Troubleshooting Tip: High root disk usage on collector due to clickhouse service

[aebadi]

Description	This article provides the steps to free up space consumed by clickhouse service on the root partition of the FortiSIEM collector.
Scope	FortiSIEM Collector 6.5.0, 7.1.3 and 7.1.4.
Solution	Run the following command first to know if the disk usage is due to clickhouse directories (/var/lib/clickhouse and /var/log/clickhouse-server). du --max-depth=4 -xh / | sort -hr | head -n 20 Stop and disable clickhouse-server service: systemctl stop clickhouse-server.service systemctl disable clickhouse-server.service Remove clickhouse data: rm -rf /var/log/clickhouse-server/ rm -rf /var/lib/clickhouse/