ClickHouse

Question 1

What is the role of the Keeper Node?

Answer 1

handle coordination between ClickHouse nodes

Question 2

What is the Keeper Node used for?

Answer 2

• cluster membership (who is alive)
• replica management (sync between shards)
• distributed DDL commands (table creation across nodes)

Question 3

Which components in FortiSIEM have this role?

Answer 3

1. Supervisor node by default
2. can be expanded to additional nodes (manual config)

Question 4

What number of Keeper Nodes should be used for maintaining quorum?

Answer 4

odd number of nodes

Question 5

What happens using 2 Keeper nodes and 1Keeper node is lost?

Answer 5

quorum is lost - need to use specific steps to recover quorum

Question 6

What happens if using 1 Keepr node and that node is lost?

Answer 6

ClickHouse event database becomes read only and insertion stops

Question 7

How is the Keeper Node referred to in logs/configs?

Answer 7

zookeeper

Question 8

Which node always initiates the queries?

Answer 8

supervisor

Question 9

What is a query node?

Answer 9

node that handle user queries (reports, dashboards, investigations)

Question 10

Which FortiSIEM components assume the role of a Query node?

Answer 10

1. supervisor node (always)
2. workers (optional but recommended for load distribution)

Question 11

Which process is run by the Query node?

Answer 11

phQueryWorker