<!--

NOTE: User and query level settings are set up in "users.xml" file.

If you have accidentally specified user-level settings here, server won't start.

You can either move the settings to the right place inside "users.xml" file

or add <skip_check_for_incorrect_settings>1</skip_check_for_incorrect_settings> here.

-->

<clickhouse>

<logger>

<!-- Possible levels [1]:

- none (turns off logging)

- fatal

- critical

- error

- warning

- notice

- information

- debug

- trace

- test (not for production usage)

[1]: https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/Logger.h#L105-L114

-->

<level>trace</level>

<!-- Startup level is used to set the root logger level at server startup.

It is useful for debugging startup issues.

The root logger level will be reset to the default level after the server is fully initialized -->

<!-- <startup_level>trace</startup_level> -->

<!-- Shutdown level is used to set the root logger level at server Shutdown.

It is useful for debugging shutdown issues -->

<!-- <shutdown_level>trace</shutdown_level> -->

<!-- Startup console level is used to set the console logger level at server startup.

It is useful for debugging startup issues.

The console logger level will be reset to the default level after the server is fully initialized -->

<!-- <startup_console_log_level>trace</startup_console_log_level> -->

<!-- Shutdown console log level is used to set the console logger level at server Shutdown.

It is useful for debugging shutdown issues -->

<!-- <shutdown_console_log_level>trace</shutdown_console_log_level> -->

<log>/var/log/clickhouse-server/clickhouse-server.log</log>

<errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>

<!-- Rotation policy

See https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/FileChannel.h#L54-L85

-->

<size>1000M</size>

<count>10</count>

<!-- <console>1</console> --> <!-- Default behavior is autodetection (log to console if not daemon mode and is tty) -->

<!-- <console_log_level>trace</console_log_level> -->

<!-- <use_syslog>0</use_syslog> -->

<!-- <syslog_level>trace</syslog_level> -->

<!-- <stream_compress>0</stream_compress> -->

<!-- By default logging happens in different threads so it does not block the execution

If the amount of messages waiting to be flushed is too large, new messages will be dropped.

-->

<!-- <async>1</async> -->

<!-- <async_queue_max_size>100000</async_queue_max_size> -->

<!-- Per level overrides (legacy):

For example to suppress logging of the ConfigReloader you can use:

NOTE: levels.logger is reserved, see below.

-->

<!--

<levels>

<ConfigReloader>none</ConfigReloader>

</levels>

-->

<!-- Per level overrides:

For example to suppress logging of the RBAC for default user you can use:

(But please note that the logger name maybe changed from version to version, even after minor upgrade)

-->

<!--

<levels>

<logger>

<name>ContextAccess (default)</name>

<level>none</level>

</logger>

<logger>

<name>DatabaseOrdinary (test)</name>

<level>none</level>

</logger>

</levels>

-->

<!-- Structured log formatting:

You can specify log format(for now, JSON only).

It can be done either on a per-channel (log, errorlog, console, syslog) level (set `channel`, i.e. `<channel>console</channel>') or for all channels (omit `channel`).

The log will be printed in specified format like JSON, example:

{"date_time":"1650918987.180175","thread_name":"#1","thread_id":"254545","level":"Trace","query_id":"","logger_name":"BaseDaemon","message":"Received signal 2","source_file":"../base/daemon/BaseDaemon.cpp; virtual void SignalListener::run()","source_line":"192"}

{"date_time_utc":"2024-11-06T09:06:09Z","thread_name":"#1","thread_id":"254545","level":"Trace","query_id":"","logger_name":"BaseDaemon","message":"Received signal 2","source_file":"../base/daemon/BaseDaemon.cpp; virtual void SignalListener::run()","source_line":"192"}

To enable JSON logging support, please uncomment the entire <formatting> tag below.

a) You can modify key names by changing values under tag values inside <names> tag.

For example, to change DATE_TIME to MY_DATE_TIME, you can do like:

<date_time>MY_DATE_TIME</date_time>

<date_time_utc>MY_UTC_DATE_TIME</date_time_utc>

b) You can stop unwanted log properties from appearing in logs. To do so, you can simply comment out (recommended)

that property from this file.

For example, if you do not want your log to print query_id, you can comment out only <query_id> tag.

However, if you comment out all the tags under <names>, the program will print default values for as

below.

-->

<!--

<formatting>

<type>json</type>

<channel></channel>

<names>

<date_time>date_time</date_time>

<date_time_utc>date_time_utc</date_time_utc>

<thread_name>thread_name</thread_name>

<thread_id>thread_id</thread_id>

<level>level</level>

<query_id>query_id</query_id>

<logger_name>logger_name</logger_name>

<message>message</message>

<source_file>source_file</source_file>

<source_line>source_line</source_line>

</names>

</formatting>

-->

</logger>

<url_scheme_mappers>

<s3>

<to>https://{bucket}.s3.amazonaws.com</to>

</s3>

<gs>

<to>https://storage.googleapis.com/{bucket}</to>

</gs>

<oss>

<to>https://{bucket}.oss.aliyuncs.com</to>

</oss>

</url_scheme_mappers>

<!-- Add headers to response in options request. OPTIONS method is used in CORS preflight requests. -->

<http_options_response>

<header>

<name>Access-Control-Allow-Origin</name>

<value>*</value>

</header>

<header>

<name>Access-Control-Allow-Headers</name>

<value>origin, x-requested-with, x-clickhouse-format, x-clickhouse-user, x-clickhouse-key, Authorization</value>

</header>

<header>

<name>Access-Control-Allow-Methods</name>

<value>POST, GET, OPTIONS</value>

</header>

<header>

<name>Access-Control-Max-Age</name>

<value>86400</value>

</header>

</http_options_response>

<!-- The name that will be shown in the clickhouse-client.

