What causes "max_body_size must be positive" in crowdsecurity/crowdsec?

Set max_body_size to a positive integer of bytes, e.g. max_body_size: 10485760 for 10 MiB

max_body_size must be positive

Error message

max_body_size must be positive

What it means

The optional max_body_size option of the http acquisition source was set to zero or a negative value. It controls the maximum accepted request body size (in bytes, after decompression; default 10 MiB), and Validate() rejects any non-positive value to prevent effectively-disabled or nonsensical limits.

Source

Thrown at pkg/acquisition/modules/http/config.go:140

		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	/*
		if hc.ChunkSize != nil && *hc.ChunkSize <= 0 {
			return errors.New("chunk_size must be positive")
		}
	*/

	if c.CustomStatusCode != nil {
		statusText := http.StatusText(*c.CustomStatusCode)
		if statusText == "" {
			return errors.New("invalid HTTP status code")
		}
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Set max_body_size to a positive integer of bytes, e.g. max_body_size: 10485760 for 10 MiB
If you want the default (10 MiB), remove the max_body_size line entirely
Check that any templating/variable feeding this value resolves to a positive number
Remember SetDefaults() only applies the default when the value is absent — an explicit 0 is rejected, not defaulted

Example fix

# before
source: http
listen_addr: 127.0.0.1:8080
auth_type: headers
headers:
  X-Api-Key: secret
max_body_size: 0
# after
source: http
listen_addr: 127.0.0.1:8080
auth_type: headers
headers:
  X-Api-Key: secret
max_body_size: 10485760

Defensive patterns

Strategy: validation

Validate before calling

if cfg.MaxBodySize != nil && *cfg.MaxBodySize <= 0 {
    return errors.New("max_body_size must be a positive integer (bytes)")
}

Type guard

func maxBodySizeValid(n *int64) bool {
    return n == nil || *n > 0
}

Try / catch

if _, err := httpacquisition.ConfigurationFromYAML(y); err != nil {
    if strings.Contains(err.Error(), "max_body_size must be positive") {
        return fmt.Errorf("bad max_body_size in acquisition config: %w", err)
    }
    return err
}

Prevention

Use positive byte values (e.g. 10485760); there is no 0 = unlimited shortcut
Omit max_body_size to get the 10 MiB default instead of setting it explicitly
Ensure only integer bytes are written — size strings like "10MB" are not accepted

When it happens

Trigger: YAML config contains max_body_size: 0 or a negative number, or a templated/typed value that evaluates to <= 0 (e.g. an env placeholder expanding to 0, or a size-with-unit string misparsed). Raised by Configuration.Validate() (config.go:139-141).

Common situations: Users who want "unlimited" bodies set max_body_size: 0 instead of removing the option (no unlimited shortcut exists in validation); unit confusion — writing max_body_size: "10MB" where only an integer byte count is accepted by the schema; automation generating 0 when a variable is unset.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b702c07e2b431410. Report an issue: GitHub.