What causes "invalid configuration value for 'LOG_SERVER' ('{log_server}')" in stamparm/maltrail?

Append a port to LOG_SERVER, e.g. LOG_SERVER=siem.example.com:514.

stamparm/maltrail · error · ConfigError

invalid configuration value for 'LOG_SERVER

Error message

invalid configuration value for 'LOG_SERVER' ('{log_server}')

What it means

The LOG_SERVER option must be either empty or a host:port endpoint. After reading it with get_str, the parser rejects any non-empty value that does not contain a colon, because a datagram target without a port cannot be used to send events to a SIEM collector.

Solutions

Append a port to LOG_SERVER, e.g. LOG_SERVER=siem.example.com:514.
If you do not intend to ship events to a remote collector, remove the LOG_SERVER line or leave it empty.
If several collectors are configured, confirm every listed endpoint includes host:port (all are validated).

Example fix

// before (config.conf)
LOG_SERVER=siem.example.com

// after (config.conf)
LOG_SERVER=siem.example.com:514

Defensive patterns

Strategy: validation

Validate before calling

let log_server = get_str(&raw, "LOG_SERVER");
let ok = log_server.is_empty() || log_server.contains(':');
if !ok { eprintln!("LOG_SERVER must be empty or host:port, got '{log_server}'"); }

Prevention

Always write endpoints as host:port; never rely on a default port.
Validate config values with a lint script before deployment.
Document collector ports in your runbook next to the hostname.

When it happens

Trigger: Setting LOG_SERVER in the config to a bare hostname or IP without a port, e.g. LOG_SERVER=siem.example.com or LOG_SERVER=10.0.0.5, then starting the sensor.

Common situations: Admins pasting just the collector hostname from a runbook; assuming a default port is applied like some syslog clients do; forgetting the port when switching from another agent that defaulted to 514.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/30b09579e9f865a3. Report an issue: GitHub.

Appendix: source

Thrown at sensor/src/config.rs:772

                "[!] unknown configuration option '{}' in configuration file '{}' (typo? see 'maltrail.conf' for the accepted names)",
                name,
                config_file.display()
            );
        }

        let capture_buffer_raw = get_str(&raw, "CAPTURE_BUFFER");
        let capture_buffer = if capture_buffer_raw.is_empty() {
            0
        } else {
            let bytes = parse_byte_size(&capture_buffer_raw).map_err(|e| {
                ConfigError(format!("invalid configuration value for 'CAPTURE_BUFFER' ('{capture_buffer_raw}'): {e}"))
            })?;
            bytes / BLOCK_LENGTH * BLOCK_LENGTH
        };

        let log_server = get_str(&raw, "LOG_SERVER");
        if !log_server.is_empty() && !log_server.contains(':') {
            bail!("invalid configuration value for 'LOG_SERVER' ('{log_server}')");
        }
        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM
        // collectors (issue #15164). Every one of them is validated: a typo in the second target
        // is exactly as fatal as one in the first, and silently forwarding to one of two
        // configured collectors is the kind of half-working that goes unnoticed for months.
        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:
        // the events go out unsigned and the listener accepts anything that reaches it.
        let log_server_secret = get_str(&raw, "LOG_SERVER_SECRET");

        let syslog_server = get_str(&raw, "SYSLOG_SERVER");
        for endpoint in split_endpoints(&syslog_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')");
            }
        }
        let logstash_server = get_str(&raw, "LOGSTASH_SERVER");
        for endpoint in split_endpoints(&logstash_server) {
            if parse_host_port(endpoint).1.is_none() {

View on GitHub (pinned to 77cfb06d76)