By default, anything with "production" will be highlighted in red in query prompt.

-->

<!--display_name>production</display_name-->

<!-- Port for HTTP API. See also 'https_port' for secure connections.

This interface is also used by ODBC and JDBC drivers (DataGrip, Dbeaver, ...)

and by most of the web interfaces (embedded UI, Grafana, Redash, ...).

-->

<http_port>8123</http_port>

<!-- Port for interaction by native protocol with:

- clickhouse-client and other native ClickHouse tools (clickhouse-benchmark);

- clickhouse-server with other clickhouse-servers for distributed query processing;

- ClickHouse drivers and applications supporting native protocol

(this protocol is also informally called as "the TCP protocol");

See also 'tcp_port_secure' for secure connections.

-->

<tcp_port>9000</tcp_port>

<!-- Chunked capabilities for native protocol by server.

Can be enabled separately for send and receive channels.

Supported modes:

- chunked - server requires from client to have chunked enabled;

- chunked_optional - server supports both chunked and notchunked protocol;

- notchunked - server requires from client notchunked protocol (current default);

- notchunked_optional - server supports both chunked and notchunked protocol.

-->

<!--

<proto_caps>

<send>notchunked_optional</send>

<recv>notchunked_optional</recv>

</proto_caps>

-->

<!-- Compatibility with MySQL protocol.

ClickHouse will pretend to be MySQL for applications connecting to this port.

-->

<mysql_port>9004</mysql_port>

<!-- Compatibility with PostgreSQL protocol.

ClickHouse will pretend to be PostgreSQL for applications connecting to this port.

-->

<postgresql_port>9005</postgresql_port>

<!-- HTTP API with TLS (HTTPS).

You have to configure certificate to enable this interface.

See the OpenSSL section below.

-->

<!-- <https_port>8443</https_port> -->

<!-- Native interface with TLS.

You have to configure certificate to enable this interface.

See the OpenSSL section below.

-->

<!-- <tcp_port_secure>9440</tcp_port_secure> -->

<!-- Native interface wrapped with PROXYv1 protocol

PROXYv1 header is sent for every connection.

ClickHouse will extract information about proxy-forwarded client address from the header.

-->

<!-- <tcp_with_proxy_port>9011</tcp_with_proxy_port> -->

<!-- Port for communication between replicas. Used for data exchange.

It provides low-level data access between servers.

This port should not be accessible from untrusted networks.

See also 'interserver_http_credentials'.

Data transferred over connections to this port should not go through untrusted networks.

See also 'interserver_https_port'.

-->

<interserver_http_port>9009</interserver_http_port>

<!-- Port for communication between replicas with TLS.

You have to configure certificate to enable this interface.

See the OpenSSL section below.

See also 'interserver_http_credentials'.

-->

<!-- <interserver_https_port>9010</interserver_https_port> -->

<!-- Hostname that is used by other replicas to request this server.

If not specified, then it is determined analogous to 'hostname -f' command.

This setting could be used to switch replication to another network interface

(the server may be connected to multiple networks via multiple addresses)

-->

<!--

<interserver_http_host>example.clickhouse.com</interserver_http_host>

-->

<!-- Port for the SSH server which allows to connect and execute

queries in an interactive fashion using the embedded client over the PTY.

-->

<!-- <tcp_ssh_port>9022</tcp_ssh_port> -->

<ssh_server>

<!-- The public part of the host key will be written to the known_hosts file

on the SSH client side on the first connect.

-->

<!-- <host_rsa_key>path_to_the_ssh_key</host_rsa_key> -->

<!-- <host_ecdsa_key>path_to_the_ssh_key</host_ecdsa_key> -->

<!-- <host_ed25519_key>path_to_the_ssh_key</host_ed25519_key> -->

<!-- Unlocks the possibility to pass the client options as environment

variables in the form of: ssh -o SetEnv="key1=value1 key2=value2".

This is considered unsafe and should be used with caution.

-->

<!-- <enable_client_options_passing>false</enable_client_options_passing>-->

</ssh_server>

<!-- You can specify credentials for authentication between replicas.

This is required when interserver_https_port is accessible from untrusted networks,

and also recommended to avoid SSRF attacks from possibly compromised services in your network.

-->

<!--<interserver_http_credentials>

<user>interserver</user>

<password></password>

</interserver_http_credentials>-->

<!-- Listen specified address.

Use :: (wildcard IPv6 address), if you want to accept connections both with IPv4 and IPv6 from everywhere.

Notes:

If you open connections from wildcard address, make sure that at least one of the following measures is applied:

- server is protected by firewall and not accessible from untrusted networks;

- all users are restricted to subset of network addresses (see users.xml);

- all users have strong passwords, only secure (TLS) interfaces are accessible, or connections are only made via TLS interfaces.

