Troubleshooting Tip: ClickHouse storage configured in GUI but not reflected in backend

Description

This article describes how to resolve an issue where ClickHouse storage configured for a Supervisor or Worker node in the FortiSIEM GUI does not appear correctly in the backend. This may result in missing mount points, uninitialized storage paths, or ClickHouse services failing to start.

Scope

 FortiSIEM Supervisor and Worker nodes using ClickHouse storage.

Solution

The inconsistency can be fixed by manually configuring the storage and ClickHouse services on the affected node by performing the following steps:

Note: Replace 'X' in the disk name '/dev/sdX' in steps 1, 3, and 4 before following the steps.

1. Wipe existing filesystem signatures:
   
   

   wipefs -a /dev/sdX

   
   

2. Create the mount directory:
   
   

   mkdir /data-clickhouse-hot-1

   
   

3. Format the disk as XFS:
   
   

   mkfs.xfs /dev/sdX

   
   

4. Add the disk to /etc/fstab:
   
   

   echo "UUID=$(blkid /dev/sdX | awk -F'"' '{print $2}') /data-clickhouse-hot-1 xfs defaults 0 0" >> /etc/fstab

   
   

5. Mount the filesystem and reload systemd:
   
   

   mount -a
   systemctl daemon-reload
   df -h

   
   

6. Create ClickHouse directory structure:
   
   

   mkdir /data-clickhouse-hot-1/clickhouse

   
   

7. Set ownership for ClickHouse:
   
   

   chown -R clickhouse.clickhouse /data-clickhouse-hot-1/

   
   

8. Restart the ClickHouse server:
   
   

   systemctl restart clickhouse-server

   
   

9. Verify ClickHouse directory initialization:
   
   

   ls -ltrh /data-clickhouse-hot-1/clickhouse/

   
   

10. Restart and enable monitoring services:
    
    

    systemctl restart phClickHouseMonitor
    systemctl enable phClickHouseMonitor
    systemctl enable clickhouse-server

    
    

11. Validate ClickHouse databases:
    
    

    clickhouse-client -q "select * from system.databases"

    
    

12. Enable ClickHouse in the FortiSIEM configuration file.

Edit the FortiSIEM configuration file:

vi /opt/phoenix/config/phoenix_config.txt

Locate the following block:

[BEGIN ClickHouse]

Under this block, change the ClickHouse enable flag:

enable=false

To:

enable=true

13. Check service status:
    
    

phstatus