fluent/fluentd · error · ArgumentError

'#{capability}' is not valid capability. Valid Capabilities

Error message

'#{capability}' is not valid capability. Valid Capabilities are:  #{valid_capabilities.join(", ")}

What it means

Raised as ArgumentError by fluent-cap-ctl (Linux only, requires the capng_c gem). Names given to --add or --drop are split on commas and each must appear in the list enumerated from libcap-ng via CapNG::Capability#each; the error text prints the full list of valid names. Names are exact, lowercase, with the cap_ prefix (cap_chown, cap_net_bind_service, cap_sys_admin, ...).

Source

Thrown at lib/fluent/command/cap_ctl.rb:157

        puts "Effective:   #{print.caps_text(:buffer, :effective)}"
        puts "Inheritable: #{print.caps_text(:buffer, :inheritable)}"
        puts "Permitted:   #{print.caps_text(:buffer, :permitted)}"
      end
    end

    def get_valid_capabilities
      capabilities = []
      cap = CapNG::Capability.new
      cap.each do |_code, capability|
        capabilities << capability
      end
      capabilities
    end

    def check_capabilities(capabilities, valid_capabilities)
      capabilities.each do |capability|
        unless valid_capabilities.include?(capability)
          raise ArgumentError, "'#{capability}' is not valid capability. Valid Capabilities are:  #{valid_capabilities.join(", ")}"
        end
      end
    end

    def parse_options!(argv)
      begin
        rest = @op.parse(argv)

        if rest.length != 0
          usage nil
        end
      rescue
        usage $!.to_s
      end
    end
  end
end

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Use the exact names from the error message's own 'Valid Capabilities are:' list, e.g. cap_net_bind_service
2. Run fluent-cap-ctl --get first to confirm the target, and copy-paste names from the printed list
3. Update the capng_c gem if your kernel has the capability but the gem does not
4. Alternatively use setcap on the binary instead of fluent-cap-ctl

Example fix

# before
fluent-cap-ctl --add net_bind_service

# after
fluent-cap-ctl --add cap_net_bind_service

require 'capng'
valid = []
CapNG::Capability.new.each { |_code, cap| valid << cap.to_s }
requested = ARGV[0].to_s.split(/\s*,\s*/)
unknown = requested - valid
abort "unknown capabilities: #{unknown.join(', ')}" unless unknown.empty?

When it happens

Trigger: fluent-cap-ctl --add net_bind_service (missing cap_ prefix); --add CAP_NET_BIND_SERVICE (wrong case); a capability name that does not exist in the libcap-ng version bundled with capng_c; stray spaces or empty items after comma-splitting.

Common situations: Granting fluentd's Ruby binary the ability to bind ports below 1024 with cap_net_bind_service; scripts copying names from setcap/capsh docs that use different casing; older capng_c builds lacking newer capabilities.

Related errors

• unknown_key
• Input must be a map (got #{record.class})
• Missing arguments
• invalid_params
• Unknown #{@kind} plugin '#{type}'. Run 'gem search -rd fluen

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/bec4abf8e366d86b. Report an issue: GitHub.