- users without password have readonly access.

See also: https://www.shodan.io/search?query=clickhouse

-->

<!-- <listen_host>::</listen_host> -->

<!-- Same for hosts without support for IPv6: -->

<!-- <listen_host>0.0.0.0</listen_host> -->

<!-- Default values - try listen localhost on IPv4 and IPv6. -->

<!--

<listen_host>::1</listen_host>

<listen_host>127.0.0.1</listen_host>

-->

<!-- <interserver_listen_host>::</interserver_listen_host> -->

<!-- Listen host for communication between replicas. Used for data exchange -->

<!-- Default values - equal to listen_host -->

<!-- Don't exit if IPv6 or IPv4 networks are unavailable while trying to listen. -->

<!-- <listen_try>0</listen_try> -->

<!-- Allow multiple servers to listen on the same address:port. This is not recommended.

-->

<!-- <listen_reuse_port>0</listen_reuse_port> -->

<!-- <listen_backlog>4096</listen_backlog> -->

<!-- <max_connections>4096</max_connections> -->

<!-- For 'Connection: keep-alive' in HTTP 1.1 -->

<keep_alive_timeout>10</keep_alive_timeout>

<!-- Enable verbose output in /replicas_status handler. -->

<!-- <enable_verbose_replicas_status/>true<enable_verbose_replicas_status>-->

<!-- Enable stacktrace in default http handler. -->

<!-- <enable_http_stacktrace/>true<enable_http_stacktrace>-->

<!-- gRPC protocol (see src/Server/grpc_protos/clickhouse_grpc.proto for the API) -->

<!-- <grpc_port>9100</grpc_port> -->

<grpc>

<enable_ssl>false</enable_ssl>

<!-- The following two files are used only if enable_ssl=1 -->

<ssl_cert_file>/path/to/ssl_cert_file</ssl_cert_file>

<ssl_key_file>/path/to/ssl_key_file</ssl_key_file>

<!-- Whether server will request client for a certificate -->

<ssl_require_client_auth>false</ssl_require_client_auth>

<!-- The following file is used only if ssl_require_client_auth=1 -->

<ssl_ca_cert_file>/path/to/ssl_ca_cert_file</ssl_ca_cert_file>

<!-- Default transport compression type (can be overridden by client, see the transport_compression_type field in QueryInfo).

Supported algorithms: none, deflate, gzip, stream_gzip -->

<transport_compression_type>none</transport_compression_type>

<!-- Default transport compression level. Supported levels: 0..3 -->

<transport_compression_level>0</transport_compression_level>

<!-- Send/receive message size limits in bytes. -1 means unlimited -->

<max_send_message_size>-1</max_send_message_size>

<max_receive_message_size>-1</max_receive_message_size>

<!-- Enable if you want very detailed logs -->

<verbose_logs>false</verbose_logs>

</grpc>

<!-- Used with https_port and tcp_port_secure. Full ssl options list: https://github.com/ClickHouse-Extras/poco/blob/master/NetSSL_OpenSSL/include/Poco/Net/SSLManager.h#L71

Note: ClickHouse Cloud https://clickhouse.com/cloud always has secure connections configured.

-->

<openSSL>

<server> <!-- Used for https server AND secure tcp port -->

<!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt -->

<!-- <certificateFile>/etc/clickhouse-server/server.crt</certificateFile>

<privateKeyFile>/etc/clickhouse-server/server.key</privateKeyFile> -->

<!-- dhparams are optional. You can delete the <dhParamsFile> element.

To generate dhparams, use the following command:

openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096

Only file format with BEGIN DH PARAMETERS is supported.

-->

<!-- <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile>-->

<verificationMode>none</verificationMode>

<loadDefaultCAFile>true</loadDefaultCAFile>

<cacheSessions>true</cacheSessions>

<disableProtocols>sslv2,sslv3</disableProtocols>

<preferServerCiphers>true</preferServerCiphers>

<invalidCertificateHandler>

<!-- The server, in contrast to the client, cannot ask about the certificate interactively.

The only reasonable option is to reject.

-->

<name>RejectCertificateHandler</name>

</invalidCertificateHandler>

</server>

<client> <!-- Used for connecting to https dictionary source and secured Zookeeper communication -->

<loadDefaultCAFile>true</loadDefaultCAFile>

<cacheSessions>true</cacheSessions>

<disableProtocols>sslv2,sslv3</disableProtocols>

<preferServerCiphers>true</preferServerCiphers>

<!-- Use for self-signed: <verificationMode>none</verificationMode> -->

<invalidCertificateHandler>

<!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->

<name>RejectCertificateHandler</name>

</invalidCertificateHandler>

</client>

</openSSL>

<!-- Let's Encrypt certificate provider configuration -->

<!--

<acme>

<email>[email protected]</email>

<terms_of_service_agreed>true</terms_of_service_agreed>

<domains>

<domain>example.com</domain>

</domains>

</acme>

-->

<!-- Default root page on http[s] server. -->

<!--

<http_server_default_response><![CDATA[Greetings from ClickHouse!]]></http_server_default_response>

-->

<!-- The maximum number of query processing threads, excluding threads for retrieving data from remote servers, allowed to run all queries.

