failures_before_critical not supported for check of type %q

Error message

failures_before_critical not supported for check of type %q

What it means

Like success_before_passing, FailuresBeforeCritical is only valid on pass/fail check types (tcp, http, grpc). Setting it > 0 on any other check type (script, ttl, etc.) is rejected with the unsupported type named.

Source

Thrown at nomad/structs/services.go:450

		}
	}

	// passFailCheckTypes are intersection of check types supported by both Consul
	// and Nomad when using the pass/fail check threshold features.
	//
	// Consul only.
	passFailCheckTypes := []string{"tcp", "http", "grpc"}

	if sc.SuccessBeforePassing < 0 {
		return fmt.Errorf("success_before_passing must be non-negative")
	} else if sc.SuccessBeforePassing > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("success_before_passing not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeCritical < 0 {
		return fmt.Errorf("failures_before_critical must be non-negative")
	} else if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_critical not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeWarning < 0 {
		return fmt.Errorf("failures_before_warning must be non-negative")
	} else if sc.FailuresBeforeWarning > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_warning not supported for check of type %q", sc.Type)
	}

	// Arbitrary value, we could bump it if needed
	if len(sc.Notes) > 255 {
		return fmt.Errorf("notes must not be longer than 255 characters")
	}

	return nil
}

// RequiresPort returns whether the service check requires the task has a port.
func (sc *ServiceCheck) RequiresPort() bool {

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove failures_before_critical from non pass/fail checks
Switch the check type to tcp/http/grpc
Set failures_before_critical to 0

Example fix

// before
check {
  type = "ttl"
  failures_before_critical = 3
}
// after
check {
  type = "tcp"
  failures_before_critical = 3
}

Defensive patterns

Strategy: validation

Validate before calling

var passFail = []string{"tcp","http","grpc"}
if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFail, sc.Type) {
    return fmt.Errorf("failures_before_critical unsupported for type %q", sc.Type)
}

Type guard

func canUseFailuresBeforeCritical(sc *ServiceCheck) bool {
    return sc.FailuresBeforeCritical == 0 || slices.Contains([]string{"tcp","http","grpc"}, sc.Type)
}

Prevention

Apply pass/fail knobs only to tcp/http/grpc checks
Run nomad job validate in CI

When it happens

Trigger: Setting FailuresBeforeCritical > 0 on a check with Type outside {tcp,http,grpc}, then validating the service.

Common situations: Same misconfiguration pattern as success_before_passing: shared check blocks templated across script/ttl and http checks.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/96552ee971a35456. Report an issue: GitHub.