What causes "Check %s invalid: %v" in hashicorp/nomad?

Read the nested %v detail for the specific check violation and fix it in the check stanza.

Check %s invalid: %v

Error message

Check %s invalid: %v

What it means

This is the wrapper error format used in validateConsulService when ServiceCheck.validateConsul() returns an error for a check on a Consul-provider service. The %s is the check name and %v the underlying reason (bad interval, timeout, method, header, grpc address, etc.). The check-level failure is nested inside this message.

Source

Thrown at nomad/structs/services.go:871

	// check checks
	for _, c := range s.Checks {
		// validate the check port
		if err := s.validateCheckPort(c); err != nil {
			mErr.Errors = append(mErr.Errors, err)
			continue
		}

		// TCP checks against a Consul Connect enabled service are not supported
		// due to the service being bound to the loopback interface inside the
		// network namespace
		if c.Type == ServiceCheckTCP && s.Connect != nil && s.Connect.SidecarService != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Check %s invalid: tcp checks are not valid for Connect enabled services", c.Name))
			continue
		}

		// validate the consul check
		if err := c.validateConsul(); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Check %s invalid: %v", c.Name, err))
		}
	}

	// validate the consul service kind
	switch api.ServiceKind(s.Kind) {
	case api.ServiceKindTypical,
		api.ServiceKindAPIGateway,
		api.ServiceKindIngressGateway,
		api.ServiceKindMeshGateway,
		api.ServiceKindTerminatingGateway:
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("Service %s kind must be one of consul service kind or empty", s.Name))
	}

	// check connect
	if s.Connect != nil {
		if err := s.Connect.Validate(); err != nil {
			mErr.Errors = append(mErr.Errors, err)

View on GitHub (pinned to 482b49bf1a)

Solutions

Read the nested %v detail for the specific check violation and fix it in the check stanza.
Ensure interval and timeout meet Consul's minimum durations (e.g. interval >= 1s).
Verify check type is one of tcp, http, grpc, or script (with appropriate permissions).

Example fix

// before
check {
  type = "http"
  interval = "100ms"
  timeout = "1s"
}
// after
check {
  type = "http"
  interval = "10s"
  timeout = "2s"
}

Defensive patterns

Strategy: validation

Validate before calling

if c.Interval != "" {
  if d, err := time.ParseDuration(c.Interval); err != nil || d < time.Second {
    return fmt.Errorf("check %q: interval must be >= 1s", c.Name)
  }
}

Try / catch

err := job.Validate()
var me *structs.MultiError
if errors.As(err, &me) {
  for _, e := range me.Errors {
    if strings.Contains(e.Error(), "Check ") {
      log.Printf("fix service check: %v", e)
    }
  }
}

Prevention

Keep check intervals >= 1s and timeouts shorter than intervals
Only use fields supported by the chosen provider (consul vs nomad checks differ)
Validate jobs with `nomad job validate` before submission

When it happens

Trigger: Any check validation failure for a consul-provider service, e.g. interval/timeout below minimums, unsupported check type, invalid expose config, or a grpc check without address_mode constraints.

Common situations: Misconfigured check timings (too-short intervals), using http checks with invalid paths, or checks referencing fields only valid for other providers.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b1a217907bb943e6. Report an issue: GitHub.