apache/cassandra · error · ConfigurationException

Can't enable full query log archiving via nodetool unless fu

Error message

Can't enable full query log archiving via nodetool unless full_query_logging_options.allow_nodetool_archive_command is set to true

What it means

StorageService.enableFullQueryLog() similarly permits an archiveCommand argument, but passing one is refused with a ConfigurationException unless full_query_logging_options.allow_nodetool_archive_command is true in cassandra.yaml. This prevents arbitrary command execution through the runtime-tuning interface.

Source

Thrown at src/java/org/apache/cassandra/service/StorageService.java:5235

    public void shutdownServer()
    {
        if (drainOnShutdown != null)
        {
            Runtime.getRuntime().removeShutdownHook(drainOnShutdown);
        }
    }

    @Override
    public void enableFullQueryLogger(String path, String rollCycle, Boolean blocking, int maxQueueWeight, long maxLogSize, String archiveCommand, int maxArchiveRetries)
    {
        FullQueryLoggerOptions fqlOptions = DatabaseDescriptor.getFullQueryLogOptions();
        path = path != null ? path : fqlOptions.log_dir;
        rollCycle = rollCycle != null ? rollCycle : fqlOptions.roll_cycle;
        blocking = blocking != null ? blocking : fqlOptions.block;
        maxQueueWeight = maxQueueWeight != Integer.MIN_VALUE ? maxQueueWeight : fqlOptions.max_queue_weight;
        maxLogSize = maxLogSize != Long.MIN_VALUE ? maxLogSize : fqlOptions.max_log_size;
        if (archiveCommand != null && !fqlOptions.allow_nodetool_archive_command)
            throw new ConfigurationException("Can't enable full query log archiving via nodetool unless full_query_logging_options.allow_nodetool_archive_command is set to true");
        archiveCommand = archiveCommand != null ? archiveCommand : fqlOptions.archive_command;
        maxArchiveRetries = maxArchiveRetries != Integer.MIN_VALUE ? maxArchiveRetries : fqlOptions.max_archive_retries;

        checkNotNull(path, "cassandra.yaml did not set log_dir and not set as parameter");
        FullQueryLogger.instance.enableWithoutClean(File.getPath(path), rollCycle, blocking, maxQueueWeight, maxLogSize, archiveCommand, maxArchiveRetries);
    }

    @Override
    public void resetFullQueryLogger()
    {
        FullQueryLogger.instance.reset(DatabaseDescriptor.getFullQueryLogOptions().log_dir);
    }

    @Override
    public void stopFullQueryLogger()
    {
        FullQueryLogger.instance.stop();
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Set full_query_logging_options.allow_nodetool_archive_command: true in cassandra.yaml and restart.
2. Rely on full_query_logging_options.archive_command configured in yaml instead of passing one at runtime.
3. Remove the archive-command argument from the nodetool call if archiving is not needed.

Example fix

// before (cassandra.yaml)
full_query_logging_options:
  log_dir: /var/log/cassandra/fql
// after (cassandra.yaml)
full_query_logging_options:
  log_dir: /var/log/cassandra/fql
  allow_nodetool_archive_command: true
// restart, then nodetool enablefullquerylog --archive-command <cmd>

if (archiveCommand != null && !fqlOptions.allow_nodetool_archive_command)
    throw new IllegalArgumentException("set full_query_logging_options.allow_nodetool_archive_command: true first");

try { ss.enableFullQueryLog(..., archiveCommand); } catch (ConfigurationException e) { log.error("FQL archiving via nodetool disallowed: {}", e.getMessage()); }

When it happens

Trigger: Calling enableFullQueryLog(..., archiveCommand=<cmd>) with a non-null archiveCommand while full_query_logging_options.allow_nodetool_archive_command is false (the default).

Common situations: Enabling FQL archiving at runtime via nodetool enablefullquerylog --archive-command on a cluster whose yaml still has the default (disallowed); security-hardened environments; scripts reused across clusters with different yaml settings.

Related errors

• Can't enable audit log archiving via nodetool unless audit_l
• JAAS login configuration missing for JMX authenticator setup
• Access denied
• Access Denied
• Access is denied!

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/bc10cd9cb852a41e. Report an issue: GitHub.