FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
kdave
Staff
Staff
Article Id 420332
Description This article describes how to resolve 'No Results Found' errors on Dashboards and 'No Report Results found' errors on Analytics for HA Cluster nodes.
Scope FortiSIEM.
Solution

While deploying a 3 Supervisor Cluster in HA on the v7.4.2 release, the following errors were observed on Dashboard and Analytics frequently.

Dashboard shows 'No results found' and Analytics queries show 'No Report results found'.

 

Dashboard shows No Results FoundDashboard shows No Results Found

 

Analytics queries return No Report Results FoundAnalytics queries return No Report Results Found 

The following errors were observed while checking in backend Phoenix logs of the Leader Supervisor Node.

 

2025-11-04T13:14:18.043877+01:00 Super1 phMonitorSupervisor[1492492]: [PH_CLICKHOUSE_NOT_REACHABLE]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phMonitorProcess.cpp,[lineNumber]=11813,[phLogDetail]=Failed to reach ClickHouse : HTTP Post Failed. CURLcode: 7

 

Relevant Debug logs:

 

2025-11-04T12:42:35.365241+01:00 Super1 phMonitorSupervisor[1492492]: [PH_GENERIC_DEBUG]:[eventSeverity]=PHL_DEBUG,[procName]=phMonitorSupervisor,[fileName]=phHttpClient.cpp,[lineNumber]=2818,[phLogDetail]=Failed to post to http://Super2:8123/, result: 7, will retry

2025-11-04T12:42:35.366175+01:00 Super1 phMonitorSupervisor[1492492]: [PH_GENERIC_DEBUG]:[eventSeverity]=PHL_DEBUG,[procName]=phMonitorSupervisor,[fileName]=phHttpClient.cpp,[lineNumber]=2818,[phLogDetail]=Failed to post to http://Super3:8123/, result: 7, will retry

2025-11-04T13:15:11.321360+01:00 Super1 phQueryMaster[358236]: [PH_QUERY_CLICKHOUSE_EXEC_FAILED]:[eventSeverity]=PHL_ERROR,[procName]=phQueryMaster,[fileName]=ClickHouseSearcher.cpp,[lineNumber]=198,[queryId]=12471,[phLogDetail]=Failed to query from ClickHouse. Resp: Code: 279. DB::NetException: All connection tries failed. Log:
2025-11-04T13:15:11.321372+01:00 Super1 phQueryMaster[358236]: There is no table `fsiem`.`query_result` on server: Super2:9000
2025-11-04T13:15:11.321374+01:00 Super1 phQueryMaster[358236]: : While executing Remote. (ALL_CONNECTION_TRIES_FAILED) (version 23.8.16.40 (official build))

 

The steps below need to be performed to troubleshoot this issue further:

  • Check on HA nodes, phClickHouseMonitor, and ClickHouseServer processes not found in phstatus.
  • Check using df -h, verify if /data-clickhouse-hot-1 has been mounted.
  • Log into HA (Super2, Super3) nodes GUI and add Clickhouse disk from Admin -> Setup -> Storage -> Online.
  • Test & Save the disks on both HA nodes.
  • Check by running queries again from Analytics, Dashboard, and reports.
  • All the queries should return results.

 

Related document:

Configuring Supervisor/Worker Cluster for HA - DB Inside