This is not a hard limit. In case if the limit is reached the query will still get at least one thread to run.

Query can upscale to desired number of threads during execution if more threads become available.

-->

<concurrent_threads_soft_limit_num>0</concurrent_threads_soft_limit_num>

<concurrent_threads_soft_limit_ratio_to_cores>2</concurrent_threads_soft_limit_ratio_to_cores>

<concurrent_threads_scheduler>max_min_fair</concurrent_threads_scheduler>

<!-- Maximum number of concurrent queries. -->

<max_concurrent_queries>1000</max_concurrent_queries>

<!-- Maximum memory usage (resident set size) for server process.

Zero value or unset means default. Default is "max_server_memory_usage_to_ram_ratio" of available physical RAM.

If the value is larger than "max_server_memory_usage_to_ram_ratio" of available physical RAM, it will be cut down.

The constraint is checked on query execution time.

If a query tries to allocate memory and the current memory usage plus allocation is greater

than specified threshold, exception will be thrown.

It is not practical to set this constraint to small values like just a few gigabytes,

because memory allocator will keep this amount of memory in caches and the server will deny service of queries.

-->

<max_server_memory_usage>0</max_server_memory_usage>

<!-- Maximum number of threads in the Global thread pool.

This will default to a maximum of 10000 threads if not specified.

This setting will be useful in scenarios where there are a large number

of distributed queries that are running concurrently but are idling most

of the time, in which case a higher number of threads might be required.

-->

<max_thread_pool_size>10000</max_thread_pool_size>

<!-- Configure other thread pools: -->

<!--

<background_buffer_flush_schedule_pool_size>16</background_buffer_flush_schedule_pool_size>

<background_pool_size>16</background_pool_size>

<background_merges_mutations_concurrency_ratio>2</background_merges_mutations_concurrency_ratio>

<background_merges_mutations_scheduling_policy>round_robin</background_merges_mutations_scheduling_policy>

<background_move_pool_size>8</background_move_pool_size>

<background_fetches_pool_size>8</background_fetches_pool_size>

<background_common_pool_size>8</background_common_pool_size>

<background_schedule_pool_size>128</background_schedule_pool_size>

<background_message_broker_schedule_pool_size>16</background_message_broker_schedule_pool_size>

<background_distributed_schedule_pool_size>16</background_distributed_schedule_pool_size>

<tables_loader_foreground_pool_size>0</tables_loader_foreground_pool_size>

<tables_loader_background_pool_size>0</tables_loader_background_pool_size>

-->

<!-- Enables asynchronous loading of databases and tables to speedup server startup.

Queries to not yet loaded entity will be blocked until load is finished.

-->

<async_load_databases>true</async_load_databases>

<!-- On memory constrained environments you may have to set this to value larger than 1.

-->

<max_server_memory_usage_to_ram_ratio>0.9</max_server_memory_usage_to_ram_ratio>

<!-- Simple server-wide memory profiler. Collect a stack trace at every peak allocation step (in bytes).

Data will be stored in system.trace_log table with query_id = empty string.

Zero means disabled.

-->

<total_memory_profiler_step>4194304</total_memory_profiler_step>

<!-- Collect random allocations and deallocations and write them into system.trace_log with 'MemorySample' trace_type.

The probability is for every alloc/free regardless to the size of the allocation.

Note that sampling happens only when the amount of untracked memory exceeds the untracked memory limit,

which is 4 MiB by default but can be lowered if 'total_memory_profiler_step' is lowered.

You may want to set 'total_memory_profiler_step' to 1 for extra fine grained sampling.

-->

<total_memory_tracker_sample_probability>0</total_memory_tracker_sample_probability>

<!-- Set limit on number of open files (default: maximum). This setting makes sense on Mac OS X because getrlimit() fails to retrieve

correct maximum value. -->

<!-- <max_open_files>262144</max_open_files> -->

<!-- Size of cache of uncompressed blocks of data, used in tables of MergeTree family.

In bytes. Cache is single for server. Memory is allocated only on demand.

Cache is used when 'use_uncompressed_cache' user setting turned on (off by default).

Uncompressed cache is advantageous only for very short queries and in rare cases.

Note: uncompressed cache can be pointless for lz4, because memory bandwidth

is slower than multi-core decompression on some server configurations.

Enabling it can sometimes paradoxically make queries slower.

-->

<uncompressed_cache_size>8589934592</uncompressed_cache_size>

<!-- Approximate size of mark cache, used in tables of MergeTree family.

In bytes. Cache is single for server. Memory is allocated only on demand.

You should not lower this value. -->

<!-- <mark_cache_size>5368709120</mark_cache_size> -->

<!-- For marks of secondary indices. -->

<!-- <index_mark_cache_size>5368709120</index_mark_cache_size> -->

<!-- If you enable the `min_bytes_to_use_mmap_io` setting,

the data in MergeTree tables can be read with mmap to avoid copying from kernel to userspace.

It makes sense only for large files and helps only if data reside in page cache.

To avoid frequent open/mmap/munmap/close calls (which are very expensive due to consequent page faults)

and to reuse mappings from several threads and queries,

the cache of mapped files is maintained. Its size is the number of mapped regions (usually equal to the number of mapped files).

