Cleaning out old OSSEC alerts

ugly_delete.sql

WITH
  del_data AS (
    DELETE
      FROM data
      WHERE EXISTS (
              SELECT id
                FROM alert
                WHERE timestamp <= EXTRACT(EPOCH FROM (NOW() - '1 year'::interval))::integer AND
                      data.id = alert.id
            )
      RETURNING id
  )

  DELETE
    FROM alert
    WHERE EXISTS (
            SELECT 1
              FROM del_data
              WHERE alert.id = del_data.id
          );