crowdsecurity/crowdsec · error · DeleteFail

alert graph delete batch meta: %w

Error message

alert graph delete batch meta: %w

What it means

DeleteAlertGraphBatch deletes meta rows owned by the alerts in idList; on failure it logs the raw error and returns DeleteFail wrapped. Events deletion had succeeded (or was skipped) but the meta cleanup failed, potentially leaving orphaned meta rows.

Source

Thrown at pkg/database/alerts.go:911

func (c *Client) DeleteAlertGraphBatch(ctx context.Context, alertItems []*ent.Alert) (int, error) {
	idList := make([]int, 0)
	for _, alert := range alertItems {
		idList = append(idList, alert.ID)
	}

	_, err := c.Ent.Event.Delete().
		Where(event.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch events: %w", DeleteFail)
	}

	_, err = c.Ent.Meta.Delete().
		Where(meta.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch meta: %w", DeleteFail)
	}

	_, err = c.Ent.Decision.Delete().
		Where(decision.HasOwnerWith(alert.IDIn(idList...))).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return 0, fmt.Errorf("alert graph delete batch decisions: %w", DeleteFail)
	}

	deleted, err := c.Ent.Alert.Delete().
		Where(alert.IDIn(idList...)).Exec(ctx)
	if err != nil {
		c.Log.Warningf("DeleteAlertGraphBatch : %s", err)
		return deleted, fmt.Errorf("alert graph delete batch: %w", DeleteFail)
	}

	c.Log.Debug("Done batch delete alerts")

View on GitHub (pinned to 909b515798)

Solutions

1. Check the preceding Warningf log for the raw driver error
2. Retry DeleteAlertGraphBatch; deletion is per-graph step so re-running is safe for cleanup
3. Reduce batch size if IN-clause limits are implicated
4. Inspect for orphaned meta rows if the failure persists and clean with a manual delete by alert_id

if len(idList) == 0 {
    return nil
}

_, err := client.DeleteAlertGraphBatch(ctx, ids)
if err != nil {
    // safe to retry; verify meta cleanup afterwards
    return retryAfterCleanup(ctx, ids)
}

When it happens

Trigger: c.Ent.Meta.Delete().Where(meta.HasOwnerWith(alert.IDIn(...))).Exec(ctx) fails — DB connectivity, lock contention, oversized ID list, context cancelled.

Common situations: Large batch alert deletion against SQLite under lock contention; connection dropped between the event and meta delete statements; MySQL deadlock with a concurrent alert writer.

Related errors

• alert graph delete batch events: %w
• alert with ID '%d': %w
• unable to delete
• event meta '%v': %w: %w
• machine '%s': %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/239ca63d30848841. Report an issue: GitHub.