stamparm/maltrail · error · ConfigError

invalid configuration value for 'SYSLOG_SERVER

Error message

invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')

What it means

SYSLOG_SERVER may list several endpoints; each is split with split_endpoints and must parse as host:port via parse_host_port. If any endpoint's port part is missing (parse_host_port returns None for the port), the parser bails naming the offending endpoint.

Solutions

1. Add an explicit port to every SYSLOG_SERVER endpoint, e.g. SYSLOG_SERVER=syslog1.example.com:514,syslog2.example.com:514.
2. Check the exact endpoint quoted in the error message — with multiple endpoints only the invalid one is named.
3. Verify separator handling: ensure endpoints are properly split (no stray spaces/quotes) so host:port parsing sees the colon.
4. Clear the option if remote syslog is not used.

Example fix

// before (config.conf)
SYSLOG_SERVER=syslog1.example.com,syslog2.example.com:514

// after (config.conf)
SYSLOG_SERVER=syslog1.example.com:514,syslog2.example.com:514

let syslog_server = get_str(&raw, "SYSLOG_SERVER");
for endpoint in syslog_server.split(',') {
    if !endpoint.trim().is_empty() && parse_host_port(endpoint.trim()).1.is_none() {
        eprintln!("SYSLOG_SERVER endpoint '{endpoint}' lacks a :port");
    }
}

When it happens

Trigger: Configuring SYSLOG_SERVER with one or more comma-separated endpoints where at least one lacks a :port suffix, e.g. SYSLOG_SERVER=syslog1.example.com,syslog2.example.com:514 (first endpoint is invalid).

Common situations: Adding redundant syslog collectors where only some entries got ports; copying hostnames from DNS records; assuming syslog's traditional default port 514 is implied by the library (it is not).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid USERS entry ' ' [?] (hint: add whitespace at start…
• invalid configuration
• missing configuration file
• missing mandatory option
• invalid configuration value for 'LOG_SERVER

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/0566b2ae20eb7539. Report an issue: GitHub.

Appendix: source

Thrown at sensor/src/config.rs:785

            bytes / BLOCK_LENGTH * BLOCK_LENGTH
        };

        let log_server = get_str(&raw, "LOG_SERVER");
        if !log_server.is_empty() && !log_server.contains(':') {
            bail!("invalid configuration value for 'LOG_SERVER' ('{log_server}')");
        }
        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM
        // collectors (issue #15164). Every one of them is validated: a typo in the second target
        // is exactly as fatal as one in the first, and silently forwarding to one of two
        // configured collectors is the kind of half-working that goes unnoticed for months.
        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:
        // the events go out unsigned and the listener accepts anything that reaches it.
        let log_server_secret = get_str(&raw, "LOG_SERVER_SECRET");

        let syslog_server = get_str(&raw, "SYSLOG_SERVER");
        for endpoint in split_endpoints(&syslog_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')");
            }
        }
        let logstash_server = get_str(&raw, "LOGSTASH_SERVER");
        for endpoint in split_endpoints(&logstash_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')");
            }
        }
        let remote_severity_regex = get_str(&raw, "REMOTE_SEVERITY_REGEX");
        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {
            bail!("invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')");
        }

        let update_period = match get_u64(&raw, "UPDATE_PERIOD") {
            Some(v) => v,
            None => bail!("invalid configuration value for 'UPDATE_PERIOD' ('{}')", get_str(&raw, "UPDATE_PERIOD")),
        };

View on GitHub (pinned to 77cfb06d76)