crowdsecurity/crowdsec · error

invalid threshold: must be > 0 and <= 1

Error message

invalid threshold: must be > 0 and <= 1

What it means

The Bayesian bucket type requires BayesianThreshold to be strictly between 0 and 1 (exclusive of 0, inclusive of 1) because it is a probability cutoff at which an alert overflows. BucketFactory.Validate rejects any threshold of 0 or > 1 at load time.

Source

Thrown at pkg/leakybucket/buckettype.go:117

}

func (ConditionalType) BuildProcessors(_ *BucketFactory) []Processor {
	return []Processor{&DumbProcessor{}}
}

type BayesianType struct{}

func (BayesianType) Validate(f *BucketFactory) error {
	if len(f.Spec.BayesianConditions) == 0 {
		return errors.New("bayesian conditions are required")
	}

	if f.Spec.BayesianPrior <= 0 || f.Spec.BayesianPrior > 1 {
		return errors.New("invalid prior: must be > 0 and <= 1")
	}

	if f.Spec.BayesianThreshold == 0 || f.Spec.BayesianThreshold > 1 {
		return errors.New("invalid threshold: must be > 0 and <= 1")
	}

	if f.Spec.Capacity != -1 {
		return errors.New("capacity must be -1")
	}

	return nil
}

func (BayesianType) BuildProcessors(_ *BucketFactory) []Processor {
	return []Processor{&DumbProcessor{}}
}

View on GitHub (pinned to 909b515798)

Solutions

  1. Set BayesianThreshold to a value in (0, 1], e.g. 0.98 for a 98% probability cutoff
  2. Keep BayesianPrior in (0, 1] too, since it is validated just above
  3. Re-run `cscli hubtest` or reload crowdsec to confirm the bucket loads

Example fix

# before
filter: "evt.Meta.log_type == 'http_access-log'
bayesian_threshold: 1.5
# after
filter: "evt.Meta.log_type == 'http_access-log'
bayesian_threshold: 0.95
Defensive patterns

Strategy: validation

Validate before calling

if cfg.BayesianThreshold <= 0 || cfg.BayesianThreshold > 1 {
    return fmt.Errorf("bayesian_threshold must be in (0, 1], got %v", cfg.BayesianThreshold)
}

Prevention

When it happens

Trigger: Loading/parsing a leaky bucket YAML whose Spec.Type is 'bayesian' (or another type using Validate on pkg/leakybucket/buckettype.go) with Spec.BayesianThreshold set to 0, negative, or greater than 1.

Common situations: Typo in the threshold (e.g. `bayesian_threshold: 10` meaning 10%), copy-pasted config from a non-Bayesian bucket, or leaving the field at default 0 while converting a classic bucket to bayesian.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors


AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0334954d93f0aedb. Report an issue: GitHub.