failures_before_warning not supported for check of type %q

Error message

failures_before_warning not supported for check of type %q

What it means

validateConsul found a positive failures_before_warning (or failures_before_critical) value on a check type outside the supported tcp/http/grpc set; threshold features only apply to those check types.

Source

Thrown at nomad/structs/services.go:456

	// Consul only.
	passFailCheckTypes := []string{"tcp", "http", "grpc"}

	if sc.SuccessBeforePassing < 0 {
		return fmt.Errorf("success_before_passing must be non-negative")
	} else if sc.SuccessBeforePassing > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("success_before_passing not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeCritical < 0 {
		return fmt.Errorf("failures_before_critical must be non-negative")
	} else if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_critical not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeWarning < 0 {
		return fmt.Errorf("failures_before_warning must be non-negative")
	} else if sc.FailuresBeforeWarning > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_warning not supported for check of type %q", sc.Type)
	}

	// Arbitrary value, we could bump it if needed
	if len(sc.Notes) > 255 {
		return fmt.Errorf("notes must not be longer than 255 characters")
	}

	return nil
}

// RequiresPort returns whether the service check requires the task has a port.
func (sc *ServiceCheck) RequiresPort() bool {
	switch sc.Type {
	case ServiceCheckGRPC, ServiceCheckHTTP, ServiceCheckTCP:
		return true
	default:
		return false
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove the failures threshold fields from non-tcp/http/grpc checks
Switch the check type to tcp, http, or grpc if thresholds are needed

Example fix

// before
check {
  type = "script"
  failures_before_warning = 1
}
// after
check {
  type = "http"
  failures_before_warning = 1
}

Defensive patterns

Strategy: validation

Validate before calling

var passFail = []string{"tcp","http","grpc"}
if sc.FailuresBeforeWarning > 0 && !slices.Contains(passFail, sc.Type) {
    return fmt.Errorf("failures_before_warning unsupported for type %q", sc.Type)
}

Type guard

func canUseFailuresBeforeWarning(sc *ServiceCheck) bool {
    return sc.FailuresBeforeWarning == 0 || slices.Contains([]string{"tcp","http","grpc"}, sc.Type)
}

Prevention

Keep warning thresholds out of script/ttl checks
Centralize check construction in helpers that enforce type constraints

When it happens

Trigger: Setting FailuresBeforeWarning > 0 on a check whose Type is not tcp/http/grpc during Consul validation.

Common situations: Template-generated check blocks applying warning thresholds to script or ttl checks.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b77b2ad1139af9ae. Report an issue: GitHub.