What causes "unable to delete allowlist items: %w" in crowdsecurity/crowdsec?

Inspect the wrapped database error for the root cause

unable to delete allowlist items: %w

Error message

unable to delete allowlist items: %w

What it means

DeleteAllowList first removes the allowlist's items, then the allowlist itself. This error means the AllowListItem DELETE (filtered by allowlist name and fromConsole flag) failed, so nothing was deleted and the whole operation aborted. The raw DB error is wrapped.

Source

Thrown at pkg/database/allowlists.go:45

		SetFromConsole(fromConsole).
		SetDescription(description).
		SetAllowlistID(allowlistID).
		Save(ctx)
	if err != nil {
		if sqlgraph.IsUniqueConstraintError(err) {
			return nil, fmt.Errorf("allowlist '%s' already exists", name)
		}

		return nil, fmt.Errorf("unable to create allowlist: %w", err)
	}

	return allowlist, nil
}

func (c *Client) DeleteAllowList(ctx context.Context, name string, fromConsole bool) error {
	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole))).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist items: %w", err)
	}

	c.Log.Debugf("deleted %d items from allowlist %s", nbDeleted, name)

	nbDeleted, err = c.Ent.AllowList.
		Delete().
		Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)).
		Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist: %w", err)
	}

	if nbDeleted == 0 {
		return fmt.Errorf("allowlist %s not found", name)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Inspect the wrapped database error for the root cause
Verify DB connectivity and DELETE grants on the allowlist_items table
Retry the delete
Check for lock contention with concurrent allowlist edits

Defensive patterns

Strategy: try-catch

Validate before calling

exists, err := client.Ent.AllowList.Query().Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)).Exist(ctx)
if err != nil || !exists { /* allowlist absent: skip */ }

Try / catch

err := client.DeleteAllowList(ctx, name, false)
if err != nil {
    // raw DB error is wrapped; log it and check connectivity/grants
    return err
}

Prevention

Confirm the allowlist exists and the fromConsole flag matches before deleting
Grant DELETE on allowlist_items to the DB user
Retry on transient DB failures
Avoid deleting allowlists while console sync is writing items

When it happens

Trigger: c.DeleteAllowList(ctx, name, fromConsole) where AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(...)) fails — DB down, permission, lock, or context cancellation.

Common situations: cscli allowlist delete while the DB is under heavy write load; DB connection dropped; DB user lacking DELETE on allowlist_items.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/52e0c99b12790e6f. Report an issue: GitHub.