apache/cassandra · error · java.lang.IllegalArgumentException

denylist_max_keys_per_table must be a positive integer.

Error message

denylist_max_keys_per_table must be a positive integer.

What it means

DatabaseDescriptor.setDenylistMaxKeysPerTable validates its argument before storing it in the runtime configuration. A value of zero or negative would disable or corrupt the denylist size accounting, so the setter rejects it with IllegalArgumentException. This guard exists because the value is a live-updatable config knob, not just a startup-time YAML field.

Source

Thrown at src/java/org/apache/cassandra/config/DatabaseDescriptor.java:5572

    public static ConsistencyLevel getDenylistConsistencyLevel()
    {
        return conf.denylist_consistency_level;
    }

    public static void setDenylistConsistencyLevel(ConsistencyLevel cl)
    {
        conf.denylist_consistency_level = cl;
    }

    public static int getDenylistMaxKeysPerTable()
    {
        return conf.denylist_max_keys_per_table;
    }

    public static void setDenylistMaxKeysPerTable(int value)
    {
        if (value <= 0)
            throw new IllegalArgumentException("denylist_max_keys_per_table must be a positive integer.");
        conf.denylist_max_keys_per_table = value;
    }

    public static int getDenylistMaxKeysTotal()
    {
        return conf.denylist_max_keys_total;
    }

    public static void setDenylistMaxKeysTotal(int value)
    {
        if (value <= 0)
            throw new IllegalArgumentException("denylist_max_keys_total must be a positive integer.");
        conf.denylist_max_keys_total = value;
    }

    public static boolean getAuthCacheWarmingEnabled()
    {
        return conf.auth_cache_warming_enabled;

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Pass a positive integer (>= 1) to setDenylistMaxKeysPerTable.
2. Fix the value in cassandra.yaml or the config source feeding the setter.
3. If you intended to disable denylisting, use the dedicated enable/disable flag instead of setting the limit to 0.

Example fix

// before
DatabaseDescriptor.setDenylistMaxKeysPerTable(0);
// after
DatabaseDescriptor.setDenylistMaxKeysPerTable(1000);

if (value >= 1) DatabaseDescriptor.setDenylistMaxKeysPerTable(value);

boolean isValidDenylistLimit(int v) { return v > 0; }

try { DatabaseDescriptor.setDenylistMaxKeysPerTable(value); } catch (IllegalArgumentException e) { log.error("bad denylist_max_keys_per_table", e); }

When it happens

Trigger: Calling DatabaseDescriptor.setDenylistMaxKeysPerTable(0) or any negative int, either programmatically in tests/tools or via a JMX/config-management path that relays a bad value.

Common situations: Operators scripting configuration changes pass 0 thinking it means 'unlimited' or 'disabled'; YAML migrations or templating emit an empty/zero value; tooling subtracts values yielding negatives.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• denylist_max_keys_total must be a positive integer.
• Maximum number of workers must not be negative
• Invalid data rate: value must be non-negative
• Invalid data storage: %s Accepted units:%s
• Invalid value of entire_sstable_stream_throughput_outbound:

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/d8ed1fd79a499843. Report an issue: GitHub.