cassandra.yaml configuration file

Determines how HCD handles commit log disk failures.

Reading from spinning disks is slow so HCD buffers them with an extra page of 4KB just in case. This is unnecessary for SSDs so HCD buffers only what is required.

Determines how HCD handles disk failures.

Configure this property to set the snitch. The most common snitches are:

The gossip seed provider and corresponding addresses of nodes that are designated as contact points in the cluster. A joining node contacts the nodes in the seeds list and establishes a connection to the first available node to discover the members of the cluster and topology.

The token allocation algorithm for vnodes distributes token ranges across nodes in a datacenter based on the number of nodes and the value of num_tokens. With allocate_tokens_for_keyspace, token distribution also considers a specified replication factor, resulting in a more balanced distribution compared to legacy random allocation (without vnodes).

The token allocation algorithm for vnodes distributes token ranges across nodes in a datacenter based on the number of nodes and the value of num_tokens. With allocate_tokens_for_local_replication_factor, token distribution also considers a specified replication factor, resulting in a more balanced distribution compared to legacy random allocation (without vnodes).

When joining a cluster for the first time, this property determines whether the node will request replicas to stream data. This is the default behavior. If the node is defined as a seed node, it immediately joins the cluster without data.

Set to the node’s public IP address in environments where nodes are only able to communicate across networks using their public IP addresses such as multi-region Amazon EC2 deployments. Otherwise, the node will broadcast on the same address as listen_address.

Manually assign tokens for token range allocation to nodes:

Set to true on nodes with multiple interfaces to enable communication on both listen_address and broadcast_address.

When using vnodes, defines the number of token ranges to assign to the node:

The partitioner determines how data is distributed across the nodes in the cluster.

The rate at which HCD compacts SSTable candidates, expressed as throughput. For example, 64MiB/s. The faster the database inserts data, the faster HCD must compact in order to keep the number of SSTables down.

Determines how HCD allocates memory to the memtable.

Selects the memtable implementation and configures named memtable profiles. The default profile is applied to any table that does not specify a memtable property.

memtable:
  configurations:
    skiplist:
      class_name: SkipListMemtable
    trie:
      class_name: TrieMemtable
    default:
      inherits: trie

The maximum amount of memory to allocate for memtables on JVM heap, expressed as a size. For example, 2048MiB. When the threshold is reached, writes are blocked until a flush completes.

The maximum amount of memory to allocate for memtables from native memory, expressed as a size. For example, 2048MiB. When the threshold is reached, writes are blocked until a flush completes.

The threshold that triggers a flush based on the ratio of memtable size to the maximum memory size permitted for memtables.

The total number of memtables that can be flushed concurrently as well as the number of flush writer threads per disk. Factors into the memtable flush threshold calculation.

When enabled (set to true), a snapshot is taken before DROP KEYSPACE, DROP TABLE, or TRUNCATE TABLE is executed.

Time-to-live for automatically created snapshots, expressed as a duration. For example, 30d. Snapshots older than this are automatically deleted. Set to 0 to disable automatic deletion of snapshots.

Throttle for the number of hard links created or removed per second when creating or clearing snapshots. A non-zero value limits the rate to avoid performance impact, particularly on consumer SSDs.

When enabled (set to true), HCD creates hard links to each SSTable that has been flushed or streamed in the backups/ subdirectory of the keyspace data. You can also enable incremental backups for an individual table using the incremental_backups table property.

When enabled (set to true), a snapshot is taken before each compaction task. The snapshot may be used as a rollback position in an upgrade. Usage is limited since the general recommendation is to take backups before performing an upgrade.

Whether hinted handoff is enabled globally. When false, no hints are generated for any unavailable replica.

A list of datacenters for which hinted handoff is disabled when hinted_handoff_enabled is true. All other datacenters continue to receive hints. Because hinted_handoff_enabled defaults to true, all datacenters receive hints unless explicitly listed here.

hinted_handoff_disabled_datacenters:
  - DC1
  - DC2

The maximum amount of time hints are generated for a dead node, expressed as a duration.For example, 3h. After this window, new hints for the node are not created until the node has been seen alive again and goes down again.

