Apache Doris 4.x 生产环境部署实战：3节点高可用集群搭建指南

Apache Doris 作为一款统一的实时分析型数据仓库，凭借其高性能与易用性，已成为众多后端架构中的核心中间件。本文基于官方最佳实践，详细记录在3节点物理机环境下部署Doris 4.x高可用集群的完整流程，涵盖架构选型、环境调优、FE/BE配置及集群组网等关键步骤，助你快速搭建稳定、高效的数据库服务。

架构选型：为什么选择存算一体？

虽然Doris 3.0+引入了存算分离架构，但在本次3节点物理机+NAS的环境中，我们评估后决定采用经典的存算一体（Coupled）模式。决策依据如下：

• 基础设施适配性：存算分离强依赖高性能对象存储（S3/OSS）和FoundationDB，而当前NAS的IOPS性能无法支撑元数据频繁交互，强行部署反而会成为瓶颈。
• 小集群极致性能：在节点数<10的场景下，存算一体利用本地磁盘读取数据，规避了大量网络RPC开销，查询延迟通常更优。
• 平滑演进：Doris 4.x对存算一体持续优化，未来若基础设施升级，可通过 Backup/Restore 或 CCR 平滑迁移至存算分离架构。

集群规划与环境准备

本次部署基于Apache Doris 4.0.2版本，适用于4.x全系列。集群由3台物理机构成，每台节点同时部署FE和BE角色，实现高可用。服务器节点规划如下：

服务器 IP	主机名 (Hostname)	节点角色 (Roles)	硬件配置	关键端口规划
192.168.221.62		FE (Master)BE	CPU: 8 Core RAM: 32 GB Disk: 100G (/data)	FE: 8030/9030 BE: 8040/9050
192.168.221.63		FE (Follower)BE	CPU: 8 Core RAM: 32 GB Disk: 100G (/data)	同上
192.168.221.64		FE (Follower)BE	CPU: 8 Core RAM: 32 GB Disk: 100G (/data)	同上

在开始部署前，需完成以下环境准备工作：配置SSH免密互信、优化系统文件句柄数、关闭防火墙与SELinux、禁用Swap及透明大页、部署JDK、配置NTP时钟同步。这些步骤是数据库稳定运行的基础，务必逐一执行。

系统调优与基础环境配置

以下为关键调优步骤，确保Doris获得最佳运行环境：

• SSH免密互信：在所有节点上配置hosts映射，生成密钥并分发，实现主节点对三台机器的免密控制。
• 文件句柄优化：修改limits.conf和sysctl.conf，将最大文件句柄数设为65536，vm.max_map_count设为2000000。
• 关闭防火墙：执行

  ## 查看防火墙命令
  systemctl status firewalld
  ## 开启防火墙命令
  systemctl start firewalld
  ## 关闭防火墙命令
  systemctl stop firewalld
  ## 禁用防火墙命令
  systemctl disable firewalld
  ## 查看系统防火墙规则命令
  iptables -L
  ## 清空系统防火墙规则命令
  iptables -F

  关闭firewalld服务。
• 禁用SELinux：执行

  ## 查看SeLinux状态
  getenforce
  ## 临时关闭SeLinux
  setenforce 0
  ## 永久关闭SeLinux
  sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
  ## 重启生效

  临时禁用，并修改配置文件永久关闭。
• 禁用Swap：执行

  ## 查看Swappiness版本号
  swapon --version
  ## 【永久关闭】修改 fstab 防止重启复活
  sed -i '/swap/s/^/#/' /etc/fstab
  ## 【内核策略】告诉内核尽量别用
  echo "vm.swappiness = 0" >> /etc/sysctl.conf
  ##【立即关闭】先在当前系统里把它关了，如果不重启的情况下
  swapoff -a
  ## 立即生效
  sysctl -p

  关闭交换分区。
• 禁用透明大页：执行

  ## 立即禁用（当前运行期临时有效）
  echo never > /sys/kernel/mm/transparent_hugepage/enabled
  echo never > /sys/kernel/mm/transparent_hugepage/defrag
  ## 永久有效(写入开机持久化) 这里和图中不太一样,以这里为准;
  cat >> /etc/rc.d/rc.local <<'EOF'
  echo never > /sys/kernel/mm/transparent_hugepage/enabled
  echo never > /sys/kernel/mm/transparent_hugepage/defrag
  EOF
  ## 赋权
  chmod +x /etc/rc.d/rc.local

  禁用THP，避免内存抖动。
• 部署JDK：清理旧版本，解压安装JDK至统一目录，配置环境变量并验证。
• NTP时钟同步：确保所有节点时间一致，避免集群通信异常。

Doris 4.x HA集群部署

完成环境准备后，进入核心部署阶段。我们采用“程序与数据物理分离”的最佳实践：程序目录位于/data/doris402，数据目录统一指向/data/doris，确保未来升级时数据安全。

1. FE（Frontend）配置与启动

FE是集群的控制节点，负责元数据管理和查询协调。关键配置项包括：

• priority_networks：强制指定Doris使用哪个网段通信，避免绑定到虚拟网卡。例如，若机器IP为192.168.221.62，子网掩码为255.255.255.0，则配置为192.168.221.0/24。
• 元数据目录：设置为/data/doris/fe，与程序目录分离。

