crowdsecurity/crowdsec · error · DeleteFail

alert graph delete batch events: %w

Error message

alert graph delete batch events: %w

What it means

DeleteAlertGraphBatch deletes all event rows owned by the alerts in idList; on failure the raw DB error is logged as a warning and a wrapped DeleteFail is returned. The alert graph (events) could not be removed.

Source

Thrown at pkg/database/alerts.go:904

		}

		offset += paginationSize
	}

	return ret, nil
}

func (c *Client) DeleteAlertGraphBatch(ctx context.Context, alertItems []*ent.Alert) (int, error) {
	idList := make([]int, 0)
	for _, alert := range alertItems {
		idList = append(idList, alert.ID)
	}

	_, err := c.Ent.Event.Delete().
		Where(event.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch events: %w", DeleteFail)
	}

	_, err = c.Ent.Meta.Delete().
		Where(meta.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch meta: %w", DeleteFail)
	}

	_, err = c.Ent.Decision.Delete().
		Where(decision.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch decisions: %w", DeleteFail)
	}

	deleted, err := c.Ent.Alert.Delete().
		Where(alert.IDIn(idList...)).Exec(ctx)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the warning log line for the underlying driver error
2. Delete in smaller batches to stay under the driver's IN-clause/parameter limit
3. Retry after resolving DB connectivity or lock contention
4. Run `cscli alerts delete` during low-traffic windows for big cleanups

if len(idList) == 0 {
    return nil // nothing to delete
}

n, err := client.DeleteAlertGraphBatch(ctx, ids)
if err != nil {
    // retry in smaller chunks
    return retryChunks(ids, 100)
}

When it happens

Trigger: c.Ent.Event.Delete().Where(event.HasOwnerWith(alert.IDIn(...))).Exec(ctx) fails — DB unavailable, oversized IN clause (too many alert IDs), context cancelled, FK/lock contention.

Common situations: `cscli alerts delete` with a very large ID list exceeding driver parameter limits; SQLite lock during concurrent writes; DB restart mid-delete.

Related errors

• alert graph delete batch meta: %w
• alert with ID '%d': %w
• unable to delete
• event meta '%v': %w: %w
• machine '%s': %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/203a837bd5c17a65. Report an issue: GitHub.