Maximum throttle for hint delivery, expressed as throughput. For example, 1024KiB/s. The rate is reduced proportionally to the number of nodes in the cluster.

Number of threads used to deliver hints. Consider increasing this value for multi-datacenter deployments where cross-datacenter handoff tends to be slower.

How often hints are flushed from internal buffers to disk, expressed as a duration. This does not trigger an fsync.

Maximum size of a single hints file, expressed as a size. For example, 128MiB.

Maximum total size of hints stored per target host, expressed as a size. Older hints are deleted to stay within this limit.

Whether to automatically delete hints for nodes that have been removed from the cluster.

When true, a decommissioning node transfers its pending hints to other nodes before leaving the cluster.

When true, the hint window state (how long a node has been down) is persisted across node restarts so that the hint window does not reset when the hinting node is restarted.

Defines the mode by which the commit log is synchronized to disk. When the data is considered fully persisted to storage, the data will survive a system crash or power outage. The sync mode also determines when HCD sends a successful write acknowledgement to the coordinator.

Time interval between commit log syncs to disk, expressed as a duration. For example, 10000ms. Only set with periodic sync mode, otherwise an exception will be logged.

The number of milliseconds to block writes while waiting for a slow disk flush to complete in periodic sync mode.

The duration between disk syncs. Only set with group sync mode, otherwise an exception will be logged.

The size of individual commit log file segments. A small size means more frequent flushes leading to small SSTables which put pressure on compaction.

Sets the disk access mode for writing commit log segments:

The compression algorithm applied to SSTable data blocks when flushing a compressed table to disk. High-ratio compressors such as LZ4HC, Zstd, and Deflate can block flushes for too long, so the default uses a faster compressor for flush.

The maximum allowed size of a mutation (the payload size of a write request), expressed as a size. For example, 16MiB. Defaults to half the size of commitlog_segment_size. If explicitly set, you must set commitlog_segment_size to at least twice the value of max_mutation_size.

The maximum disk space for commit logs on disk, expressed as a size. For example, 8192MiB.

By default, the commit log is not compressed. To enable compression, specify the compression library to use.

Enables CDC functionality on a per-node basis when set to true.

When cdc_enabled is true and the CDC raw directory is full, determines whether write requests to CDC-enabled tables are blocked (true) or silently dropped (false).

When true, repairs propagate CDC mutations to the CDC raw directory on the repaired node.

Maximum disk space to use for CDC logs, expressed as a size. For example, 4096MiB. If the limit is reached, HCD throws WriteTimeoutException on mutations, including CDC-enabled tables. A CDCCompactor (a consumer) parses the raw CDC logs and deletes them when parsing is completed.

Interval between disk space checks when the cdc_total_space limit is reached, expressed as a duration. For example, 250ms.

The number of concurrent read threads. For workloads with more data than fits in memory, set to this value to 16 times the number of drives. This ensures the the OS and drives have enough queue depth to reorder requests efficiently.

The number of concurrent write threads. Writes are rarely I/O bound, so the ideal value is 8 times the number of CPU cores.

The number of concurrent counter write threads. Counter writes read the current value before incrementing, so they behave similarly to reads. Set to the same value as concurrent_reads.

The number of concurrent materialized view write threads. Because materialized view writes include a read step, this value should be limited to the lesser of concurrent_reads or concurrent_writes.

The number of compaction threads allowed to run simultaneously. Simultaneous compactions help preserve read performance in a mixed read-write workload by limiting the number of small SSTables that accumulate during a single long-running compaction.

The number of repair validation threads allowed to run simultaneously.

The number of view builder tasks allowed to run simultaneously if materialized views are enabled. This is experimental.

