Troubleshooting Tip: Resolving ClickHouse Error “Too many parts. Merges are processing significantly slower than inserts”
| Description | This error happens when ClickHouse creates too many small data parts in a table. The background merge process cannot keep up, causing performance issues. As a result, queries or data ingestion may fail with the error:
|
| Scope | FortiSIEM environments that use ClickHouse as the backend database. |
| Solution | This error typically happens in any of the following conditions:
Initial Investigation:
Check ClickHouse logs for the TOO_MANY_PARTS error:
grep -i "TOO_MANY_PARTS" /var/log/clickhouse-server/clickhouse-server.log ClickHouse failed. respCode:500 resp:Code: 252. DB::Exception: Too many parts (3001 with average size of 282.52 KiB) in table 'fsiem.events_replicated (75dbec0-3f31-4405-b818-63161137fcac)'. Merges are processing significantly slower than inserts. (TOO_MANY_PARTS) (version 23.8.16.40 (official build))
Root Cause:
ClickHouse uses the MergeTree engine, which writes each insert as a small part on disk. Background threads merge these parts into larger files. If inserts arrive faster than merges complete, the table grows thousands of tiny parts, triggering the TOO_MANY_PARTS exception.
The current max part setup on each click house node is set to 5 located here:
cat /etc/clickhouse-server/config.xml | grep -i max_suspicious_broken_parts This means ClickHouse will tolerate up to 5 broken parts before halting. Broken parts may result from disk issues, unclean shutdowns, or corrupted merges.
Recommended Fix:
Set this parameter to '0' to avoid processing any corrupted data parts.
cp /etc/clickhouse-server/config.xml /etc/clickhouse-server/config.xml_Back
vi /etc/clickhouse-server/config.xml
Summary:
This issue stems from ClickHouse being overwhelmed by too many small parts and not merging them fast enough. The fix involves:
ClickHouse refuses to process any broken part. The benefit is:
As a result, changing the value to '0' does not directly make merges faster — it ensures that merges are not blocked or delayed by bad parts hiding in the system. |