nats-io/nats-server · error

jetstream can not be enabled on the system account

Error message

jetstream can not be enabled on the system account

What it means

JetStream cannot be enabled on the system account because the system account hosts the JetStream API services themselves; enabling user JetStream limits on it would be circular and is rejected explicitly by EnableJetStream after checking the account is registered.

Source

Thrown at server/jetstream.go:1202

func (a *Account) assignJetStreamLimits(limits map[string]JetStreamAccountLimits) {
	a.mu.Lock()
	a.jsLimits = limits
	a.mu.Unlock()
}

// EnableJetStream will enable JetStream on this account with the defined limits.
// This is a helper for JetStreamEnableAccount.
func (a *Account) EnableJetStream(limits map[string]JetStreamAccountLimits, tq chan<- func()) error {
	a.mu.RLock()
	s := a.srv
	a.mu.RUnlock()

	if s == nil {
		return fmt.Errorf("jetstream account not registered")
	}

	if s.SystemAccount() == a {
		return fmt.Errorf("jetstream can not be enabled on the system account")
	}

	s.mu.RLock()
	if s.sys == nil {
		s.mu.RUnlock()
		return ErrServerNotRunning
	}
	sendq := s.sys.sendq
	s.mu.RUnlock()

	// No limits means we dynamically set up limits.
	// We also place limits here so we know that the account is configured for JetStream.
	if len(limits) == 0 {
		limits = defaultJSAccountTiers
	}

	a.assignJetStreamLimits(limits)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Skip the system account when enabling JetStream: compare acc with s.SystemAccount() before calling.
2. Enable JetStream only on user/application accounts.
3. If the system account needs JetStream resources, that is handled internally by the server; no user action required.
4. Restructure loops to filter reserved accounts.

Example fix

// before
for _, acc := range accounts {
    acc.EnableJetStream(limits, tq)
}
// after
sys := s.SystemAccount()
for _, acc := range accounts {
    if acc == sys { continue }
    acc.EnableJetStream(limits, tq)
}

if acc == s.SystemAccount() {
    return fmt.Errorf("refusing to enable JetStream on system account")
}

if err := acc.EnableJetStream(limits, tq); err != nil {
    if strings.Contains(err.Error(), "system account") {
        log.Printf("skipping system account %s", acc.Name)
        return nil
    }
    return err
}

When it happens

Trigger: Calling EnableJetStream on the account returned by s.SystemAccount(), or on an account configured as the SystemAccount option, or on the implicit DEFAULT system account in non-operator mode.

Common situations: Looping over all accounts and enabling JetStream indiscriminately including the system account; copying account config from a normal account onto the system account; misreading documentation that says all accounts need JetStream enabled.

Related errors

• system account not setup
• error creating store for stream
• error creating store for consumer
• JS_STREAM_OFFLINE
• JS_ERR_GENERIC

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7e253f4c296f7029. Report an issue: GitHub.