diff --git a/pkg/database/alerts.go b/pkg/database/alerts.go index c6fee27fb..3b0c63e00 100644 --- a/pkg/database/alerts.go +++ b/pkg/database/alerts.go @@ -575,11 +575,36 @@ func (c *Client) DeleteAlertWithFilter(filter map[string][]string) (int, error) return len(alertsToDelete), nil } +func (c *Client) FlushOrphans() { + /* While it has only been linked to some very corner-case bug : https://github.com/crowdsecurity/crowdsec/issues/778 */ + /* We want to take care of orphaned events for which the parent alert/decision has been deleted */ + + events_count, err := c.Ent.Event.Delete().Where(event.Not(event.HasOwner())).Exec(c.CTX) + if err != nil { + c.Log.Warningf("error while deleting orphan events : %s", err) + return + } + if events_count > 0 { + c.Log.Infof("%d deleted orphan events", events_count) + } + + events_count, err = c.Ent.Decision.Delete().Where(decision.Not(decision.HasOwner())).Exec(c.CTX) + if err != nil { + c.Log.Warningf("error while deleting orphan decisions : %s", err) + return + } + if events_count > 0 { + c.Log.Infof("%d deleted orphan decisions", events_count) + } +} + func (c *Client) FlushAlerts(MaxAge string, MaxItems int) error { var deletedByAge int var deletedByNbItem int var totalAlerts int var err error + + c.FlushOrphans() totalAlerts, err = c.TotalAlerts() if err != nil { c.Log.Warningf("FlushAlerts (max items count) : %s", err)