The default compaction strategy and properties to use when a table doesn’t explicitly set compaction properties. Also applies to system tables.

default_compaction:
  class_name: UnifiedCompactionStrategy
  parameters:
    scaling_parameters: T4
    max_sstables_to_compact: 64
    target_sstable_size: 1GiB
    sstable_growth: 0.3333333333333333
    min_sstable_size: 100MiB

Selects the SSTable format for new SSTables using the selected_format subproperty:

sstable:
  selected_format: bti

The size threshold at which the compaction process opens new SSTables before they are fully written, expressed as a size. For example, 50MiB. Set to null to disable preemptive opening.

Maximum size of the native protocol prepared statement cache.

Maximum memory for inter-node and client-server networking buffers, expressed as a size. For example, 128MiB. Allocated from native memory in addition to heap.

Enables the SSTable chunk cache. When enabled, recently accessed sections of SSTables are stored in memory as uncompressed buffers to reduce disk I/O.

Granularity of the collation index of rows within a partition, expressed as a size. For example, 4KiB. A smaller granularity results in faster row lookups within a partition at the cost of a larger index file.

Maximum memory to use for caching SSTable chunks and buffer pools, expressed as a size. For example, 512MiB. Allocated from native memory in addition to heap. Requires file_cache_enabled: true.

When the SSTable buffer pool is exhausted (that is, when it has exceeded file_cache_size), controls whether buffers are allocated on-heap (true) or off-heap (false).

Maximum time the node waits for each cache (row, key, counter) to load at startup before timing out, expressed as a duration. Set to 0 to disable the timeout and wait indefinitely.

Maximum size of the key cache in memory, expressed as a size.

How often the key cache is saved to saved_caches_directory for the big SSTable format only. Saving the key cache greatly improves cold-start speeds with relatively low I/O cost.

Number of keys from the key cache to save. Only relevant to the big SSTable format.

The classname of the row cache provider to use if row_cache_size and row_cache_save_period aren’t 0:

Maximum size of the row cache in memory. The row cache can improve read latency, but it requires a significant amount of memory because it contains the entire row. Use the row cache only for frequently read rows or static rows. If the cache is too small, it might be too cold at startup and perform suboptimally until it has warmed up and recached the most frequently read rows.

How often row cache keys are saved to saved_caches_directory, expressed as a duration. Only applies if row_cache_size is greater than 0.

The number of keys from the row cache to save if row_cache_save_period is greater than 0.

The size of the counter cache. It doesn’t require as much memory as other caches because only the local (clock, count) tuple of a counter cell is kept in memory, not the whole counter.

How often the database saves counter cache keys to saved_caches_directory, expressed as a duration. This keeps the cache warm through restarts.

The number of keys from the counter cache to save if counter_cache_save_period is greater than 0.

Maximum network bandwidth for streaming file transfers between datacenters, expressed as throughput. Set to a value less than or equal to stream_throughput_outbound.

Enables the Zero Copy Streaming feature where eligible SSTables are streamed in their entirety between nodes instead of individual partitions, transferring data at a significantly faster rate.

Maximum network bandwidth permitted for all outbound streaming file transfers on a node, expressed as throughput.

Throttles entire SSTable outbound streaming transfers when stream_entire_sstables is enabled, expressed as throughput. Set to 0 to disable throttling.

Throttles entire SSTable streaming between datacenters when stream_entire_sstables is enabled, expressed as throughput. Set to 0 to disable throttling.

Time interval between keep-alive messages sent during streaming to prevent idle connections from being reset. A stream session is considered stalled and fails when no keep-alive message is received for two consecutive keep-alive periods. With the default of 300s, a stalled stream times out after 10 minutes.

The number of parallel connections used per remote host during streaming. Increase when joins are CPU-bound rather than network-bound, for example when a few nodes have large files.

How long the coordinator waits for read operations to complete, expressed as a duration. For example, 5000ms. The lowest acceptable value is 10 ms.

How long the coordinator waits for sequential scans or index scans to complete, expressed as a duration. The lowest acceptable value is 10 ms.

How long the coordinator waits for write operations to complete, expressed as a duration. The lowest acceptable value is 10 ms.

