cilium/cilium · error

unexpected event buffer config value format, should be in fo

Error message

unexpected event buffer config value format, should be in format 'mapname=enabled_100_24h'

What it means

ParseEventBufferTupleString parses a BPF event-buffer config string of the form 'mapname=enabled_maxSize_ttl' (e.g. 'enabled_100_24h'). The string is split on '_' and must yield exactly 3 parts; this error is thrown when the split count differs, meaning the value is malformed.

Source

Thrown at pkg/option/config.go:3570

// GetEventBufferConfig returns either the relevant config for a map name, or a default
// one with enabled=false otherwise.
func (d *DaemonConfig) GetEventBufferConfig(name string) BPFEventBufferConfig {
	return d.bpfMapEventConfigs.get(name)
}

func (cs BPFEventBufferConfigs) get(name string) BPFEventBufferConfig {
	return cs[name]
}

// ParseEventBufferTupleString parses a event buffer configuration tuple string.
// For example: enabled_100_24h
// Which refers to enabled=true, maxSize=100, ttl=24hours.
func ParseEventBufferTupleString(optsStr string) (BPFEventBufferConfig, error) {
	opts := strings.Split(optsStr, "_")
	enabled := false
	conf := BPFEventBufferConfig{}
	if len(opts) != 3 {
		return conf, fmt.Errorf("unexpected event buffer config value format, should be in format 'mapname=enabled_100_24h'")
	}

	if opts[0] != "enabled" && opts[0] != "disabled" {
		return conf, fmt.Errorf("could not parse event buffer enabled: must be either 'enabled' or 'disabled'")
	}
	if opts[0] == "enabled" {
		enabled = true
	}
	size, err := strconv.Atoi(opts[1])
	if err != nil {
		return conf, fmt.Errorf("could not parse event buffer maxSize int: %w", err)
	}
	ttl, err := time.ParseDuration(opts[2])
	if err != nil {
		return conf, fmt.Errorf("could not parse event buffer ttl duration: %w", err)
	}
	if size < 0 {
		return conf, fmt.Errorf("event buffer max size cannot be less than zero (%d)", conf.MaxSize)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Fix the value to have exactly three underscore-separated parts: enabled|disabled_maxSize_ttlDuration (e.g. 'enabled_100_24h').
2. Ensure the whole option string follows 'mapname=enabled_100_24h' including the map name and '=' prefix.
3. Quote or escape the value in your shell/manifest so it is not split or truncated before parsing.

Example fix

// before
--bpf-map-event-buffers=tracepoint_100_24h
// after
--bpf-map-event-buffers=tracepoint_syscalls=enabled_100_24h

parts := strings.Split(value, "_")
if len(parts) != 3 {
    return fmt.Errorf("event buffer tuple %q must be 'enabled|disabled_<size>_<ttl>'", value)
}

func isValidEventBufferTuple(s string) bool {
	parts := strings.Split(s, "_")
	return len(parts) == 3 && (parts[0] == "enabled" || parts[0] == "disabled")
}

conf, err := ParseEventBufferTupleString(cfgStr)
if err != nil {
	return fmt.Errorf("bad event buffer config %q: %w", cfgStr, err)
}

When it happens

Trigger: Calling ParseEventBufferTupleString with a string that, after splitting on '_', does not produce exactly 3 tokens — e.g. 'enabled_100', 'enabled_100_24h_extra', or a value missing the mapname=prefix format entirely.

Common situations: Users hand-editing ConfigMap/agent flags for BPFMapEventBuffers misspell the tuple, use commas or spaces instead of underscores, or supply only 'enabled' without size and TTL.

Related errors

• could not parse event buffer enabled: must be either 'enable
• could not parse event buffer maxSize int: %w
• could not parse event buffer ttl duration: %w
• event buffer max size cannot be less than zero (%d)
• unable to parse %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/af15aa991720d075. Report an issue: GitHub.