apache/rocketmq · error · AuthorizationException

create Acl to RocksDB failed.

Error message

create Acl to RocksDB failed.

What it means

LocalAuthorizationMetadataProvider.createAcl() wraps any exception thrown while serializing the Acl to JSON and writing it to the local RocksDB ACL store (put + flushWAL). The cause chain (AuthorizationException with cause) carries the real failure: RocksDB I/O error, disk full, serialization failure, or the store being shut down/corrupt.

Source

Thrown at auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java:89

        this.aclCache = Caffeine.newBuilder()
            .maximumSize(authConfig.getAclCacheMaxNum())
            .expireAfterAccess(authConfig.getAclCacheExpiredSecond(), TimeUnit.SECONDS)
            .refreshAfterWrite(authConfig.getAclCacheRefreshSecond(), TimeUnit.SECONDS)
            .executor(cacheRefreshExecutor)
            .build(new AclCacheLoader(this.storage));
    }

    @Override
    public CompletableFuture<Void> createAcl(Acl acl) {
        try {
            Subject subject = acl.getSubject();
            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);
            byte[] valueBytes = JSON.toJSONBytes(acl);
            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("create Acl to RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override
    public CompletableFuture<Void> deleteAcl(Subject subject) {
        try {
            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);
            this.storage.delete(AUTH_METADATA_COLUMN_FAMILY, keyBytes);
            this.storage.flushWAL();
            this.aclCache.invalidate(subject.getSubjectKey());
        } catch (Exception e) {
            throw new AuthorizationException("delete Acl from RocksDB failed.", e);
        }
        return CompletableFuture.completedFuture(null);
    }

    @Override

View on GitHub (pinned to 293f588571)

Solutions

1. Inspect the nested cause of the AuthorizationException to identify the real RocksDB or serialization error
2. Check disk space and filesystem health on the auth config path (df -h; dmesg | grep -i error)
3. If the store was closed during shutdown, retry the ACL creation after the broker is fully up
4. Verify the Acl/Subject objects only contain serializable fields before submission

try {
    provider.createAcl(acl).join();
} catch (CompletionException e) {
    Throwable real = ExceptionUtils.getRealException(e);
    if (real instanceof AuthorizationException && real.getCause() != null) {
        log.error("createAcl store failure: {}", real.getCause().getMessage());
    }
}

When it happens

Trigger: createAcl while the RocksDB storage is in a bad state: disk full, store directory on a failing disk, store already closed during broker shutdown, or the Acl object containing data that fastjson cannot serialize.

Common situations: Disk exhaustion on the broker's config volume; ACL writes racing broker shutdown; filesystem errors on the store path; a custom Subject/Acl subclass with non-serializable fields.

Related errors

• delete Acl from RocksDB failed.
• update Acl to RocksDB failed.
• get Acl from RocksDB failed.
• The actions is empty.
• The actions can not be Any.

AI-assisted analysis of apache/rocketmq@293f588571 (2026-08-14). Data as JSON: /api/errors/6b024a9729b04eb6. Report an issue: GitHub.