apache/cassandra · error · ConfigurationException

%s is requested but not allowed, restart cassandra with -D%s

Error message

%s is requested but not allowed, restart cassandra with -D%s=true to allow it

What it means

Setting unsafe_aggressive_sstable_expiration to 'true' is only permitted when the JVM was started with -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true. Otherwise validateOptions throws this ConfigurationException telling you the exact system property to set.

Source

Thrown at src/java/org/apache/cassandra/db/compaction/TimeWindowCompactionStrategyOptions.java:158

            if (expiredCheckFrequency < 0)
            {
                throw new ConfigurationException(String.format("%s must not be negative, but was %d", EXPIRED_SSTABLE_CHECK_FREQUENCY_SECONDS_KEY, expiredCheckFrequency));
             }
        }
        catch (NumberFormatException e)
        {
            throw new ConfigurationException(String.format("%s is not a parsable int (base10) for %s", optionValue, EXPIRED_SSTABLE_CHECK_FREQUENCY_SECONDS_KEY), e);
        }


        optionValue = options.get(UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_KEY);
        if (optionValue != null)
        {
            if (!(optionValue.equalsIgnoreCase("true") || optionValue.equalsIgnoreCase("false")))
                throw new ConfigurationException(String.format("%s is not 'true' or 'false' (%s)", UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_KEY, optionValue));

            if (optionValue.equalsIgnoreCase("true") && !UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_ENABLED)
                throw new ConfigurationException(String.format("%s is requested but not allowed, restart cassandra with -D%s=true to allow it",
                                                               UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_KEY, ALLOW_UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION.getKey()));
        }

        uncheckedOptions.remove(COMPACTION_WINDOW_SIZE_KEY);
        uncheckedOptions.remove(COMPACTION_WINDOW_UNIT_KEY);
        uncheckedOptions.remove(TIMESTAMP_RESOLUTION_KEY);
        uncheckedOptions.remove(EXPIRED_SSTABLE_CHECK_FREQUENCY_SECONDS_KEY);
        uncheckedOptions.remove(UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_KEY);

        uncheckedOptions = SizeTieredCompactionStrategyOptions.validateOptions(options, uncheckedOptions);

        return uncheckedOptions;
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Restart Cassandra with -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true added to JVM options (cassandra-env.sh JVM_OPTS or JVM_EXTRA_OPTS)
Understand the risk first: the flag disables safe max_window_bounds checks and can cause data loss
Alternatively keep the option at 'false' or remove it
Verify the property took effect before retrying the ALTER TABLE

Example fix

// before (cassandra-env.sh)
JVM_OPTS="$JVM_OPTS"
// after
JVM_OPTS="$JVM_OPTS -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true"

Defensive patterns

Strategy: validation

Validate before calling

if ("true".equalsIgnoreCase(opts.get("unsafe_aggressive_sstable_expiration")) &&
    !Boolean.getBoolean("cassandra.allow_unsafe_aggressive_sstable_expiration"))
    throw new IllegalStateException("set -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true on the server first");

Try / catch

try {
    session.execute(alterStmt);
} catch (RuntimeException e) {
    if (e.getMessage().contains("is requested but not allowed")) {
        // add -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true to server JVM opts and restart
    }
    throw e;
}

Prevention

Add the -D flag to cassandra-env.sh JVM_OPTS on every node of clusters that need the feature
Remember the flag requires a full node restart, not a reload
Re-evaluate the risk: aggressive expiration can delete unexpired data
Keep cluster configs in sync to avoid the error reappearing on new nodes

When it happens

Trigger: validateOptions with unsafe_aggressive_sstable_expiration='true' while UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION_ENABLED (derived from the ALLOW_UNSAFE_AGGRESSIVE_SSTABLE_EXPIRATION system property) is false, i.e. Cassandra started without the -D flag.

Common situations: Enabling aggressive sstable expiration (dangerous: can drop data in unexpired windows) in table options without the corresponding node startup flag, e.g. after migrating config to a new cluster; container images without custom JVM opts.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/612ec0b8497ff11d. Report an issue: GitHub.