ClickHouse Configuration
This section covers how to configure a ClickHouse topology of Keeper and Data/Query nodes.
Before beginning, make sure that:
- You have gone through ClickHouse Operation Overview and the ClickHouse Sizing Guide, located in the FortiSIEM Documentation Library.
- You have identified the FortiSIEM nodes that are going to be ClickHouse Keeper nodes and ClickHouse Data nodes.
- You have configured appropriate disks on the FortiSIEM nodes appropriate for their role.
Take the following steps.
- Navigate to ADMIN > Settings > Database > ClickHouse Config.
- Configure ClickHouse Keeper Cluster.
- Click on + and add a Worker.
- Click on - to remove a Worker.
- An operation for a ClickHouse Keeper Cluster node, such as adding or removing a node, MUST be done individually, meaning that after an operation is done, a test and deploy action must be performed. For example, if you add a ClickHouse Keeper Cluster node, you must then perform a test and deploy before doing any other operation for another ClickHouse Keeper Cluster node, such as adding another ClickHouse Keeper Cluster node, or removing a ClickHouse Keeper Cluster node. Do NOT perform more than one operation, such as adding or removing a ClickHouse Keeper Cluster node without testing and deploying it, as doing so may cause stability issues.
- Configure ClickHouse Server Cluster. You need to know the number of shards.
- Click on + and add a shard.
- Add Workers to the shard.
- Check Data if this Worker is a ClickHouse Data Node. A Data node receives events, processes them and writes to ClickHouse database.
- Check Query if this Worker is a ClickHouse Query Node. A Query node stores events replicated from data nodes and participates in Queries. However, it does not process events and triggers incidents.
- Check both Data and Query if this Worker is both a ClickHouse Data and Query Node. This is the most common setup.
- Once the shards have been created and workers have been added to the shard, then click Test.
- If Test succeeds, then click Deploy to push the changes to ClickHouse.
Notes:
- If you made changes to the ClickHouse Keeper Cluster, then after Deploy succeeds,
phClickHouseMonitor
,ClickHouseKeeper
andClickHouseServer
processes will restart. - If you made changes to the ClickHouse Cluster, then after Deploy succeeds,
phClickHouseMonitor
, andClickHouseServer
processes will restart.
For Advanced Configuration Operations, see Advanced Operations in the Appendix.