I wonder how to trigger an error message immediately when user enters a command instead of when the user commits the transaction? I am currently doing the validation under CDB_SUB_PREPARE but looks like this validation gets kicked in only when the user commits the transaction.
I was under impression that CDB_SUB_PREPARE is every time user enters a command ; and CDB_SUB_COMMIT is when the user commits.
Please let me know if my understanding is wrong.

root@cavium-thunderx 21:25:12% set link vlan-map 0 vid 0
[ok][2018-01-12 21:25:22]

root@cavium-thunderx 21:25:22% commit
Aborted: resource denied: 0 is invalid (range is 2-4094) (abort the transaction)
[error][2018-01-12 21:25:25]

root@cavium-thunderx 21:25:25%

Hello, CDB_SUB_PREPARE cannot be used for this. It is invoked in prepare phase against running database, which is after commit operation. The difference between CDB_SUB_PREPARE and CDB_SUB_COMMIT is, that when processing CDB_SUB_PREPARE subscriptions, you can still abort
current transaction by calling cdb_sub_abort_trans().
See ConfD UG - description of cdb_subscribe2 function (in confd_lib_cdb) and also ConfD transaction state diagram (e.g. in 7.5. User sessions and ConfD Transactions).

If you want to trigger error message immediately user enters command, you should also consider possible consequences in other northbound interfaces, which are different from CLI. This is the reason why validation is done in validate phase.

For CLI you may look at clispec and override config commands with CLI custom commands (which fill appropriate configuration via maapi) . This is possible if you have few commands that you need to check and display message.

Also, if it is just a matter of rejecting values that are invalid “by definition”, i.e. the validity does not depend on other data, as is presumably the case with the vlan-id in the example, the restriction can, and probably should, be specified in the type definition. E.g.

type uint16 {
  range "2 .. 4094"

This will also result in an immediate error when the invalid value is entered in the CLI.

@per, unfortunately my validation rules depend on other data as well… Let me try what @mnovak has suggested.

Thanks will take a look