The amount of data in mapped files can be monitored

in system.metrics, system.metric_log by the MMappedFiles, MMappedFileBytes metrics

and in system.asynchronous_metrics, system.asynchronous_metrics_log by the MMapCacheCells metric,

and also in system.events, system.processes, system.query_log, system.query_thread_log, system.query_views_log by the

CreatedReadBufferMMap, CreatedReadBufferMMapFailed, MMappedFileCacheHits, MMappedFileCacheMisses events.

Note that the amount of data in mapped files does not consume memory directly and is not accounted

in query or server memory usage - because this memory can be discarded similar to OS page cache.

The cache is dropped (the files are closed) automatically on removal of old parts in MergeTree,

also it can be dropped manually by the SYSTEM DROP MMAP CACHE query.

-->

<!-- <mmap_cache_size>1024</mmap_cache_size> -->

<!-- Cache size in bytes for compiled expressions.-->

<!-- <compiled_expression_cache_size>134217728</compiled_expression_cache_size> -->

<!-- Cache size in elements for compiled expressions.-->

<!-- <compiled_expression_cache_elements_size>10000</compiled_expression_cache_elements_size> -->

<!-- Size of the query condition cache in bytes. -->

<query_condition_cache_size>106700800</query_condition_cache_size>

<!-- Configuration for the query cache -->

<!--

<query_cache>

<max_size_in_bytes>1073741824</max_size_in_bytes>

<max_entries>1024</max_entries>

<max_entry_size_in_bytes>1048576</max_entry_size_in_bytes>

<max_entry_size_in_rows>30000000</max_entry_size_in_rows>

</query_cache>

-->

<!-- Cache path for custom (created from SQL) cached disks -->

<custom_cached_disks_base_directory>/var/lib/clickhouse/caches/</custom_cached_disks_base_directory>

<validate_tcp_client_information>false</validate_tcp_client_information>

<!-- Path to data directory, with trailing slash. -->

<path>/var/lib/clickhouse/</path>

<!-- Multi-disk configuration example: -->

<!--

<storage_configuration>

<disks>

<default>

<keep_free_space_bytes>0</keep_free_space_bytes>

</default>

<data>

<path>/data/</path>

<keep_free_space_bytes>0</keep_free_space_bytes>

</data>

<s3>

<type>s3</type>

<endpoint>http://path/to/endpoint</endpoint>

<access_key_id>your_access_key_id</access_key_id>

<secret_access_key>your_secret_access_key</secret_access_key>

</s3>

<blob_storage_disk>

<type>azure_blob_storage</type>

<storage_account_url>http://account.blob.core.windows.net</storage_account_url>

<container_name>container</container_name>

<account_name>account</account_name>

<account_key>pass123</account_key>

<metadata_path>/var/lib/clickhouse/disks/blob_storage_disk/</metadata_path>

<skip_access_check>false</skip_access_check>

</blob_storage_disk>

</disks>

<policies>

<all>

<volumes>

<main>

<disk>default</disk>

<disk>data</disk>

<disk>s3</disk>

<disk>blob_storage_disk</disk>

<max_data_part_size_bytes></max_data_part_size_bytes>

<max_data_part_size_ratio></max_data_part_size_ratio>

<perform_ttl_move_on_insert>true</perform_ttl_move_on_insert>

<load_balancing>round_robin</load_balancing>

</main>

</volumes>

<move_factor>0.2</move_factor>

</all>

</policies>

</storage_configuration>

-->

<!-- Default database disk storing metadata files: -->

<!--

<database_disk>

<disk>default</disk>

</database_disk>

-->

<!-- Path to temporary data for processing heavy queries. -->

<!-- NOTE: all files with `tmp` prefix will be removed at server startup -->

<tmp_path>/var/lib/clickhouse/tmp/</tmp_path>

<!-- Enable AuthType plaintext_password and no_password for ACL (1 = allow, 0 = forbid). -->

<allow_plaintext_password>1</allow_plaintext_password>

<allow_no_password>1</allow_no_password>

<allow_implicit_no_password>1</allow_implicit_no_password>

<!-- When a user does not specify a password type in the CREATE USER query, the default password type is used.

Accepted values are: 'plaintext_password', 'sha256_password', 'double_sha1_password', 'bcrypt_password'.

-->

<default_password_type>sha256_password</default_password_type>

<!-- Work factor for bcrypt_password authentication type -->

<bcrypt_workfactor>12</bcrypt_workfactor>

<!-- Complexity requirements for user passwords.

Note: ClickHouse Cloud https://clickhouse.com/cloud is always configured for strong passwords.

-->

<!-- <password_complexity>

<rule>

<pattern>.{12}</pattern>

<message>be at least 12 characters long</message>

</rule>

<rule>

<pattern>\p{N}</pattern>

<message>contain at least 1 numeric character</message>

</rule>

<rule>

<pattern>\p{Ll}</pattern>

<message>contain at least 1 lowercase character</message>

</rule>

<rule>

<pattern>\p{Lu}</pattern>

<message>contain at least 1 uppercase character</message>

</rule>

<rule>

<pattern>[^\p{L}\p{N}]</pattern>

<message>contain at least 1 special character</message>

</rule>

</password_complexity> -->

<!-- Policy from the <storage_configuration> for the temporary files.