How long the coordinator waits for counter write operations to complete, expressed as a duration. The lowest acceptable value is 10 ms.

How long the coordinator retries a CAS (lightweight transaction) operation that contends with other proposals for the same row, expressed as a duration. The lowest acceptable value is 10 ms.

How long the coordinator waits for truncations to complete, expressed as a duration. Because auto_snapshot is enabled by default, a flush must complete before the snapshot is taken. The lowest acceptable value is 10 ms.

The default timeout for all other miscellaneous operations, expressed as a duration. The lowest acceptable value is 10 ms.

Upper bound on how long any request received via native transport is considered live and serviceable. When a request exceeds this limit, the server returns an OverloadedException to the client.

How long the coordinator waits for aggregation read operations, such as SELECT COUNT(*) and MIN(x), to complete.

Whether the coordinator and replicas exchange operation timeout information so that replicas can avoid processing requests that have already timed out on the coordinator. Corresponds to the legacy cross_node_timeout parameter (renamed in a prior release).

Threshold duration above which a slow read query is logged as a warning. Select queries that take longer than this threshold generate an aggregated log message to identify slow queries. Set to 0 to disable slow query logging.

Timeout for establishing internode TCP connections, expressed as a duration.

Only supported on Linux with epoll.

Maximum time unacknowledged data can remain on a streaming internode connection before the connection is discarded, expressed as a duration. Set to 0 to increase the timeout (uses OS default).

A dedicated port for encrypted native transport (CQL) connections when client_encryption_options.enabled is true. If set to a different value than native_transport_port, then the standard port remains unencrypted and this port carries encrypted traffic only.

Maximum allowed size of a native transport (CQL) frame. Requests larger than this value are rejected as invalid.

Idle connection timeout for native transport (CQL) connections. Connections that have had no reads or writes for this duration are closed. Clients can prevent closure by sending an OPTIONS request (heartbeat) within the timeout window.

Enables rate limiting for native transport (CQL) requests. When enabled, requests that exceed native_transport_max_requests_per_second are rejected.

Maximum number of native transport (CQL) requests per second across the node. Requires native_transport_rate_limiting_enabled: true.

Size of the TCP send buffer for internode communication, expressed as a size. For example, 1MiB. When not set, the OS default (net.ipv4.tcp_wmem) is used.

Size of the TCP receive buffer for internode communication, expressed as a size. For example, 1MiB. When not set, the OS default (net.ipv4.tcp_rmem) is used.

Per-link capacity of the internode send queue, expressed as a size. For example, 4MiB. Each node pair has three links (urgent, small, large).

Per-endpoint reserve capacity for the internode send queue, expressed as a size. Limits total queued messages to or from a single peer node.

Global reserve capacity for all internode send queues, expressed as a size.

Per-link capacity of the internode receive queue, expressed as a size.

Per-endpoint reserve capacity for the internode receive queue, expressed as a size.

Global reserve capacity for all internode receive queues, expressed as a size.

The number of simultaneous Merkle tree requests allowed during repair.

Maximum memory used for repair session state, expressed as a size. For example, 128MiB. Commented out by default; the calculated default is 1/16th of the heap. A smaller value reduces resolution of repair trees, which can cause over-streaming.

Configuration block for retry behavior during repair sessions. Set in the repair section`. For example:

repair:
  retries:
    enabled: true
    max_retries: 3

The authentication backend that implements IAuthenticator to identify users.

The authorization backend that implements IAuthorizer to limit access and provide permissions:

The role management backend that implements IRoleManager to maintain grants and memberships between roles:

The backend for authenticating and authorizing internode connections. This is now a block with class_name and optional parameters subproperties. For mTLS configuration examples, see Configure mTLS authentication.

internode_authenticator:
  class_name: org.apache.cassandra.auth.AllowAllInternodeAuthenticator
  parameters: {}

The network authorization backend that implements INetworkAuthorizer to restrict user access to certain datacenters. This is now a block with a class_name subproperty:

network_authorizer:
  class_name: org.apache.cassandra.auth.AllowAllNetworkAuthorizer

The CIDR authorization backend that implements ICIDRAuthorizer to restrict user access from certain CIDR ranges. Use a block with class_name subproperty rather than setting the class name as the literal value:

cidr_authorizer:
  class_name: org.apache.cassandra.auth.AllowAllCIDRAuthorizer

Requires cidr_authorizer: CassandraCIDRAuthorizer.

