{"record":{"id":"52b08bde42b01654","repo":"apache/cassandra","slug":"guardrail-s-violated-s-52b08b","errorCode":null,"errorMessage":"Guardrail %s violated: %s","messagePattern":"Guardrail (.+?) violated: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/db/guardrails/AbstractCustomGuardrail.java","lineNumber":50,"sourceCode":"     * @param name                name of the custom guardrail\n     * @param reason              guardrail reason\n     * @param configSupplier      configuration supplier of the custom guardrail\n     * @param guardWhileSuperuser when true, the guardrail will be executed even the caller is a superuser. If\n     *                            false, this guardrail will be called only in case a caller is not a superuser.\n     */\n    public AbstractCustomGuardrail(String name, String reason, Supplier<CustomGuardrailConfig> configSupplier, boolean guardWhileSuperuser)\n    {\n        super(name, reason, configSupplier, guardWhileSuperuser);\n    }\n\n    @Override\n    String decorateMessage(String message)\n    {\n        return String.format(\"Guardrail %s violated: %s\", name, message);\n    }\n\n    @Override\n    protected void warn(String message, String redactedMessage)\n    {\n        String msg = decorateMessage(message);\n        String redactedMsg = decorateMessage(redactedMessage);\n\n        ClientWarn.instance.warn(msg);\n        Tracing.trace(redactedMsg);\n        GuardrailsDiagnostics.warned(name, redactedMsg);\n    }\n\n    @Override\n    protected void fail(String message, String redactedMessage, @Nullable ClientState state)\n    {\n        String msg = decorateMessage(message);\n        String redactedMsg = decorateMessage(redactedMessage);\n\n        ClientWarn.instance.warn(msg);\n        Tracing.trace(redactedMsg);\n        GuardrailsDiagnostics.failed(name, redactedMsg);","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/AbstractCustomGuardrail.java#L32-L68","documentation":"Custom guardrails (user-implemented AbstractGuardrail subclasses) report violations by decorating the message with the guardrail name and sending it to the client via ClientWarn and to tracing. This is a warning path, not an exception: the violating operation still executes but the client is notified that 'Guardrail <name> violated: <detail>'.","triggerScenarios":"Any operation that triggers a custom guardrail's warn(String, String) method — i.e. the guardrail's supplier returns a non-empty warning message for the executed statement.","commonSituations":"Operators installing organization-specific custom guardrails that flag risky-but-legal operations (e.g. large partitions, unlogged batches on specific keyspaces); clients seeing warnings prefixed with the custom guardrail name in drivers.","solutions":["Read the decorated message; the guardrail name and detail indicate which custom guardrail fired and why.","Adjust the operation to comply with the guardrail policy (e.g. reduce batch size, avoid flagged keyspace).","If the warning is too aggressive, reconfigure or lower the custom guardrail's threshold in cassandra.yaml or in the guardrail's implementation.","Check server traces (Tracing) for the redacted version if the client message was sensitive."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check in application: run the statement against the same guardrail policy\n// e.g. estimate partition/collection size before write and compare to configured guardrail warn thresholds\nlong approxSize = estimateMutationSize(statement);\nif (approxSize > configuredGuardrailWarnThreshold) {\n    log.warn(\"Custom guardrail '{}' would flag this operation (size={} bytes)\", guardrailName, approxSize);\n}","typeGuard":null,"tryCatchPattern":"// This is a warning, not an exception: read it from client warnings\nResultSet rs = session.execute(stmt);\nfor (String w : rs.getExecutionInfo().getWarnings()) {\n    if (w.startsWith(\"Guardrail \" + guardrailName)) { /* adjust workload or config */ }\n}","preventionTips":["Document custom guardrail policies for application teams.","Monitor client warnings in driver metrics/logs.","Tune guardrail thresholds per environment (dev vs prod).","Test new guardrails in staging before enabling cluster-wide."],"tags":["cassandra","guardrails","client-warning"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}