{"record":{"id":"203a837bd5c17a65","repo":"crowdsecurity/crowdsec","slug":"alert-graph-delete-batch-events-w","errorCode":null,"errorMessage":"alert graph delete batch events: %w","messagePattern":"alert graph delete batch events: %w","errorType":"exception","errorClass":"DeleteFail","httpStatus":null,"severity":"error","filePath":"pkg/database/alerts.go","lineNumber":904,"sourceCode":"\t\t}\n\n\t\toffset += paginationSize\n\t}\n\n\treturn ret, nil\n}\n\nfunc (c *Client) DeleteAlertGraphBatch(ctx context.Context, alertItems []*ent.Alert) (int, error) {\n\tidList := make([]int, 0)\n\tfor _, alert := range alertItems {\n\t\tidList = append(idList, alert.ID)\n\t}\n\n\t_, err := c.Ent.Event.Delete().\n\t\tWhere(event.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraphBatch : %s\", err)\n\t\treturn 0, fmt.Errorf(\"alert graph delete batch events: %w\", DeleteFail)\n\t}\n\n\t_, err = c.Ent.Meta.Delete().\n\t\tWhere(meta.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraphBatch : %s\", err)\n\t\treturn 0, fmt.Errorf(\"alert graph delete batch meta: %w\", DeleteFail)\n\t}\n\n\t_, err = c.Ent.Decision.Delete().\n\t\tWhere(decision.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraphBatch : %s\", err)\n\t\treturn 0, fmt.Errorf(\"alert graph delete batch decisions: %w\", DeleteFail)\n\t}\n\n\tdeleted, err := c.Ent.Alert.Delete().\n\t\tWhere(alert.IDIn(idList...)).Exec(ctx)","sourceCodeStart":886,"sourceCodeEnd":922,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/alerts.go#L886-L922","documentation":"DeleteAlertGraphBatch deletes all event rows owned by the alerts in idList; on failure the raw DB error is logged as a warning and a wrapped DeleteFail is returned. The alert graph (events) could not be removed.","triggerScenarios":"c.Ent.Event.Delete().Where(event.HasOwnerWith(alert.IDIn(...))).Exec(ctx) fails — DB unavailable, oversized IN clause (too many alert IDs), context cancelled, FK/lock contention.","commonSituations":"`cscli alerts delete` with a very large ID list exceeding driver parameter limits; SQLite lock during concurrent writes; DB restart mid-delete.","solutions":["Check the warning log line for the underlying driver error","Delete in smaller batches to stay under the driver's IN-clause/parameter limit","Retry after resolving DB connectivity or lock contention","Run `cscli alerts delete` during low-traffic windows for big cleanups"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if len(idList) == 0 {\n    return nil // nothing to delete\n}","typeGuard":null,"tryCatchPattern":"n, err := client.DeleteAlertGraphBatch(ctx, ids)\nif err != nil {\n    // retry in smaller chunks\n    return retryChunks(ids, 100)\n}","preventionTips":["Delete alerts in chunks of a few hundred IDs max","Schedule big cleanups when the DB is idle","For SQLite, avoid concurrent writers during deletes"],"tags":["database","delete","alerts"],"backgroundTag":"database-write-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}