get_str(&raw, \"REMOTE_SEVERITY_REGEX\");\nif !regex.is_empty() {\n    // compile with the same engine the sensor uses\n    if crate::pyre::build_fancy(&regex).is_err() {\n        eprintln!(\"REMOTE_SEVERITY_REGEX is not a valid fancy regex: {regex}\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Test regexes in a validator using the same engine before deploying.","Avoid engine-specific constructs (PCRE look-behinds, backrefs) unless supported.","Watch for config templating that mangles backslashes."],"tags":["rust","configuration","regex"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}