{"record":{"id":"205525df0272f669","repo":"crowdsecurity/crowdsec","slug":"alert-with-id-d-w","errorCode":null,"errorMessage":"alert with ID '%d': %w","messagePattern":"alert with ID '(.+?)': %w","errorType":"exception","errorClass":"DeleteFail","httpStatus":null,"severity":"error","filePath":"pkg/database/alerts.go","lineNumber":962,"sourceCode":"\t\tWhere(meta.HasOwnerWith(alert.IDEQ(alertItem.ID))).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraph : %s\", err)\n\t\treturn fmt.Errorf(\"meta with alert ID '%d': %w\", alertItem.ID, DeleteFail)\n\t}\n\n\t// delete the associated decisions\n\t_, err = c.Ent.Decision.Delete().\n\t\tWhere(decision.HasOwnerWith(alert.IDEQ(alertItem.ID))).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraph : %s\", err)\n\t\treturn fmt.Errorf(\"decision with alert ID '%d': %w\", alertItem.ID, DeleteFail)\n\t}\n\n\t// delete the alert\n\terr = c.Ent.Alert.DeleteOne(alertItem).Exec(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"DeleteAlertGraph : %s\", err)\n\t\treturn fmt.Errorf(\"alert with ID '%d': %w\", alertItem.ID, DeleteFail)\n\t}\n\n\treturn nil\n}\n\nfunc (c *Client) DeleteAlertByID(ctx context.Context, id int) error {\n\talertItem, err := c.Ent.Alert.Query().Where(alert.IDEQ(id)).Only(ctx)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn c.DeleteAlertGraph(ctx, alertItem)\n}\n\nfunc (c *Client) DeleteAlertWithFilter(ctx context.Context, filter map[string][]string) (int, error) {\n\tpreds, err := alertPredicatesFromFilter(filter)\n\tif err != nil {\n\t\treturn 0, err","sourceCodeStart":944,"sourceCodeEnd":980,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/alerts.go#L944-L980","documentation":"The final step of DeleteAlertGraph: deleting the alert row itself after its children were removed. This error means Alert.DeleteOne(alertItem) failed — the alert persists even though its events/meta/decisions are gone. Wraps the DeleteFail sentinel.","triggerScenarios":"DeleteAlertByID(ctx, id) -> DeleteAlertGraph: Alert.DeleteOne(alertItem) fails, typically because the alert was concurrently deleted by another request, or a DB error (connection, grant, lock) occurs.","commonSituations":"Two LAPI requests deleting the same alert concurrently; DB failover; privileged-operational cleanup scripts racing with cscli alerts delete.","solutions":["Read the 'DeleteAlertGraph : %s' warning for the underlying error","If the alert no longer exists it was deleted concurrently — treat as success","Retry DeleteAlertByID once; if it now returns not-found, cleanup is effectively complete","Serialize concurrent deletes in your automation"],"exampleFix":"// before\nerr := client.DeleteAlertByID(ctx, id)\n// after\nerr := client.DeleteAlertByID(ctx, id)\nif err != nil && errors.Is(err, entdb.DeleteFail) {\n    // maybe already deleted concurrently; verify before retrying\n}","handlingStrategy":"try-catch","validationCode":"exists, _ := client.Ent.Alert.Query().Where(alert.IDEQ(id)).Exist(ctx)\nif !exists { return nil } // already deleted concurrently","typeGuard":null,"tryCatchPattern":"err := client.DeleteAlertByID(ctx, id)\nif err != nil {\n    if _, checkErr := client.GetAlertByID(ctx, id); checkErr != nil {\n        // alert gone: concurrent delete, treat as success\n    }\n}","preventionTips":["Serialize delete operations for the same alert","Treat 'not found after failure' as success in cleanup scripts","Check DB grants on alerts","Log and dedupe concurrent delete attempts in automation"],"tags":["database","delete","alerts"],"backgroundTag":"database-write-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}