Requires cidr_authorizer: CassandraCIDRAuthorizer.

Requires cidr_authorizer: CassandraCIDRAuthorizer.

Requires cidr_authorizer: CassandraCIDRAuthorizer.

When true, authorization checks for nested resources (such as a column in a table in a keyspace) traverse the entire resource hierarchy from root, checking permissions at each level. When false, checks start from the most specific resource.

Configure client-to-server encryption settings.

client_encryption_options:
    enabled: false                    # Enable client-to-server encryption
    optional: true                    # Allow encrypted and unencrypted connections
    keystore: conf/.keystore         # Path to keystore file
    keystore_password: cassandra     # Keystore password (CHANGE THIS)
    require_client_auth: false        # Verify client certificates
    truststore: conf/.truststore     # Path to truststore file
    truststore_password: cassandra   # Truststore password (CHANGE THIS)
    protocol: TLS                     # SSL/TLS protocol
    store_type: JKS                   # Keystore type
    cipher_suites: [                 # Supported cipher suites
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    ]
    # ssl_context_factory:           # Optional: custom SSL context factory
    #   class_name: ...

Configure server-to-server internode encryption settings.

server_encryption_options:
    internode_encryption: none        # Encryption scope: none, dc, rack, or all
    optional: true                    # Allow encrypted and unencrypted connections
    keystore: conf/.keystore         # Path to keystore file (uncommented by default)
    keystore: conf/.keystore         # Path to keystore file
    keystore_password: cassandra     # Don't use the default keystore password
    require_client_auth: false        # Verify peer server certificates
    truststore: conf/.truststore     # Path to truststore file
    truststore_password: cassandra   # Don't use the default truststore password
    require_endpoint_verification: false  # Verify hostname in certificate
    legacy_ssl_storage_port_enabled: false # Enable legacy SSL storage port (upgrade only)
    # outbound_keystore: conf/.keystore        # Separate keystore for outbound connections
    # outbound_keystore_password: cassandra        # Don't use the default password.
    # ssl_context_factory:
    #   class_name: ...

Configure transparent data encryption (TDE) for data at rest.

transparent_data_encryption_options:
    enabled: false                    # Enable transparent data encryption
    chunk_length_kb: 64              # Encryption chunk size
    cipher: AES/CBC/PKCS5Padding     # Encryption cipher
    key_alias: testing:1             # Key alias for encryption
    iv_length: 16                    # CBC IV length for AES
    key_provider:
      - class_name: org.apache.cassandra.security.JKSKeyProvider
        parameters:
          - keystore: conf/.keystore
            keystore_password: cassandra
            store_type: JCEKS
            key_password: cassandra

Configure audit logging to track CQL commands and authentication events.

audit_logging_options:
    enabled: false                    # Enable audit logging
    logger:
      - class_name: BinAuditLogger   # Audit logger implementation
    audit_logs_dir:                  # Directory for audit logs
    included_keyspaces:              # Keyspaces to audit
    excluded_keyspaces: system, system_schema, system_virtual_schema
    included_categories:             # Categories to audit
    excluded_categories:             # Categories to exclude
    included_users:                  # Users to audit
    excluded_users:                  # Users to exclude
    roll_cycle: HOURLY              # Log roll cycle
    block: true                      # Block on log write
    max_queue_weight: 268435456     # Max queue weight (256 MiB)
    max_log_size: 17179869184       # Max log size (16 GiB)
    archive_command:                 # Archive command
    max_archive_retries: 10         # Max archive retries

Time-to-live for query trace entries in the system_traces.events table, expressed as a duration.

