{"record":{"id":"33ea036a3479449d","repo":"apache/rocketmq","slug":"delete-acl-from-rocksdb-failed","errorCode":null,"errorMessage":"delete Acl from RocksDB failed.","messagePattern":"delete Acl from RocksDB failed\\.","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java","lineNumber":102,"sourceCode":"            byte[] valueBytes = JSON.toJSONBytes(acl);\n            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);\n            this.storage.flushWAL();\n            this.aclCache.invalidate(subject.getSubjectKey());\n        } catch (Exception e) {\n            throw new AuthorizationException(\"create Acl to RocksDB failed.\", e);\n        }\n        return CompletableFuture.completedFuture(null);\n    }\n\n    @Override\n    public CompletableFuture<Void> deleteAcl(Subject subject) {\n        try {\n            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);\n            this.storage.delete(AUTH_METADATA_COLUMN_FAMILY, keyBytes);\n            this.storage.flushWAL();\n            this.aclCache.invalidate(subject.getSubjectKey());\n        } catch (Exception e) {\n            throw new AuthorizationException(\"delete Acl from RocksDB failed.\", e);\n        }\n        return CompletableFuture.completedFuture(null);\n    }\n\n    @Override\n    public CompletableFuture<Void> updateAcl(Acl acl) {\n        try {\n            Subject subject = acl.getSubject();\n            byte[] keyBytes = subject.getSubjectKey().getBytes(StandardCharsets.UTF_8);\n            byte[] valueBytes = JSON.toJSONBytes(acl);\n            this.storage.put(AUTH_METADATA_COLUMN_FAMILY, keyBytes, keyBytes.length, valueBytes);\n            this.storage.flushWAL();\n            this.aclCache.invalidate(subject.getSubjectKey());\n        } catch (Exception e) {\n            throw new AuthorizationException(\"update Acl to RocksDB failed.\", e);\n        }\n        return CompletableFuture.completedFuture(null);\n    }","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/provider/LocalAuthorizationMetadataProvider.java#L84-L120","documentation":"LocalAuthorizationMetadataProvider.deleteAcl() wraps failures from removing a subject's key from the local RocksDB ACL store (delete + flushWAL). As with create/update, the meaningful diagnostic is the nested cause: RocksDB I/O failure, closed handle, or encoding problems with the subject key.","triggerScenarios":"deleteAcl(subject) while RocksDB is unavailable (disk error, store closed during shutdown, corrupted column family) or when the subject key bytes cannot be encoded.","commonSituations":"Deleting ACLs during broker shutdown/restart windows; failing disk on the config volume; RocksDB directory corrupted after a crash.","solutions":["Read the nested cause to pinpoint the RocksDB-level failure","Verify broker is fully started (store open) before issuing ACL deletions","Check disk health and space on the auth config path","If the store is corrupted, restore the acls directory from backup or recreate it and re-import the ACLs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    provider.deleteAcl(subject).join();\n} catch (CompletionException e) {\n    Throwable real = ExceptionUtils.getRealException(e);\n    // inspect real.getCause() for the RocksDB-level failure before retrying\n}","preventionTips":["Perform ACL deletions only when the broker is fully started","Watch broker logs for store errors before batching ACL deletions"],"tags":["auth","rocksdb","persistence","acl","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}