{"record":{"id":"0334954d93f0aedb","repo":"crowdsecurity/crowdsec","slug":"invalid-threshold-must-be-0-and-1","errorCode":null,"errorMessage":"invalid threshold: must be > 0 and <= 1","messagePattern":"invalid threshold: must be > 0 and <= 1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/buckettype.go","lineNumber":117,"sourceCode":"}\n\nfunc (ConditionalType) BuildProcessors(_ *BucketFactory) []Processor {\n\treturn []Processor{&DumbProcessor{}}\n}\n\ntype BayesianType struct{}\n\nfunc (BayesianType) Validate(f *BucketFactory) error {\n\tif len(f.Spec.BayesianConditions) == 0 {\n\t\treturn errors.New(\"bayesian conditions are required\")\n\t}\n\n\tif f.Spec.BayesianPrior <= 0 || f.Spec.BayesianPrior > 1 {\n\t\treturn errors.New(\"invalid prior: must be > 0 and <= 1\")\n\t}\n\n\tif f.Spec.BayesianThreshold == 0 || f.Spec.BayesianThreshold > 1 {\n\t\treturn errors.New(\"invalid threshold: must be > 0 and <= 1\")\n\t}\n\n\tif f.Spec.Capacity != -1 {\n\t\treturn errors.New(\"capacity must be -1\")\n\t}\n\n\treturn nil\n}\n\nfunc (BayesianType) BuildProcessors(_ *BucketFactory) []Processor {\n\treturn []Processor{&DumbProcessor{}}\n}\n","sourceCodeStart":99,"sourceCodeEnd":130,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/buckettype.go#L99-L130","documentation":"The Bayesian bucket type requires BayesianThreshold to be strictly between 0 and 1 (exclusive of 0, inclusive of 1) because it is a probability cutoff at which an alert overflows. BucketFactory.Validate rejects any threshold of 0 or > 1 at load time.","triggerScenarios":"Loading/parsing a leaky bucket YAML whose Spec.Type is 'bayesian' (or another type using Validate on pkg/leakybucket/buckettype.go) with Spec.BayesianThreshold set to 0, negative, or greater than 1.","commonSituations":"Typo in the threshold (e.g. `bayesian_threshold: 10` meaning 10%), copy-pasted config from a non-Bayesian bucket, or leaving the field at default 0 while converting a classic bucket to bayesian.","solutions":["Set BayesianThreshold to a value in (0, 1], e.g. 0.98 for a 98% probability cutoff","Keep BayesianPrior in (0, 1] too, since it is validated just above","Re-run `cscli hubtest` or reload crowdsec to confirm the bucket loads"],"exampleFix":"# before\nfilter: \"evt.Meta.log_type == 'http_access-log'\nbayesian_threshold: 1.5\n# after\nfilter: \"evt.Meta.log_type == 'http_access-log'\nbayesian_threshold: 0.95","handlingStrategy":"validation","validationCode":"if cfg.BayesianThreshold <= 0 || cfg.BayesianThreshold > 1 {\n    return fmt.Errorf(\"bayesian_threshold must be in (0, 1], got %v\", cfg.BayesianThreshold)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use probabilities like 0.95, never percentages","Validate scenario YAML with cscli hubtest before deploy","Keep prior and threshold both in (0,1]"],"tags":["crowdsec","leakybucket","config-validation","bayesian"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}