crowdsecurity/crowdsec · error
invalid threshold: must be > 0 and <= 1
Error message
invalid threshold: must be > 0 and <= 1
What it means
The Bayesian bucket type requires BayesianThreshold to be strictly between 0 and 1 (exclusive of 0, inclusive of 1) because it is a probability cutoff at which an alert overflows. BucketFactory.Validate rejects any threshold of 0 or > 1 at load time.
Source
Thrown at pkg/leakybucket/buckettype.go:117
}
func (ConditionalType) BuildProcessors(_ *BucketFactory) []Processor {
return []Processor{&DumbProcessor{}}
}
type BayesianType struct{}
func (BayesianType) Validate(f *BucketFactory) error {
if len(f.Spec.BayesianConditions) == 0 {
return errors.New("bayesian conditions are required")
}
if f.Spec.BayesianPrior <= 0 || f.Spec.BayesianPrior > 1 {
return errors.New("invalid prior: must be > 0 and <= 1")
}
if f.Spec.BayesianThreshold == 0 || f.Spec.BayesianThreshold > 1 {
return errors.New("invalid threshold: must be > 0 and <= 1")
}
if f.Spec.Capacity != -1 {
return errors.New("capacity must be -1")
}
return nil
}
func (BayesianType) BuildProcessors(_ *BucketFactory) []Processor {
return []Processor{&DumbProcessor{}}
}
View on GitHub (pinned to 909b515798)
Solutions
- Set BayesianThreshold to a value in (0, 1], e.g. 0.98 for a 98% probability cutoff
- Keep BayesianPrior in (0, 1] too, since it is validated just above
- Re-run `cscli hubtest` or reload crowdsec to confirm the bucket loads
Example fix
# before filter: "evt.Meta.log_type == 'http_access-log' bayesian_threshold: 1.5 # after filter: "evt.Meta.log_type == 'http_access-log' bayesian_threshold: 0.95
Defensive patterns
Strategy: validation
Validate before calling
if cfg.BayesianThreshold <= 0 || cfg.BayesianThreshold > 1 {
return fmt.Errorf("bayesian_threshold must be in (0, 1], got %v", cfg.BayesianThreshold)
} Prevention
- Use probabilities like 0.95, never percentages
- Validate scenario YAML with cscli hubtest before deploy
- Keep prior and threshold both in (0,1]
When it happens
Trigger: Loading/parsing a leaky bucket YAML whose Spec.Type is 'bayesian' (or another type using Validate on pkg/leakybucket/buckettype.go) with Spec.BayesianThreshold set to 0, negative, or greater than 1.
Common situations: Typo in the threshold (e.g. `bayesian_threshold: 10` meaning 10%), copy-pasted config from a non-Bayesian bucket, or leaving the field at default 0 while converting a classic bucket to bayesian.
Understand the failure class
Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.
Related errors
- capacity must be -1
- bucket must have name
- description is mandatory
- missing filter directive
- empty scope information
AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06).
Data as JSON: /api/errors/0334954d93f0aedb.
Report an issue: GitHub.