What causes "not enough overwrite bytes read (%d != %d)" in nats-io/nats-server?

Fix the host entropy source (getrandom//dev/urandom health) and retry the purge

not enough overwrite bytes read (%d != %d)

Error message

not enough overwrite bytes read (%d != %d)

What it means

Thrown when overwriting a deleted/empty record: the store randomizes the record body with rand.Read before writing it over the old data (data shredding), and the entropy source returned fewer bytes than requested. The overwrite is aborted so no partially-randomized record is persisted.

Source

Thrown at server/filestore.go:6777

	}
}

// Lock should be held.
func (mb *msgBlock) eraseMsg(seq uint64, ri, rl int, isLastBlock bool) error {
	var le = binary.LittleEndian
	var hdr [msgHdrSize]byte

	le.PutUint32(hdr[0:], uint32(rl))
	le.PutUint64(hdr[4:], seq|ebit)
	le.PutUint64(hdr[12:], 0)
	le.PutUint16(hdr[20:], 0)

	// Randomize record
	data := make([]byte, rl-emptyRecordLen)
	if n, err := rand.Read(data); err != nil {
		return err
	} else if n != len(data) {
		return fmt.Errorf("not enough overwrite bytes read (%d != %d)", n, len(data))
	}

	// Now write to underlying buffer.
	var b bytes.Buffer
	b.Write(hdr[:])
	b.Write(data)

	// Calculate hash.
	mb.hh.Reset()
	mb.hh.Write(hdr[4:20])
	mb.hh.Write(data)
	var hb [highwayhash.Size64]byte
	checksum := mb.hh.Sum(hb[:0])
	// Write to msg record.
	b.Write(checksum)

	// Update both cache and disk.
	nbytes := b.Bytes()

View on GitHub (pinned to 3a66a489d2)

Solutions

Fix the host entropy source (getrandom//dev/urandom health) and retry the purge
Restart the server process once the randomness subsystem is healthy
Avoid sandbox/seccomp configurations that block system randomness syscalls
If reproducible, upgrade OS/Go runtime for modern crypto/rand guarantees

Defensive patterns

Strategy: try-catch

Try / catch

// Go: purge/trim calls can surface entropy faults
if err := purgeOrTrim(msgs); err != nil {
    if strings.Contains(err.Error(), "not enough overwrite bytes") {
        // entropy source fault: fix host randomness, then retry purge
    }
    return err
}

Prevention

Monitor entropy health on hosts doing frequent purges
Avoid seccomp profiles blocking getrandom
Restart processes after entropy recovery
Keep kernels/runtime up to date

When it happens

Trigger: Purging/removing messages from a file-store block where the overwrite path randomizes len(data) bytes and rand.Read returns n < len(data) without an error.

Common situations: Host entropy exhaustion or blocked getrandom during message purge/trim operations on large blocks.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/9f70905dee453a99. Report an issue: GitHub.