If not set <tmp_path> is used, otherwise <tmp_path> is ignored.

Notes:

- move_factor is ignored

- keep_free_space_bytes is ignored

- max_data_part_size_bytes is ignored

- you must have exactly one volume in that policy

NOTE: all files with `tmp` prefix will be removed at server startup

-->

<!-- <tmp_policy>tmp</tmp_policy> -->

<!-- Directory with user provided files that are accessible by 'file' table function. -->

<user_files_path>/var/lib/clickhouse/user_files/</user_files_path>

<!-- LDAP server definitions. -->

<ldap_servers>

<!-- List LDAP servers with their connection parameters here to later 1) use them as authenticators for dedicated local users,

who have 'ldap' authentication mechanism specified instead of 'password', or to 2) use them as remote user directories.

Parameters:

host - LDAP server hostname or IP, this parameter is mandatory and cannot be empty.

port - LDAP server port, default is 636 if enable_tls is set to true, 389 otherwise.

bind_dn - template used to construct the DN to bind to.

The resulting DN will be constructed by replacing all '{user_name}' substrings of the template with the actual

user name during each authentication attempt.

user_dn_detection - section with LDAP search parameters for detecting the actual user DN of the bound user.

This is mainly used in search filters for further role mapping when the server is Active Directory. The

resulting user DN will be used when replacing '{user_dn}' substrings wherever they are allowed. By default,

user DN is set equal to bind DN, but once search is performed, it will be updated with to the actual detected

user DN value.

base_dn - template used to construct the base DN for the LDAP search.

The resulting DN will be constructed by replacing all '{user_name}' and '{bind_dn}' substrings

of the template with the actual user name and bind DN during the LDAP search.

scope - scope of the LDAP search.

Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).

search_filter - template used to construct the search filter for the LDAP search.

The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', and '{base_dn}'

substrings of the template with the actual user name, bind DN, and base DN during the LDAP search.

Note, that the special characters must be escaped properly in XML.

verification_cooldown - a period of time, in seconds, after a successful bind attempt, during which a user will be assumed

to be successfully authenticated for all consecutive requests without contacting the LDAP server.

Specify 0 (the default) to disable caching and force contacting the LDAP server for each authentication request.

enable_tls - flag to trigger use of secure connection to the LDAP server.

Specify 'no' for plain text (ldap://) protocol (not recommended).

Specify 'yes' for LDAP over SSL/TLS (ldaps://) protocol (recommended, the default).

Specify 'starttls' for legacy StartTLS protocol (plain text (ldap://) protocol, upgraded to TLS).

tls_minimum_protocol_version - the minimum protocol version of SSL/TLS.

Accepted values are: 'ssl2', 'ssl3', 'tls1.0', 'tls1.1', 'tls1.2' (the default).

tls_require_cert - SSL/TLS peer certificate verification behavior.

Accepted values are: 'never', 'allow', 'try', 'demand' (the default).

tls_cert_file - path to certificate file.

tls_key_file - path to certificate key file.

tls_ca_cert_file - path to CA certificate file.

tls_ca_cert_dir - path to the directory containing CA certificates.

tls_cipher_suite - allowed cipher suite (in OpenSSL notation).

Example:

<my_ldap_server>

<host>localhost</host>

<port>636</port>

<bind_dn>uid={user_name},ou=users,dc=example,dc=com</bind_dn>

<verification_cooldown>300</verification_cooldown>

<enable_tls>yes</enable_tls>

<tls_minimum_protocol_version>tls1.2</tls_minimum_protocol_version>

<tls_require_cert>demand</tls_require_cert>

<tls_cert_file>/path/to/tls_cert_file</tls_cert_file>

<tls_key_file>/path/to/tls_key_file</tls_key_file>

<tls_ca_cert_file>/path/to/tls_ca_cert_file</tls_ca_cert_file>

<tls_ca_cert_dir>/path/to/tls_ca_cert_dir</tls_ca_cert_dir>

<tls_cipher_suite>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384</tls_cipher_suite>

</my_ldap_server>

Example (typical Active Directory with configured user DN detection for further role mapping):

<my_ad_server>

<host>localhost</host>

<port>389</port>

<bind_dn>EXAMPLE\{user_name}</bind_dn>

<user_dn_detection>

<base_dn>CN=Users,DC=example,DC=com</base_dn>

<search_filter>(&amp;(objectClass=user)(sAMAccountName={user_name}))</search_filter>

</user_dn_detection>

<enable_tls>no</enable_tls>

</my_ad_server>

-->

</ldap_servers>

<!-- To enable Kerberos authentication support for HTTP requests (GSS-SPNEGO), for those users who are explicitly configured

to authenticate via Kerberos, define a single 'kerberos' section here.

Parameters:

principal - canonical service principal name, that will be acquired and used when accepting security contexts.

This parameter is optional, if omitted, the default principal will be used.

This parameter cannot be specified together with 'realm' parameter.

realm - a realm, that will be used to restrict authentication to only those requests whose initiator's realm matches it.

This parameter is optional, if omitted, no additional filtering by realm will be applied.

