crowdsecurity/crowdsec · error · DeleteFail

alert graph delete batch events

Error message

alert graph delete batch events: %w

What it means

DeleteAlertGraphBatch deletes all event rows owned by the alerts in idList; on failure the raw DB error is logged as a warning and a wrapped DeleteFail is returned. The alert graph (events) could not be removed.

Solutions

1. Check the warning log line for the underlying driver error
2. Delete in smaller batches to stay under the driver's IN-clause/parameter limit
3. Retry after resolving DB connectivity or lock contention
4. Run `cscli alerts delete` during low-traffic windows for big cleanups

if len(idList) == 0 {
    return nil // nothing to delete
}

n, err := client.DeleteAlertGraphBatch(ctx, ids)
if err != nil {
    // retry in smaller chunks
    return retryChunks(ids, 100)
}

When it happens

Trigger: c.Ent.Event.Delete().Where(event.HasOwnerWith(alert.IDIn(...))).Exec(ctx) fails — DB unavailable, oversized IN clause (too many alert IDs), context cancelled, FK/lock contention.

Common situations: `cscli alerts delete` with a very large ID list exceeding driver parameter limits; SQLite lock during concurrent writes; DB restart mid-delete.

Related errors

• alert graph delete batch meta
• alert with ID
• alert graph delete batch decisions
• alert graph delete batch
• could not delete alerts

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/203a837bd5c17a65. Report an issue: GitHub.

Appendix: source

Thrown at pkg/database/alerts.go:904

		}

		offset += paginationSize
	}

	return ret, nil
}

func (c *Client) DeleteAlertGraphBatch(ctx context.Context, alertItems []*ent.Alert) (int, error) {
	idList := make([]int, 0)
	for _, alert := range alertItems {
		idList = append(idList, alert.ID)
	}

	_, err := c.Ent.Event.Delete().
		Where(event.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch events: %w", DeleteFail)
	}

	_, err = c.Ent.Meta.Delete().
		Where(meta.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch meta: %w", DeleteFail)
	}

	_, err = c.Ent.Decision.Delete().
		Where(decision.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch decisions: %w", DeleteFail)
	}

	deleted, err := c.Ent.Alert.Delete().
		Where(alert.IDIn(idList...)).Exec(ctx)

View on GitHub (pinned to 909b515798)