Troubleshooting Tip: How to resolve 'Authentication failed: password is incorrect, or there is no user with such name' Clickhouse error on FortiSIEM node

Description

This article describes how to resolve an 'Authentication failed: password is incorrect, or there is no user with such name' Clickhouse error on a FortiSIEM node.

Scope

FortiSIEM Supervisor Worker.

Solution

The following errors are observed while checking into the backend Phoenix logs as below.

tail -f /opt/phoenix/log/phoenix.log

phDataManager[47339]: [PH_DATAMANAGER_SUMMARYWRITER_ERROR]:[eventSeverity]=PHL_ERROR,[procName]=phDataManager,[fileName]=SummEventWriter.cpp,[lineNumber]=1001,[errorNo]=403,[errReason]=Uploading events to ClickHouse failed. respCode:403 resp:Code: 516. DB::Exception: default: Authentication failed: password is incorrect, or there is no user with such name.

phDataManager[47339]: If you have installed ClickHouse and forgot password you can reset it in the configuration file.
phDataManager[47339]: The password for default user is typically located at /etc/clickhouse-server/users.d/default-password.xml
phDataManager[47339]: and deleting this file will reset the password.
phDataManager[47339]: See also /etc/clickhouse-server/users.xml on the server where ClickHouse is installed.
phDataManager[47339]: . (AUTHENTICATION_FAILED) (version 23.8.16.40 (official build))

Follow the steps below to resolve this error:

Solution 1:

• Review all FortiSIEM nodes and check if they are part of the Clickhouse Cluster.

• If any node is not part of the Clickhouse cluster and is acting as an Event Worker, it needs to be a part of the Data node cluster.

• Add the appropriate node from Admin -> Settings -> Database -> Clickhouse config -> Test & Deploy.

Solution 2:

• Check if the proxy has been enabled in the environment.

echo $http_proxy

• Disable the proxy in the environment and check for the error again.

• If Proxy configuration has been created under /etc/profile.d/proxy.sh, the line for http_proxy can be commented out/removed, then enter the below command.
  
  

export http_proxy=""

• Check again using the command below if the proxy has been disabled.
  
  

echo $http_proxy