This parameter cannot be specified together with 'principal' parameter.

Example:

<kerberos />

Example:

<kerberos>

<principal>HTTP/[email protected]</principal>

</kerberos>

Example:

<kerberos>

<realm>EXAMPLE.COM</realm>

</kerberos>

-->

<!-- Sources to read users, roles, access rights, profiles of settings, quotas. -->

<user_directories>

<users_xml>

<!-- Path to configuration file with predefined users. -->

<path>users.xml</path>

</users_xml>

<local_directory>

<!-- Path to folder where users created by SQL commands are stored. -->

<path>/var/lib/clickhouse/access/</path>

</local_directory>

<!-- To add an LDAP server as a remote user directory of users that are not defined locally, define a single 'ldap' section

with the following parameters:

server - one of LDAP server names defined in 'ldap_servers' config section above.

This parameter is mandatory and cannot be empty.

roles - section with a list of locally defined roles that will be assigned to each user retrieved from the LDAP server.

If no roles are specified here or assigned during role mapping (below), user will not be able to perform any

actions after authentication.

role_mapping - section with LDAP search parameters and mapping rules.

When a user authenticates, while still bound to LDAP, an LDAP search is performed using search_filter and the

name of the logged in user. For each entry found during that search, the value of the specified attribute is

extracted. For each attribute value that has the specified prefix, the prefix is removed, and the rest of the

value becomes the name of a local role defined in ClickHouse, which is expected to be created beforehand by

CREATE ROLE command.

There can be multiple 'role_mapping' sections defined inside the same 'ldap' section. All of them will be

applied.

base_dn - template used to construct the base DN for the LDAP search.

The resulting DN will be constructed by replacing all '{user_name}', '{bind_dn}', and '{user_dn}'

substrings of the template with the actual user name, bind DN, and user DN during each LDAP search.

scope - scope of the LDAP search.

Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).

search_filter - template used to construct the search filter for the LDAP search.

The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', '{user_dn}', and

'{base_dn}' substrings of the template with the actual user name, bind DN, user DN, and base DN during

each LDAP search.

Note, that the special characters must be escaped properly in XML.

attribute - attribute name whose values will be returned by the LDAP search. 'cn', by default.

prefix - prefix, that will be expected to be in front of each string in the original list of strings returned by

the LDAP search. Prefix will be removed from the original strings and resulting strings will be treated

as local role names. Empty, by default.

Example:

<ldap>

<server>my_ldap_server</server>

<roles>

<my_local_role1 />

<my_local_role2 />

</roles>

<role_mapping>

<base_dn>ou=groups,dc=example,dc=com</base_dn>

<scope>subtree</scope>

<search_filter>(&amp;(objectClass=groupOfNames)(member={bind_dn}))</search_filter>

<attribute>cn</attribute>

<prefix>clickhouse_</prefix>

</role_mapping>

</ldap>

Example (typical Active Directory with role mapping that relies on the detected user DN):

<ldap>

<server>my_ad_server</server>

<role_mapping>

<base_dn>CN=Users,DC=example,DC=com</base_dn>

<attribute>CN</attribute>

<scope>subtree</scope>

<search_filter>(&amp;(objectClass=group)(member={user_dn}))</search_filter>

<prefix>clickhouse_</prefix>

</role_mapping>

</ldap>

-->

</user_directories>

<access_control_improvements>

<!-- Whether reading from a table should throw an exception if the table has row policies,

but none of them are for the current user.

By default this setting is false. -->

<throw_on_unmatched_row_policies>false</throw_on_unmatched_row_policies>

<!-- Enables logic that users without permissive row policies can still read rows using a SELECT query.

For example, if there two users A, B and a row policy is defined only for A, then

if this setting is true the user B will see all rows, and if this setting is false the user B will see no rows.

By default this setting is true. -->

<users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>

<!-- By default, for backward compatibility ON CLUSTER queries ignore CLUSTER grant,

however you can change this behaviour by setting this to true -->

<on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>

<!-- By default, for backward compatibility "SELECT * FROM system.<table>" doesn't require any grants and can be executed

by any user. You can change this behaviour by setting this to true.

If it's set to true then this query requires "GRANT SELECT ON system.<table>" just like as for non-system tables.

Exceptions: a few system tables ("tables", "columns", "databases", and some constant tables like "one", "contributors")

are still accessible for everyone; and if there is a SHOW privilege (e.g. "SHOW USERS") granted the corresponding system

table (i.e. "system.users") will be accessible. -->

<select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>

<!-- By default, for backward compatibility "SELECT * FROM information_schema.<table>" doesn't require any grants and can be

executed by any user. You can change this behaviour by setting this to true.

If it's set to true then this query requires "GRANT SELECT ON information_schema.<table>" just like as for ordinary tables. -->

<select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>

<!-- By default, for backward compatibility a settings profile constraint for a specific setting inherit every not set field from

previous profile. You can change this behaviour by setting this to true.

If it's set to true then if settings profile has a constraint for a specific setting, then this constraint completely cancels all

actions of previous constraint (defined in other profiles) for the same specific setting, including fields that are not set by new constraint.

