{"record":{"id":"bc10cd9cb852a41e","repo":"apache/cassandra","slug":"can-t-enable-full-query-log-archiving-via-nodetool","errorCode":null,"errorMessage":"Can't enable full query log archiving via nodetool unless full_query_logging_options.allow_nodetool_archive_command is set to true","messagePattern":"Can't enable full query log archiving via nodetool unless full_query_logging_options\\.allow_nodetool_archive_command is set to true","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/StorageService.java","lineNumber":5235,"sourceCode":"    public void shutdownServer()\n    {\n        if (drainOnShutdown != null)\n        {\n            Runtime.getRuntime().removeShutdownHook(drainOnShutdown);\n        }\n    }\n\n    @Override\n    public void enableFullQueryLogger(String path, String rollCycle, Boolean blocking, int maxQueueWeight, long maxLogSize, String archiveCommand, int maxArchiveRetries)\n    {\n        FullQueryLoggerOptions fqlOptions = DatabaseDescriptor.getFullQueryLogOptions();\n        path = path != null ? path : fqlOptions.log_dir;\n        rollCycle = rollCycle != null ? rollCycle : fqlOptions.roll_cycle;\n        blocking = blocking != null ? blocking : fqlOptions.block;\n        maxQueueWeight = maxQueueWeight != Integer.MIN_VALUE ? maxQueueWeight : fqlOptions.max_queue_weight;\n        maxLogSize = maxLogSize != Long.MIN_VALUE ? maxLogSize : fqlOptions.max_log_size;\n        if (archiveCommand != null && !fqlOptions.allow_nodetool_archive_command)\n            throw new ConfigurationException(\"Can't enable full query log archiving via nodetool unless full_query_logging_options.allow_nodetool_archive_command is set to true\");\n        archiveCommand = archiveCommand != null ? archiveCommand : fqlOptions.archive_command;\n        maxArchiveRetries = maxArchiveRetries != Integer.MIN_VALUE ? maxArchiveRetries : fqlOptions.max_archive_retries;\n\n        checkNotNull(path, \"cassandra.yaml did not set log_dir and not set as parameter\");\n        FullQueryLogger.instance.enableWithoutClean(File.getPath(path), rollCycle, blocking, maxQueueWeight, maxLogSize, archiveCommand, maxArchiveRetries);\n    }\n\n    @Override\n    public void resetFullQueryLogger()\n    {\n        FullQueryLogger.instance.reset(DatabaseDescriptor.getFullQueryLogOptions().log_dir);\n    }\n\n    @Override\n    public void stopFullQueryLogger()\n    {\n        FullQueryLogger.instance.stop();\n    }","sourceCodeStart":5217,"sourceCodeEnd":5253,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/StorageService.java#L5217-L5253","documentation":"StorageService.enableFullQueryLog() similarly permits an archiveCommand argument, but passing one is refused with a ConfigurationException unless full_query_logging_options.allow_nodetool_archive_command is true in cassandra.yaml. This prevents arbitrary command execution through the runtime-tuning interface.","triggerScenarios":"Calling enableFullQueryLog(..., archiveCommand=<cmd>) with a non-null archiveCommand while full_query_logging_options.allow_nodetool_archive_command is false (the default).","commonSituations":"Enabling FQL archiving at runtime via nodetool enablefullquerylog --archive-command on a cluster whose yaml still has the default (disallowed); security-hardened environments; scripts reused across clusters with different yaml settings.","solutions":["Set full_query_logging_options.allow_nodetool_archive_command: true in cassandra.yaml and restart.","Rely on full_query_logging_options.archive_command configured in yaml instead of passing one at runtime.","Remove the archive-command argument from the nodetool call if archiving is not needed."],"exampleFix":"// before (cassandra.yaml)\nfull_query_logging_options:\n  log_dir: /var/log/cassandra/fql\n// after (cassandra.yaml)\nfull_query_logging_options:\n  log_dir: /var/log/cassandra/fql\n  allow_nodetool_archive_command: true\n// restart, then nodetool enablefullquerylog --archive-command <cmd>","handlingStrategy":"validation","validationCode":"if (archiveCommand != null && !fqlOptions.allow_nodetool_archive_command)\n    throw new IllegalArgumentException(\"set full_query_logging_options.allow_nodetool_archive_command: true first\");","typeGuard":null,"tryCatchPattern":"try { ss.enableFullQueryLog(..., archiveCommand); } catch (ConfigurationException e) { log.error(\"FQL archiving via nodetool disallowed: {}\", e.getMessage()); }","preventionTips":["Enable allow_nodetool_archive_command in full_query_logging_options if runtime archiving is needed.","Configure archive_command in yaml rather than at runtime.","Ensure log_dir is set in yaml (a later checkNotNull also fails otherwise).","Audit cluster configs before reusing FQL-enable scripts."],"tags":["security","configuration","fql","jmx"],"backgroundTag":"feature-not-enabled","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}