stamparm/maltrail · error · ConfigError

invalid configuration value for 'OFFLINE_TIMESTAMPS

Error message

invalid configuration value for 'OFFLINE_TIMESTAMPS' ('{other}')

What it means

Config::load validates the OFFLINE_TIMESTAMPS key and bails with this message when the value matches none of the accepted alternatives (empty, 'pcap', 'wallclock', 'wall-clock', 'now'). It exists because a silently-misinterpreted timestamp source would corrupt offline replay timing, so any unrecognized spelling is fatal at startup.

Solutions

1. Set OFFLINE_TIMESTAMPS to one of the accepted values: 'pcap' (empty means pcap too) or 'wallclock'/'wall-clock'/'now'
2. Check for typos and stray characters in the value; the offending text is quoted in the error message
3. If you need a new source, add an arm to the match in sensor/src/config.rs rather than inventing a value

Example fix

// before
OFFLINE_TIMESTAMPS wall-clock-time
// after
OFFLINE_TIMESTAMPS wallclock

let v = raw.get("OFFLINE_TIMESTAMPS").unwrap_or("").trim().to_ascii_lowercase();
assert!(v.is_empty() || ["pcap","wallclock","wall-clock","now"].contains(&v.as_str()), "OFFLINE_TIMESTAMPS '{v}' invalid");

fn is_valid_ts_source(v: &str) -> bool {
    matches!(v.trim().to_ascii_lowercase().as_str(), "" | "pcap" | "wallclock" | "wall-clock" | "now")
}

When it happens

Trigger: Setting OFFLINE_TIMESTAMPS in the config file to any string other than '', 'pcap', 'wallclock', 'wall-clock', or 'now' (case-insensitive, trimmed), e.g. 'PCAP-TIME', 'capture', 'true', or a typo like 'wallock'.

Common situations: Hand-edited sensor configs after copying examples from old docs; an operator choosing 'wall-clock time' with extra words; environment-specific config templates carrying a value from a different product.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• must load
• config must load
• write config
• harness config must load
• write worker config

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/9efcf3de0d28b098. Report an issue: GitHub.

Appendix: source

Thrown at sensor/src/config.rs:976

                if capture_workers > 1 {
                    FanoutMode::Source
                } else {
                    FanoutMode::Hash
                }
            } else {
                match FanoutMode::parse(&v) {
                    Some(m) => m,
                    None => bail!("invalid configuration value for 'CAPTURE_FANOUT_MODE' ('{v}')"),
                }
            }
        };

        let offline_timestamps = {
            let v = get_str(&raw, "OFFLINE_TIMESTAMPS").to_ascii_lowercase();
            match v.trim() {
                "" | "pcap" => TimestampSource::Pcap,
                "wallclock" | "wall-clock" | "now" => TimestampSource::Wallclock,
                other => bail!("invalid configuration value for 'OFFLINE_TIMESTAMPS' ('{other}')"),
            }
        };

        let sensor_name = {
            let v = get_str(&raw, "SENSOR_NAME");
            if v.is_empty() {
                hostname()
            } else {
                v
            }
        };

        let mut cfg = Config {
            config_file: config_file.to_path_buf(),
            root: root.clone(),

            pcap_files: Vec::new(),
            console: false,

View on GitHub (pinned to 77cfb06d76)