hashicorp/nomad · error

failures_before_critical must be non-negative

Error message

failures_before_critical must be non-negative

What it means

Consul check validation requires FailuresBeforeCritical to be zero or positive. A negative value is nonsensical (counts of consecutive failures cannot be negative) and is rejected before any type-specific checks.

Source

Thrown at nomad/structs/services.go:448

		default:
			return fmt.Errorf("expose may only be set on HTTP or gRPC checks")
		}
	}

	// passFailCheckTypes are intersection of check types supported by both Consul
	// and Nomad when using the pass/fail check threshold features.
	//
	// Consul only.
	passFailCheckTypes := []string{"tcp", "http", "grpc"}

	if sc.SuccessBeforePassing < 0 {
		return fmt.Errorf("success_before_passing must be non-negative")
	} else if sc.SuccessBeforePassing > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("success_before_passing not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeCritical < 0 {
		return fmt.Errorf("failures_before_critical must be non-negative")
	} else if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_critical not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeWarning < 0 {
		return fmt.Errorf("failures_before_warning must be non-negative")
	} else if sc.FailuresBeforeWarning > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_warning not supported for check of type %q", sc.Type)
	}

	// Arbitrary value, we could bump it if needed
	if len(sc.Notes) > 255 {
		return fmt.Errorf("notes must not be longer than 255 characters")
	}

	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set failures_before_critical to 0 to disable
2. Use a non-negative integer equal to the desired failure threshold

Example fix

// before
check {
  failures_before_critical = -1
}
// after
check {
  failures_before_critical = 2
}

if sc.FailuresBeforeCritical < 0 {
    return fmt.Errorf("failures_before_critical must be non-negative")
}

func validFailuresBeforeCritical(sc *ServiceCheck) bool { return sc.FailuresBeforeCritical >= 0 }

When it happens

Trigger: Setting check.FailuresBeforeCritical to any negative integer (e.g. -1) in a Consul service check and validating it via validateConsul during job/service validation.

Common situations: HCL variable interpolation producing a negative default; arithmetic on counts gone wrong; typo like '= -1' intended as unset.

Related errors

• expose may only be set for Consul service checks
• on_update may only be set to ignore_warnings for Consul serv
• success_before_passing may only be set for Consul service ch
• failures_before_critical may only be set for Consul service
• failures_before_warning may only be set for Consul service c

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/aecfe0c6043d4f60. Report an issue: GitHub.