Time-to-live for repair trace entries in the system_traces.events table, expressed as a duration.

Validity period for the roles cache, expressed as a duration.

Validity period for the permissions cache, expressed as a duration.

Validity period for the credentials cache, expressed as a duration.

Refresh interval for the roles cache, expressed as a duration.

When true, the roles cache is updated proactively in the background before entries expire, rather than waiting for the first access after expiry.

Refresh interval for the permissions cache, expressed as a duration.

When true, the permissions cache is updated proactively in the background before entries expire, rather than waiting for the first access after expiry.

Refresh interval for the credentials cache, expressed as a duration.

When true, the credentials cache is updated proactively in the background before entries expire.

Log a warning when scanning more tombstones than this threshold.

Fail queries that scan more tombstones than this threshold.

Configuration block for replica filtering protection. This guardrail materializes replica results on-heap at the coordinator during filtering or secondary index queries at consistency levels above ONE or LOCAL_ONE. This ensures correct results even when replicas are stale, but can use significant heap for large result sets.

replica_filtering_protection:
  cached_rows_warn_threshold: 2000
  cached_rows_fail_threshold: 32000

Warning threshold for the number of rows in a page. Set to -1 to disable.

Failure threshold to prevent paging queries that request more rows than this limit. Set to -1 to disable.

Warning threshold for the number of rows skipped by LIMIT/OFFSET paging.

Failure threshold to prevent LIMIT/OFFSET paging from skipping more rows than this limit.

Warning threshold for the cartesian product size of an IN query.

Failure threshold to prevent IN queries whose cartesian product exceeds this limit.

Warning threshold for the number of partition keys in an IN query.

Failure threshold to prevent IN queries selecting more partition keys than this limit.

Log WARN on any multiple-partition batch size that exceeds this value.

Fail any multiple-partition batch that exceeds this value.

Log WARN on any batches not of type LOGGED that span across more partitions than this limit.

Warning threshold for the size of an individual column value, such as 1MiB.

Failure threshold to prevent writing column values larger than this size, such as 1MiB.

Logs a warning when write queries use the specified consistency levels.

Prevents write queries with the specified consistency levels.

Logs a warning when read queries use the specified consistency levels.

Prevents read queries with the specified consistency levels.

Whether to allow read-before-write operations, such as setting a list element by index or removing a list element by index or value.

Whether to allow user-provided timestamps in write requests.

Warning threshold for tables that have more than this number of columns.

Failure threshold to prevent tables from having more than this number of columns.

Warning threshold for the size of a collection column, expressed as a size. For example, 1MiB.

Failure threshold for the size of a collection column, expressed as a size. For example, 1MiB.

Warning threshold for the number of elements in a collection.

Failure threshold for the number of elements in a collection.

Warning threshold for the total number of user tables.

Failure threshold to prevent creating more tables than this limit.

Prevents creating tables with the specified properties.

Whether to allow CREATE TABLE or ALTER TABLE statements that set default_time_to_live = 0 on a table using TimeWindowCompactionStrategy.

Whether to emit a warning when a CREATE TABLE or ALTER TABLE statement sets default_time_to_live = 0 on a table using TimeWindowCompactionStrategy.

Whether to enable dynamic data masking (DDM), which allows CQL masking functions to be attached to table columns.

Warning threshold for the number of dimensions in a vector column.

Failure threshold to prevent creating vector columns with more dimensions than this limit.

Warning threshold for the total number of user keyspaces.

Failure threshold to prevent creating more keyspaces than this limit.

Warning threshold when a keyspace is created or altered with a replication factor less than this value.

Failure threshold to prevent creating keyspaces with a replication factor less than this value.

Warning threshold when a keyspace is created or altered with a replication factor greater than this value.

Failure threshold to prevent creating keyspaces with a replication factor greater than this value.

Warning threshold for the number of fields in a user-defined type.

Failure threshold to prevent a user-defined type from having more than this number of fields.

Warning threshold for the number of secondary indexes per table. Does not apply to CUSTOM INDEX StorageAttachedIndex.

Failure threshold to prevent creating more secondary indexes per table than this limit. Does not apply to CUSTOM INDEX StorageAttachedIndex.

Warning threshold for the number of StorageAttachedIndex (SAI) indexes per table. Only applies to CUSTOM INDEX StorageAttachedIndex.

Failure threshold for the number of StorageAttachedIndex per table. Only applies to CUSTOM INDEX StorageAttachedIndex.

Warning threshold for the total number of StorageAttachedIndex across all keyspaces.

Failure threshold for the total number of StorageAttachedIndex across all keyspaces.

Warning threshold for the number of SAI SSTable indexes referenced on a replica when executing a SELECT query.

Failure threshold for the number of SAI SSTable indexes referenced on a replica when executing a SELECT query. Set to -1 to disable.

Whether to allow secondary index queries that do not restrict on a partition key.

Warning threshold for the number of materialized views per table.

Failure threshold to prevent creating more materialized views per table than this limit. Set to 0 to disallow materialized views entirely on this node.

Log a warning when compacting partitions larger than this value.

Fail operations that produce partitions larger than this value, such as 1GiB.

Warning threshold when local data disk usage exceeds this percentage. Valid values are 1 to 100.

Failure threshold to reject write requests if replica disk usage exceeds threshold. Valid values are 1 to 100.

Maximum disk size used as the basis for calculating data_disk_usage_percentage_warn_threshold and data_disk_usage_percentage_fail_threshold, expressed as a size. For example, 500GiB.

The directory where HCD writes heap dump files.

When true, HCD automatically triggers a heap dump when an uncaught exception causes the JVM to terminate.

When true, enables diagnostic event emission for troubleshooting operational issues. Diagnostic events contain details on internal state and temporal relationships across events, and are accessible by clients via JMX.

Whether to track the repaired data state during range reads. Mismatches between the repaired datasets across replicas are reported as confirmed or unconfirmed.

Whether to track repaired data state during partition reads.

When true, records a separate metric for unconfirmed repaired data mismatches in addition to confirmed ones. Unconfirmed mismatches can occur due to pending repair sessions or unrepaired partition tombstones, and they are less likely to require intervention than confirmed mismatches.

The disk access mode for reading SSTable data files. This is separate from commitlog_disk_access_mode, which controls commit log access.

Configuration block to install a cryptographic provider at startup. By default, HCD installs the DefaultCryptoProvider, which uses the Amazon Corretto Crypto Provider (ACCP) where available and falls back to the JRE default if ACCP is not present. To force a failure when the provider is not installed properly, set fail_on_missing_provider to "true". To bypass the installation of a crypto provider entirely, use org.apache.cassandra.security.JREProvider.

crypto_provider:
  - class_name: org.apache.cassandra.security.DefaultCryptoProvider
    parameters:
      - fail_on_missing_provider: "false"

How long completed streaming session state is retained in the system_views.streaming table, expressed as a duration.

Maximum number of streaming session entries to retain in the system_views.streaming table.

Whether streaming statistics are tracked and exposed through the system_views.streaming table.

Whether partition-level denylisting is enabled.

Maximum number of denylist entries per table. Nodes warn when this limit is exceeded but continue to allow new entries.

Maximum total number of denylist entries across all tables.

How often the in-memory denylist cache is refreshed from the system.denylist_table table, expressed as a duration. This serves as a fail-safe; the recommended pattern is to call the refresh API explicitly after any changes to denylist entries.

How often to retry loading the denylist from the system table during node startup if the initial load fails, expressed as a duration.

Whether write denylisting is enabled when partition_denylist_enabled is true.

Whether read denylisting is enabled when partition_denylist_enabled is true.

Whether range read denylisting is enabled when partition_denylist_enabled is true.

The consistency level used when reading from the system.denylist_table table.