| Description | This article describes the table shown in read-only mode and how to resolve the issue if the worker shows a critical issue. |
| Scope | FortiSIEM. |
| Solution |
In the logs encountering errors like 'DB::Exception: Table is in read only mode since table metadata was not found in zookeeper' typically indicates issues related to table crashes in the database so this table can be restored.
These logs can be found in: 'tail -f /opt/phoenix/log/phoenix.log'.
Step 1: Using the 'clickhouse-client' command helps to select all the tables and the status:
clickhouse-client -q "select * from system.replicas"
v7.2.2 and later versions:
Step 2: If the tables seem in read-only mode, this can be repaired using the below format.
Example: TABLE_IS_READ_ONLY errors for 'fsiem.summary', 'fsiem.events_replicated' and 'fsiem.mv_t_events tables'.
Apply the below steps from Worker CLI for which node facing this issue. clickhouse-client -q "SYSTEM RESTORE REPLICA fsiem.events_replicated"
v7.2.2 and later versions:
clickhouse-client -q "SYSTEM RESTORE REPLICA fsiem.summary" clickhouse-client -q "SYSTEM RESTORE REPLICA fsiem.events_replicated" clickhouse-client -q "SYSTEM RESTORE REPLICA fsiem.mv_t_events"
Step 3: After applying restore recheck using the command given in STEP 1 if the table is fixed. This is how a table in read-only mode can be restored. |
