ClickHouse - OpenSRE Documentation

Overview

OpenSRE queries ClickHouse system tables to surface query activity and system health — helping diagnose database performance issues during alert investigations. Uses the HTTP client (clickhouse_connect). All operations are read-only with result caps.

Prerequisites

ClickHouse 21.x or later
Network access from the OpenSRE environment to your ClickHouse instance
A user with read access to system tables

Setup

There is no dedicated opensre integrations setup clickhouse wizard today. Configure via environment variables or the persistent store, then verify.

Option 1: Environment variables

CLICKHOUSE_HOST=your-clickhouse-host
CLICKHOUSE_PORT=8123
CLICKHOUSE_DATABASE=default
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=your-password
CLICKHOUSE_SECURE=false   # set to true for HTTPS

Variable	Default	Description
`CLICKHOUSE_HOST`	—	Required. ClickHouse hostname or IP
`CLICKHOUSE_PORT`	`8123`	HTTP(S) port (8123 for HTTP, 8443 for HTTPS)
`CLICKHOUSE_DATABASE`	`default`	Default database
`CLICKHOUSE_USER`	`default`	Username
`CLICKHOUSE_PASSWORD`	—	Password
`CLICKHOUSE_SECURE`	`false`	Use HTTPS (`true`/`false`)

Option 2: Persistent store

{
  "version": 1,
  "integrations": [
    {
      "id": "clickhouse-prod",
      "service": "clickhouse",
      "status": "active",
      "credentials": {
        "host": "your-clickhouse-host",
        "port": 8443,
        "database": "default",
        "username": "opensre_readonly",
        "password": "your-password",
        "secure": true
      }
    }
  ]
}

Credentials

Creating a read-only user

CREATE USER opensre_readonly IDENTIFIED BY 'secure-password';
GRANT SELECT ON system.* TO opensre_readonly;
GRANT SELECT ON default.* TO opensre_readonly;

Investigation tools

Tool	What it does
`get_clickhouse_system_health`	Metrics for connections, queries, replica status, uptime
`get_clickhouse_query_activity`	Recent slow / failed queries from `system.query_log`

Tools require connection_verified after a successful verify.

Verify

opensre integrations verify clickhouse

Expected output:

Service: clickhouse
Status: passed
Detail: Connected to ClickHouse 23.8.1; database: default

Troubleshooting

Symptom	Fix
Connection refused	Check host, port, and firewall. Use port `8443` with `CLICKHOUSE_SECURE=true`
Authentication failed	Verify username and password
SSL error	Set `CLICKHOUSE_SECURE=true` and use port `8443`
Access denied on system tables	Grant `SELECT ON system.*` to the OpenSRE user

Security

Create a dedicated read-only user with access only to system.* and the databases OpenSRE needs.
Use HTTPS (CLICKHOUSE_SECURE=true) in production.
Store credentials in .env or your secret manager — not in source control.

​Overview

​Prerequisites

​Setup

​Option 1: Environment variables

​Option 2: Persistent store

​Credentials

​Creating a read-only user

​Investigation tools

​Verify

​Troubleshooting

​Security