stamparm/maltrail · error · ConfigError

invalid configuration value for 'REMOTE_SEVERITY_REGEX

Error message

invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')

What it means

REMOTE_SEVERITY_REGEX, when set, is compiled as a fancy regex via crate::pyre::build_fancy. If compilation fails, the config loader bails with this message echoing the bad pattern. Empty values are allowed and disable the feature.

Solutions

1. Test the pattern in a regex validator and fix the syntax error (unbalanced groups, bad escapes).
2. Verify the construct is supported by the sensor's fancy regex engine (crate::pyre::build_fancy), not just by PCRE.
3. If the value came from a templating system, check that backslashes were not doubled or stripped during substitution.
4. Leave the option empty to disable remote severity filtering.

Example fix

// before (config.conf)
REMOTE_SEVERITY_REGEX=(?<=err)or\q*

// after (config.conf)
REMOTE_SEVERITY_REGEX=(err|crit|alert)

let regex = get_str(&raw, "REMOTE_SEVERITY_REGEX");
if !regex.is_empty() {
    // compile with the same engine the sensor uses
    if crate::pyre::build_fancy(&regex).is_err() {
        eprintln!("REMOTE_SEVERITY_REGEX is not a valid fancy regex: {regex}");
    }
}

When it happens

Trigger: Configuring REMOTE_SEVERITY_REGEX with a syntactically invalid or unsupported regex (e.g. unbalanced parentheses, invalid escape like \q, unsupported look-behind syntax) and starting the sensor.

Common situations: Regexes copied from other engines (PCRE-only constructs the fancy engine rejects); hand-edited patterns with a dropped bracket; quoting issues where the shell/config layer ate a backslash.

Related errors

• invalid USERS entry ' ' [?] (hint: add whitespace at start…
• invalid configuration
• missing configuration file
• missing mandatory option
• invalid configuration value for 'LOG_SERVER

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/c6c14274878bdde0. Report an issue: GitHub.

Appendix: source

Thrown at sensor/src/config.rs:796

        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:
        // the events go out unsigned and the listener accepts anything that reaches it.
        let log_server_secret = get_str(&raw, "LOG_SERVER_SECRET");

        let syslog_server = get_str(&raw, "SYSLOG_SERVER");
        for endpoint in split_endpoints(&syslog_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')");
            }
        }
        let logstash_server = get_str(&raw, "LOGSTASH_SERVER");
        for endpoint in split_endpoints(&logstash_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')");
            }
        }
        let remote_severity_regex = get_str(&raw, "REMOTE_SEVERITY_REGEX");
        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {
            bail!("invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')");
        }

        let update_period = match get_u64(&raw, "UPDATE_PERIOD") {
            Some(v) => v,
            None => bail!("invalid configuration value for 'UPDATE_PERIOD' ('{}')", get_str(&raw, "UPDATE_PERIOD")),
        };

        let user_whitelist = {
            let v = get_str(&raw, "USER_WHITELIST");
            if v.is_empty() {
                None
            } else if v.contains(',') {
                crate::cprintln!("[x] configuration value 'USER_WHITELIST' has been changed. Please use it to set location of whitelist file");
                None
            } else {
                let p = normalize_path(&root, &v);
                if !p.is_file() {
                    bail!("missing 'USER_WHITELIST' file '{}'", p.display());

View on GitHub (pinned to 77cfb06d76)