Troubleshooting Tip: High root disk usage on collector due to clickhouse service

This article provides the steps to free up space consumed by the ClickHouse service on the root partition of the FortiSIEM collector.

1. Run the following command first to know if the disk usage is due to clickhouse directories (/var/lib/clickhouse and /var/log/clickhouse-server).
   
   du --max-depth=4 -xh / | sort -hr | head -n 20
   
   
2. Stop and disable the clickhouse-server service:
   
   systemctl stop clickhouse-server.service
   systemctl disable clickhouse-server.service
   
   
3. Remove clickhouse data:
   
   rm -rf /var/log/clickhouse-server/
   rm -rf /var/lib/clickhouse/