apache/cassandra · error · java.lang.IllegalArgumentException

denylist_max_keys_total must be a positive integer.

Error message

denylist_max_keys_total must be a positive integer.

What it means

DatabaseDescriptor.setDenylistMaxKeysTotal enforces that the cluster-wide denylist key limit is a positive integer. Zero or negative totals would break denylist accounting across tables, so the setter throws IllegalArgumentException before mutating conf.

Source

Thrown at src/java/org/apache/cassandra/config/DatabaseDescriptor.java:5584

        return conf.denylist_max_keys_per_table;
    }

    public static void setDenylistMaxKeysPerTable(int value)
    {
        if (value <= 0)
            throw new IllegalArgumentException("denylist_max_keys_per_table must be a positive integer.");
        conf.denylist_max_keys_per_table = value;
    }

    public static int getDenylistMaxKeysTotal()
    {
        return conf.denylist_max_keys_total;
    }

    public static void setDenylistMaxKeysTotal(int value)
    {
        if (value <= 0)
            throw new IllegalArgumentException("denylist_max_keys_total must be a positive integer.");
        conf.denylist_max_keys_total = value;
    }

    public static boolean getAuthCacheWarmingEnabled()
    {
        return conf.auth_cache_warming_enabled;
    }

    public static SubnetGroups getClientErrorReportingExclusions()
    {
        return conf.client_error_reporting_exclusions;
    }

    public static SubnetGroups getInternodeErrorReportingExclusions()
    {
        return conf.internode_error_reporting_exclusions;
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Pass a positive integer (>= 1) to setDenylistMaxKeysTotal.
2. Correct the denylist_max_keys_total value in cassandra.yaml and reload.
3. Use the denylist enable/disable option rather than a zero total to turn the feature off.

Example fix

// before
DatabaseDescriptor.setDenylistMaxKeysTotal(-5);
// after
DatabaseDescriptor.setDenylistMaxKeysTotal(5000);

if (value >= 1) DatabaseDescriptor.setDenylistMaxKeysTotal(value);

boolean isValidDenylistTotal(int v) { return v > 0; }

try { DatabaseDescriptor.setDenylistMaxKeysTotal(value); } catch (IllegalArgumentException e) { log.error("bad denylist_max_keys_total", e); }

When it happens

Trigger: Calling DatabaseDescriptor.setDenylistMaxKeysTotal(0) or a negative value, programmatically or via a live-config update path.

Common situations: Operators use 0 to mean 'no limit'; automated config generators emit unset/zero numeric fields; arithmetic on existing limits produces 0 or negatives.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• denylist_max_keys_per_table must be a positive integer.
• Maximum number of workers must not be negative
• Invalid data rate: value must be non-negative
• Invalid data storage: %s Accepted units:%s
• Invalid value of entire_sstable_stream_throughput_outbound:

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/c46d742b52ca5c5c. Report an issue: GitHub.