It also enables 'changeable_in_readonly' constraint type -->

<settings_constraints_replace_previous>true</settings_constraints_replace_previous>

<!-- Enable/disable the IMPERSONATE feature (EXECUTE AS target_user). -->

<allow_impersonate_user>true</allow_impersonate_user>

<!-- By default, for backward compatibility creating table with a specific table engine ignores grant,

however you can change this behaviour by setting this to true -->

<table_engines_require_grant>false</table_engines_require_grant>

<!-- Number of seconds since last access a role is stored in the Role Cache -->

<role_cache_expiration_time_seconds>600</role_cache_expiration_time_seconds>

</access_control_improvements>

<!-- Default profile of settings. -->

<default_profile>default</default_profile>

<!-- Comma-separated list of prefixes for user-defined settings.

The server will allow to set these settings, and retrieve them with the getSetting function.

They are also logged in the query_log, similarly to other settings, but have no special effect.

The "SQL_" prefix is introduced for compatibility with MySQL - these settings are being set by Tableau.

-->

<custom_settings_prefixes>SQL_</custom_settings_prefixes>

<!-- System profile of settings. This settings are used by internal processes (Distributed DDL worker and so on). -->

<!-- <system_profile>default</system_profile> -->

<!-- Background profile of settings. This profile is used by background operations (e.g. Merge, Mutate).

Default profile name is 'background', which can be changed via the following setting. If such profile is not configured, system_profile is used.

-->

<!-- <background_profile>background</background_profile> -->

<!-- Buffer profile of settings.

This settings are used by Buffer storage to flush data to the underlying table.

Default: used from system_profile directive.

-->

<!-- <buffer_profile>default</buffer_profile> -->

<!-- Default database. -->

<default_database>default</default_database>

<!-- Server time zone could be set here.

Time zone is used when converting between String and DateTime types,

when printing DateTime in text formats and parsing DateTime from text,

it is used in date and time related functions, if specific time zone was not passed as an argument.

Time zone is specified as identifier from IANA time zone database, like UTC or Africa/Abidjan.

If not specified, system time zone at server startup is used.

Please note, that server could display time zone alias instead of specified name.

Example: Zulu is an alias for UTC.

-->

<!-- <timezone>UTC</timezone> -->

<!-- You can specify umask here (see "man umask"). Server will apply it on startup.

Number is always parsed as octal. Default umask is 027 (other users cannot read logs, data files, etc; group can only read).

-->

<!-- <umask>022</umask> -->

<!-- Perform mlockall after startup to lower first queries latency

and to prevent clickhouse executable from being paged out under high IO load.

Enabling this option is recommended but will lead to increased startup time for up to a few seconds.

-->

<mlock_executable>true</mlock_executable>

<!-- But skip it if the memory is low -->

<mlock_executable_min_total_memory_amount_bytes>5000000000</mlock_executable_min_total_memory_amount_bytes>

<!-- Reallocate memory for machine code ("text") using huge pages. Highly experimental. -->

<remap_executable>false</remap_executable>

<![CDATA[

Uncomment below in order to use JDBC table engine and function.

To install and run JDBC bridge in background:

* [Debian/Ubuntu]

export MVN_URL=https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc-bridge/

export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')

wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge_$PKG_VER-1_all.deb

apt install --no-install-recommends -f ./clickhouse-jdbc-bridge_$PKG_VER-1_all.deb

clickhouse-jdbc-bridge &

* [CentOS/RHEL]

export MVN_URL=https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc-bridge/

export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')

wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm

yum localinstall -y clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm

clickhouse-jdbc-bridge &

Please refer to https://github.com/ClickHouse/clickhouse-jdbc-bridge#usage for more information.

]]>

<!--

<jdbc_bridge>

<host>127.0.0.1</host>

<port>9019</port>

</jdbc_bridge>

-->

<!-- Configuration of clusters that could be used in Distributed tables.

https://clickhouse.com/docs/en/operations/table_engines/distributed/

Note: ClickHouse Cloud https://clickhouse.com/cloud has the cluster preconfigured and dynamically scalable.

-->

<remote_servers>

<!-- Test only shard config for testing distributed storage -->

<default>

<!-- Inter-server per-cluster secret for Distributed queries

default: no secret (no authentication will be performed)

If set, then Distributed queries will be validated on shards, so at least:

- such cluster should exist on the shard,

- such cluster should have the same secret.

And also (and which is more important), the initial_user will

be used as current user for the query.

Right now the protocol is pretty simple, and it only takes into account:

- cluster name

- query

Also, it will be nice if the following will be implemented:

- source hostname (see interserver_http_host), but then it will depend on DNS,

it can use IP address instead, but then you need to get correct on the initiator node.

- target hostname / ip address (same notes as for source hostname)

- time-based security tokens

-->

<!-- <secret></secret> -->

<shard>

<!-- Optional. Whether to write data to just one of the replicas. Default: false (write data to all replicas). -->

<!-- <internal_replication>false</internal_replication> -->

<!-- Optional. Shard weight when writing data. Default: 1. -->

<!-- <weight>1</weight> -->

<replica>

<host>localhost</host>

<port>9000</port>

<!-- Optional. Priority of the replica for load_balancing. Default: 1 (less value has more priority). -->

<!-- <priority>1</priority> -->

<!-- Use SSL? Default: no -->