apache/cassandra · error · ConfigurationException

Can't enable audit log archiving via nodetool unless audit_l

Error message

Can't enable audit log archiving via nodetool unless audit_logging_options.allow_nodetool_archive_command is set to true

What it means

StorageService.enableAuditLog() allows an archiveCommand to be supplied via nodetool/JMX, but for security reasons this is blocked unless the cassandra.yaml option audit_logging_options.allow_nodetool_archive_command is explicitly true. A ConfigurationException is thrown when an archive command is passed while the flag is disabled.

Source

Thrown at src/java/org/apache/cassandra/service/StorageService.java:5129

                       maxArchiveRetries, block, rollCycle, maxLogSize, maxQueueWeight, archiveCommand);
    }

    /** @deprecated See CASSANDRA-16725 */
    @Deprecated(since = "4.1")
    public void enableAuditLog(String loggerName, Map<String, String> parameters, String includedKeyspaces, String excludedKeyspaces, String includedCategories, String excludedCategories,
                               String includedUsers, String excludedUsers) throws ConfigurationException, IllegalStateException
    {
        enableAuditLog(loggerName, parameters, includedKeyspaces, excludedKeyspaces, includedCategories, excludedCategories, includedUsers, excludedUsers,
                       Integer.MIN_VALUE, null, null, Long.MIN_VALUE, Integer.MIN_VALUE, null);
    }

    public void enableAuditLog(String loggerName, Map<String, String> parameters, String includedKeyspaces, String excludedKeyspaces, String includedCategories, String excludedCategories,
                               String includedUsers, String excludedUsers, Integer maxArchiveRetries, Boolean block, String rollCycle,
                               Long maxLogSize, Integer maxQueueWeight, String archiveCommand) throws IllegalStateException
    {
        AuditLogOptions auditOptions = DatabaseDescriptor.getAuditLoggingOptions();
        if (archiveCommand != null && !auditOptions.allow_nodetool_archive_command)
            throw new ConfigurationException("Can't enable audit log archiving via nodetool unless audit_logging_options.allow_nodetool_archive_command is set to true");

        final AuditLogOptions options = new AuditLogOptions.Builder(auditOptions)
                                        .withEnabled(true)
                                        .withLogger(loggerName, parameters)
                                        .withIncludedKeyspaces(includedKeyspaces)
                                        .withExcludedKeyspaces(excludedKeyspaces)
                                        .withIncludedCategories(includedCategories)
                                        .withExcludedCategories(excludedCategories)
                                        .withIncludedUsers(includedUsers)
                                        .withExcludedUsers(excludedUsers)
                                        .withMaxArchiveRetries(maxArchiveRetries)
                                        .withBlock(block)
                                        .withRollCycle(rollCycle)
                                        .withMaxLogSize(maxLogSize)
                                        .withMaxQueueWeight(maxQueueWeight)
                                        .withArchiveCommand(archiveCommand)
                                        .build();

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Set audit_logging_options.allow_nodetool_archive_command: true in cassandra.yaml and restart the node.
Omit the archiveCommand parameter and rely on the pre-configured archive_command from cassandra.yaml.
If archiving is managed externally (e.g., log shipping), drop the archive command from the call entirely.

Example fix

// before (cassandra.yaml)
audit_logging_options:
  enabled: false
// after (cassandra.yaml)
audit_logging_options:
  allow_nodetool_archive_command: true
// then restart and run nodetool enableauditlog --archive-command <cmd>

Defensive patterns

Strategy: validation

Validate before calling

AuditLogOptions o = DatabaseDescriptor.getAuditLoggingOptions();
if (archiveCommand != null && !o.allow_nodetool_archive_command)
    throw new IllegalArgumentException("set audit_logging_options.allow_nodetool_archive_command: true first");

Try / catch

try { ss.enableAuditLog(..., archiveCommand); } catch (ConfigurationException e) { log.error("archiving via nodetool disallowed: {}", e.getMessage()); }

Prevention

Set allow_nodetool_archive_command: true in cassandra.yaml if runtime archiving is intended.
Omit archiveCommand and pre-configure it in yaml instead.
Treat nodetool-supplied archive commands as privileged/security-sensitive.
Keep archive commands out of generic automation templates for hardened clusters.

When it happens

Trigger: Calling enableAuditLog(..., archiveCommand=<cmd>) with a non-null archiveCommand while allow_nodetool_archive_command is false (the default) in cassandra.yaml.

Common situations: Operators enabling audit log archiving at runtime via nodetool enableauditlog --archive-command; hardened clusters where the flag is deliberately left off; scripts copied from environments where the flag was enabled.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/0a07f480dbc75d3d. Report an issue: GitHub.