Server Settings

<!-- Settings from this profile will be used to execute DDL queries -->
    <profile>default</profile>

    <!-- Controls how much ON CLUSTER queries can be run simultaneously. -->
    <pool_size>1</pool_size>

    <!--
         Cleanup settings (active tasks will not be removed)
    -->

    <!-- Controls task TTL (default 1 week) -->
    <task_max_lifetime>604800</task_max_lifetime>

    <!-- Controls how often cleanup should be performed (in seconds) -->
    <cleanup_delay_period>60</cleanup_delay_period>

    <!-- Controls how many tasks could be in the queue -->
    <max_tasks_in_queue>1000</max_tasks_in_queue>
</distributed_ddl>
```

## distributed\_ddl.cleanup\_delay\_period[​](#distributed_ddl.cleanup_delay_period "Direct link to distributed_ddl.cleanup_delay_period")

cleaning starts after new node event is received if the last cleaning wasn't made sooner than `<cleanup_delay_period>` seconds ago.

## distributed\_ddl.max\_tasks\_in\_queue[​](#distributed_ddl.max_tasks_in_queue "Direct link to distributed_ddl.max_tasks_in_queue")

the maximum number of tasks that can be in the queue.

## distributed\_ddl.path[​](#distributed_ddl.path "Direct link to distributed_ddl.path")

the path in Keeper for the `<task_queue>` for DDL queries

## distributed\_ddl.pool\_size[​](#distributed_ddl.pool_size "Direct link to distributed_ddl.pool_size")

how many `<ON CLUSTER>` queries can be run simultaneously

## distributed\_ddl.profile[​](#distributed_ddl.profile "Direct link to distributed_ddl.profile")

the profile used to execute the DDL queries

## distributed\_ddl.replicas\_path[​](#distributed_ddl.replicas_path "Direct link to distributed_ddl.replicas_path")

the path in Keeper for the `<task_queue>` for replicas

## distributed\_ddl.task\_max\_lifetime[​](#distributed_ddl.task_max_lifetime "Direct link to distributed_ddl.task_max_lifetime")

delete node if its age is greater than this value.

## distributed\_ddl\_use\_initial\_user\_and\_roles[​](#distributed_ddl_use_initial_user_and_roles "Direct link to distributed_ddl_use_initial_user_and_roles")

If enabled, ON CLUSTER queries will preserve and use the initiator's user and roles for execution on remote shards. This ensures consistent access control across the cluster but requires that the user and roles exist on all nodes.

## dns\_allow\_resolve\_names\_to\_ipv4[​](#dns_allow_resolve_names_to_ipv4 "Direct link to dns_allow_resolve_names_to_ipv4")

Allows resolve names to ipv4 addresses.

## dns\_allow\_resolve\_names\_to\_ipv6[​](#dns_allow_resolve_names_to_ipv6 "Direct link to dns_allow_resolve_names_to_ipv6")

Allows resolve names to ipv6 addresses.

## dns\_cache\_max\_entries[​](#dns_cache_max_entries "Direct link to dns_cache_max_entries")

Internal DNS cache max entries.

## dns\_cache\_update\_period[​](#dns_cache_update_period "Direct link to dns_cache_update_period")

Internal DNS cache update period in seconds.

## dns\_max\_consecutive\_failures[​](#dns_max_consecutive_failures "Direct link to dns_max_consecutive_failures")

Stop further attempts to update a hostname's DNS cache after this number of consecutive failures. The information still remains in the DNS cache. Zero means unlimited.

**See also**

- [`SYSTEM DROP DNS CACHE`](/docs/sql-reference/statements/system#drop-dns-cache)

## drop\_distributed\_cache\_pool\_size[​](#drop_distributed_cache_pool_size "Direct link to drop_distributed_cache_pool_size")

The size of the threadpool used for dropping distributed cache.

## drop\_distributed\_cache\_queue\_size[​](#drop_distributed_cache_queue_size "Direct link to drop_distributed_cache_queue_size")

The queue size of the threadpool used for dropping distributed cache.

## enable\_azure\_sdk\_logging[​](#enable_azure_sdk_logging "Direct link to enable_azure_sdk_logging")

Enables logging from Azure sdk

## encryption[​](#encryption "Direct link to encryption")

Configures a command to obtain a key to be used by [encryption codecs](/docs/sql-reference/statements/create/table#encryption-codecs). Key (or keys) should be written in environment variables or set in the configuration file.

Keys can be hex or string with a length equal to 16 bytes.

**Example**

Loading from config:

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <key>1234567812345678</key>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Note

Storing keys in the configuration file is not recommended. It isn't secure. You can move the keys into a separate config file on a secure disk and put a symlink to that config file to `config.d/` folder.

Loading from config, when the key is in hex:

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <key_hex>00112233445566778899aabbccddeeff</key_hex>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Loading key from the environment variable:

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <key_hex from_env="ENVVAR"></key_hex>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Here `current_key_id` sets the current key for encryption, and all specified keys can be used for decryption.

Each of these methods can be applied for multiple keys:

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <key_hex id="0">00112233445566778899aabbccddeeff</key_hex>
        <key_hex id="1" from_env="ENVVAR"></key_hex>
        <current_key_id>1</current_key_id>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Here `current_key_id` shows current key for encryption.

Also, users can add nonce that must be 12 bytes long (by default encryption and decryption processes use nonce that consists of zero bytes):

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <nonce>012345678910</nonce>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Or it can be set in hex:

```
<encryption_codecs>
    <aes_128_gcm_siv>
        <nonce_hex>abcdefabcdef</nonce_hex>
    </aes_128_gcm_siv>
</encryption_codecs>
```

Note

Everything mentioned above can be applied for `aes_256_gcm_siv` (but the key must be 32 bytes long).

## enforce\_keeper\_component\_tracking[​](#enforce_keeper_component_tracking "Direct link to enforce_keeper_component_tracking")

If enabled, every ZooKeeper request must have a component name set via `Coordination::setCurrentComponent`. Throws a `LOGICAL_ERROR` exception if the component is missing.

## error\_log[​](#error_log "Direct link to error_log")

It is disabled by default.

**Enabling**

To manually turn on error history collection [`system.error_log`](/docs/operations/system-tables/system-error-log), create `/etc/clickhouse-server/config.d/error_log.xml` with the following content:

```
<clickhouse>
    <error_log>
        <database>system</database>
        <table>error_log</table>
        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
        <max_size_rows>1048576</max_size_rows>
        <reserved_size_rows>8192</reserved_size_rows>
        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
        <flush_on_crash>false</flush_on_crash>
    </error_log>
</clickhouse>
```

**Disabling**

To disable `error_log` setting, you should create the following file `/etc/clickhouse-server/config.d/disable_error_log.xml` with the following content:

```
<clickhouse>
    <error_log remove="1" />
</clickhouse>
```

The following settings can be configured by sub-tags: