{"record":{"id":"98b532b94eb32aac","repo":"netbirdio/netbird","slug":"invalid-anonymize-level-q-use-q-or-q","errorCode":null,"errorMessage":"invalid anonymize level %q: use %q or %q","messagePattern":"invalid anonymize level %q: use %q or %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/root.go","lineNumber":307,"sourceCode":"var CLIBackOffSettings = &backoff.ExponentialBackOff{\n\tInitialInterval:     time.Second,\n\tRandomizationFactor: backoff.DefaultRandomizationFactor,\n\tMultiplier:          backoff.DefaultMultiplier,\n\tMaxInterval:         10 * time.Second,\n\tMaxElapsedTime:      30 * time.Second,\n\tStop:                backoff.Stop,\n\tClock:               backoff.SystemClock,\n}\n\n// effectiveAnonymize resolves the --anonymize and --anonymize-level flags:\n// setting a level implies anonymization, and an invalid level is rejected.\nfunc effectiveAnonymize() (bool, anonymize.Level, error) {\n\tif anonymizeLevelFlag == \"\" {\n\t\treturn anonymizeFlag, anonymize.LevelDefault, nil\n\t}\n\tlevel := anonymize.ParseLevel(anonymizeLevelFlag)\n\tif !strings.EqualFold(anonymizeLevelFlag, level.String()) {\n\t\treturn false, anonymize.LevelDefault, fmt.Errorf(\"invalid anonymize level %q: use %q or %q\", anonymizeLevelFlag, anonymize.LevelDefault.String(), anonymize.LevelStrict.String())\n\t}\n\treturn true, level, nil\n}\n\nfunc getSetupKey() (string, error) {\n\tif setupKeyPath != \"\" && setupKey == \"\" {\n\t\treturn getSetupKeyFromFile(setupKeyPath)\n\t}\n\treturn setupKey, nil\n}\n\nfunc getSetupKeyFromFile(setupKeyPath string) (string, error) {\n\tdata, err := os.ReadFile(setupKeyPath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read setup key file: %v\", err)\n\t}\n\treturn strings.TrimSpace(string(data)), nil\n}","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/root.go#L289-L325","documentation":"effectiveAnonymize (client/cmd/root.go:301-310) validates --anonymize-level by a round-trip: anonymize.ParseLevel maps unknown strings to LevelStrict (client/anonymize/anonymize.go:44), so the CLI compares the input (case-insensitively) to the parsed level's String(); a mismatch means the value was not 'default' or 'strict'. Only those two levels exist: LevelDefault redacts public IPs/domains/MACs; LevelStrict additionally redacts internal ranges, peer names, and netbird keys.","triggerScenarios":"--anonymize-level set to anything except 'default' or 'strict' (e.g. 'medium', 'full', 'high', 'anonymize'); NB_ANONYMIZE_LEVEL env var with a typo; scripts written for another tool's level names; trailing whitespace in the value (flag parsing does not trim).","commonSituations":"Users assuming a graded scale (low/medium/high); copy-paste from docs of a different product version; env var typo like NB_ANONYMIZE_LVL spelled out elsewhere and set here; CI setting the env globally for unrelated reasons.","solutions":["Use exactly `--anonymize-level default` or `--anonymize-level strict` (case-insensitive)","If full redaction is wanted, that is 'strict'; if only public IPs/domains/MACs, that is 'default'","Drop the flag entirely — anonymization then defaults off, or use plain --anonymize (default level)","Check NB_ANONYMIZE_LEVEL in the environment and correct or unset it"],"exampleFix":"# before\nnetbird debug daemon-logs --anonymize-level medium\n# -> invalid anonymize level \"medium\": use \"default\" or \"strict\"\n# after\nnetbird debug daemon-logs --anonymize-level strict","handlingStrategy":"validation","validationCode":"level := strings.ToLower(strings.TrimSpace(anonymizeLevelFlag))\nif level != \"\" && level != \"default\" && level != \"strict\" {\n    return fmt.Errorf(\"invalid anonymize level %q: use \\\"default\\\" or \\\"strict\\\"\", anonymizeLevelFlag)\n}","typeGuard":"func isValidAnonymizeLevel(s string) bool {\n    s = strings.ToLower(strings.TrimSpace(s))\n    return s == \"default\" || s == \"strict\"\n}","tryCatchPattern":null,"preventionTips":["Remember there are exactly two levels: default (public IPs/domains/MACs) and strict (adds internal ranges, peer names, keys)","Validate NB_ANONYMIZE_LEVEL in CI before invoking the CLI","Trim whitespace when piping values into the flag"],"tags":["cli","flags","validation","anonymize"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}