Step 1: Verify the ClickHouse service status:
Run the following command:
systemctl status clickhouse-server
Expected Result:
The service should display as actively running.
If the service is inactive or failed, review the ClickHouse logs before proceeding.
Step 2: Verify ClickHouse is accepting queries:
Run:
clickhouse-client --query "SELECT version();"
Expected Result:
The command should return the installed ClickHouse version without errors.
Step 3: Verify database accessibility:
Run:
clickhouse-client --query "SHOW DATABASES;"
Expected Result:
The query should return the list of available databases, including the FortiSIEM database.
Step 4: Verify cluster health (Distributed deployments):
Run:
clickhouse-client --query "SELECT * FROM system.clusters;"
Expected Result:
All configured cluster nodes should be listed without connection errors.
Step 5: Verify replica status:
Run:
clickhouse-client --query "SELECT database, table, is_leader, is_readonly, queue_size, absolute_delay FROM system.replicas;"
Expected Result:
 is_readonly should be 0.  queue_sizes should remain low or zero under normal conditions.  absolute_delay  should not continuously increase.
Step 6: Verify disk usage:
Run:
clickhouse-client --query "SELECT name, path, free_space, total_space FROM system.disks;"
Expected Result:
Verify that sufficient free disk space is available for ClickHouse operations.
Step 7: Verify active merges:
Run:
clickhouse-client --query "SELECT * FROM system.merges;
Expected Result:
Active merge operations may be present. Long-running or excessive merges may indicate heavy system load.
Step 8: Check recent ClickHouse errors:
Review the ClickHouse log:
tail -100 /var/log/clickhouse-server/clickhouse-server.log
Look for errors such as: Disk full. Replica unavailable. Connection timeout. Merge failures. Read-only mode.
Step 10: Verify table availability:
Run:
clickhouse-client --query "SHOW TABLES;"
Expected Result:
All expected FortiSIEM tables should be listed without errors.
Verification:
The ClickHouse backend can be considered healthy if: ClickHouse service is running. Client queries execute successfully. Database and tables are accessible. No replica synchronization issues are reported. Sufficient disk space is available. No critical errors are present in the ClickHouse logs.
| 
