FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
koolishami
Staff
Staff
Article Id 412558
Description This article describes the troubleshooting steps to resolve a phQueryMaster process down issue in v7.3x+, where the logs indicate a failure to retrieve the jsonConfig from Redis during a ClickHouse.
Scope FortiSIEM v7.3x and later, with ClickHouse database.
Solution

When phQueryMaster fails to initialize, the following errors in /opt/phoenix/log/phoenix.log may be encountered even after attempting to restart the process with phtools --start phQueryMaster:


2025-09-10T12:50:48.360368+07:00 mfusiem phQueryMaster[209086]: [PH_CLICKHOUSE_QUERY_REDIS_GET_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phQueryMaster,[fileName]=phQueryMaster.cpp,[lineNumber]=390,[queryId]=,[phLogDetail]=Failed to get/hget jsonConfig from redis
2025-09-10T12:50:48.360382+07:00 mfusiem phQueryMaster[209086]: [PH_MODULE_INIT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phQueryMaster,[fileName]=phQueryMaster.cpp,[lineNumber]=796,[module]=phQueryMaster,[phLogDetail]=Module initialization failure

 

Follow the steps below to resolve the issue:

 

Verify Redis keys: On the Supervisor CLI, connect to Redis and check if the following keys return (nil) values:

 

redis-cli -p 6666 -a `phLicenseTool --showRedisPassword`
> get cache:ClickHouse:clickhouseConfig
> get cache:phDataManager:ingestionNodes
> get cache:phDataManager:ingestionNodesOnline
> get cache:phQueryMaster:queryNodesOnline
> get cache:phQueryMaster:queryNodes

 

If these keys are missing (showing as (nil)), proceed with the service restarts below.

 

Restart Redis service:

 

/opt/phoenix/redis/bin/redis_ops.sh stop
# Wait 2 minutes
/opt/phoenix/redis/bin/redis_ops.sh start

 

Restart phClickHouseMonitor service:

 

systemctl stop phClickHouseMonitor
# Wait 2 minutes
systemctl start phClickHouseMonitor

 

Test and deploy ClickHouse settings from the GUI:

  • Navigate to Settings -> Database -> ClickHouse Config.
  • Select Test and wait for the Test Successful message.
  • Select Deploy and wait for the Save successful message.

 

Restart the phQueryMaster process:


phtools --STOP phQueryMaster
# Wait a couple of minutes
phtools --START phQueryMaster

 

After completing these steps, the phQueryMaster process should remain up and running.

Contributors