What causes "cannot set metadata for %q at %s: %w" in VictoriaMetrics/VictoriaMetrics?

Inspect the wrapped error's HTTP status: 403 means the credential lacks metadata write permission.

cannot set metadata for %q at %s: %w

Error message

cannot set metadata for %q at %s: %w

What it means

Once the async copy finishes, CopyPart calls maybeSetMetadata on the destination blob. This error wraps a failure of that metadata write after the copy completed, meaning the data is copied but metadata was not applied.

Source

Thrown at lib/backup/azremote/azblob.go:249

		}

		// After the copy will be finished status will be changed to success/failed/aborted
		// Ref: https://learn.microsoft.com/en-us/rest/api/storageservices/get-blob-properties#response-headers - x-ms-copy-status
		if *r.CopyStatus != blob.CopyStatusTypePending {
			copyStatus = r.CopyStatus
			copyStatusDescription = r.CopyStatusDescription
			break
		}

		select {
		case <-fs.ctx.Done():
			return fs.ctx.Err()
		case <-time.After(5 * time.Second):
			// Continue checking
		}
	}
	if err := fs.maybeSetMetadata(dbc); err != nil {
		return fmt.Errorf("cannot set metadata for %q at %s: %w", p.Path, fs, err)
	}

	if *copyStatus != blob.CopyStatusTypeSuccess {
		return fmt.Errorf("copy of %q from %s to %s failed: expected status %q, received %q (description: %q)", p.Path, src, fs, blob.CopyStatusTypeSuccess, *copyStatus, *copyStatusDescription)
	}

	return nil
}

// DownloadPart downloads part p from fs to w.
func (fs *FS) DownloadPart(p common.Part, w io.Writer) error {
	bc := fs.clientForPart(p)

	r, err := bc.DownloadStream(fs.ctx, &blob.DownloadStreamOptions{})
	if err != nil {
		return fmt.Errorf("cannot open reader for %q at %s (remote path %q): %w", p.Path, fs, bc.URL(), err)
	}

View on GitHub (pinned to 5079fb58f1)

Solutions

Inspect the wrapped error's HTTP status: 403 means the credential lacks metadata write permission.
Retry CopyPart — the copy-from-url is idempotent per part.
Refresh credentials or grant Storage Blob Data Contributor on the destination.
Confirm the destination container allows user metadata updates.

Defensive patterns

Strategy: try-catch

Try / catch

if err := fs.CopyPart(src, part); err != nil && strings.Contains(err.Error(), "cannot set metadata") {
    // copy finished but metadata failed; safe to retry CopyPart (idempotent)
}

Prevention

Grant metadata write permission on destination credentials
Keep context alive long enough for post-copy metadata calls
Retry on transient metadata failures after copy completes
Verify SAS token includes the metadata write permission

When it happens

Trigger: fs.maybeSetMetadata(dbc) returns an error after the polling loop observed a terminal copy status: transient network failure, authorization/permission issue, or context cancellation during SetMetadata.

Common situations: SAS tokens without metadata write permission; expired tokens on long copies; transient Azure Storage 5xx responses; destination container permissions changed mid-operation.

Related errors

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/651115192e7cd48b. Report an issue: GitHub.