完整fe.conf配置如下：

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#####################################################################
## The uppercase properties are read and exported by bin/start_fe.sh.
## To see all Frontend configurations,
## see fe/src/org/apache/doris/common/Config.java
#####################################################################
CUR_DATE=`date +%Y%m%d-%H%M%S`
# Log dir 日志目录分离
LOG_DIR = /data/doris/fe_log
# For jdk 17, this JAVA_OPTS will be used as default JVM options
JAVA_OPTS_FOR_JDK_17="-Dfile.encoding=UTF-8 -Djavax.security.auth.useSubjectCredsOnly=false -Xmx8192m -Xms8192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=$
LOG_DIR -Xlog:gc*,classhisto*=trace:$LOG_DIR/fe.gc.log.$CUR_DATE:time,uptime:filecount=10,filesize=50M --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens java
.base/jdk.internal.ref=ALL-UNNAMED --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.xerces.internal.jaxp=ALL-UNNAMED"
# 指定JDK路径
JAVA_HOME=/usr/java/jdk-17.0.12
##
## the lowercase properties are read by main program.
##
# 元数据目录分离
meta_dir = /data/doris/doris_meta
# Default dirs to put jdbc drivers,default value is ${DORIS_HOME}/jdbc_drivers
# jdbc_drivers_dir = ${DORIS_HOME}/jdbc_drivers
http_port = 8030
rpc_port = 9020
query_port = 9030
edit_log_port = 9010
arrow_flight_sql_port = 8070
# Choose one if there are more than one ip except loopback address. 
# Note that there should at most one ip match this list.
# If no ip match this rule, will choose one randomly.
# use CIDR format, e.g. 10.10.10.0/24 or IP format, e.g. 10.10.10.1
# 强制绑定内网网段。
priority_networks = 192.168.221.0/24
# Advanced configurations 
# log_roll_size_mb = 1024
# INFO, WARN, ERROR, FATAL
sys_log_level = INFO
# NORMAL, BRIEF, ASYNC
sys_log_mode = ASYNC
# sys_log_roll_num = 10
# sys_log_verbose_modules = org.apache.doris
# 审计日志目录
audit_log_dir = /data/doris/fe_log
# audit_log_modules = slow_query, query
# audit_log_roll_num = 10
# meta_delay_toleration_second = 10
# qe_max_connection = 1024
# qe_query_timeout_second = 300
# qe_slow_log_ms = 5000
# 开启 SQL 审计
enable_sql_audit = true
# 放宽元数据心跳超时
bdbje_heartbeat_timeout_second = 60
# 设置远程片段执行超时
remote_fragment_exec_timeout_ms = 15000
# 提升最大连接数
qe_max_connection = 2048
# 表名大小写不敏感
lower_case_table_names = 1
# 提升 Kafka 导入并发。
max_routine_load_task_num_per_be = 10

启动Master节点后，安装MySQL客户端并登录，执行SQL注册Follower节点：

ALTER SYSTEM ADD FOLLOWER "192.168.221.63:9010";
ALTER SYSTEM ADD FOLLOWER "192.168.221.64:9010";

⚠️ 注册时必须填写节点真实IP，而非网段。然后分发程序包至Follower节点，首次启动需指定Helper参数：

## 节点2 bigdata-2 操作
[root@bigdata-2 doris402]# /data/doris402/fe/bin/start_fe.sh --helper 192.168.221.62:9010 --daemon
[root@bigdata-2 doris402]# jps
55050 Jps
54925 DorisFE
## 节点3 bigdata-3 操作
[root@bigdata-3 ~]# /data/doris402/fe/bin/start_fe.sh --helper 192.168.221.62:9010 --daemon
[root@bigdata-3 ~]# jps
53906 DorisFE
54034 Jps

通过SQL检查集群拓扑，确认所有FE节点心跳正常。

2. BE（Backend）配置与启动

BE是数据节点，负责数据存储和计算。关键配置项包括：

• storage_root_path：设置为/data/doris/be。
• priority_networks：与FE保持一致。

完整be.conf配置如下：

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
CUR_DATE=`date +%Y%m%d-%H%M%S`
# 日志目录分离
LOG_DIR = /data/doris/be_log
# 限制 BE 的 Java 堆内存
# For jdk 17, this JAVA_OPTS will be used as default JVM options
JAVA_OPTS_FOR_JDK_17="-Dfile.encoding=UTF-8 -Djol.skipHotspotSAAttach=true -Xmx2048m -DlogPath=$LOG_DIR/jni.log -Xlog:gc*:$LOG_DIR/be.gc.log.$CUR_DATE:time,uptime:filecount=10,filesize=50M -Djavax.security.auth.useSubjectCredsOnly=false -Dsun.security.krb5.debug=true -Dsun.java.command=DorisBE -XX:-Critical
JNINatives -XX:+IgnoreUnrecognizedVMOptions --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/sun.nio.cs=ALL-UNNAMED --add-opens=java.base/sun.security.action=ALL-
UNNAMED --add-opens=java.base/sun.util.calendar=ALL-UNNAMED --add-opens=java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-opens=java.management/sun.management=ALL-UNNAMED -Darrow.enable_null_check_for_get=false"
# 指定 JDK 路径
JAVA_HOME = /usr/java/jdk-17.0.12
# https://github.com/apache/doris/blob/master/docs/zh-CN/community/developer-guide/debug-tool.md#jemalloc-heap-profile
# https://jemalloc.net/jemalloc.3.html
JEMALLOC_CONF="percpu_arena:percpu,background_thread:true,metadata_thp:auto,muzzy_decay_ms:5000,dirty_decay_ms:5000,oversize_threshold:0,prof:true,prof_active:false,lg_prof_interval:-1,lg_extent_max_active_fit:8"
JEMALLOC_PROF_PRFIX="jemalloc_heap_profile_"
# ports for admin, web, heartbeat service 
# 业务管控端口
be_port = 9060
# 数据导入与监控端口。
webserver_port = 8040
# 心跳存活检测端口。
heartbeat_service_port = 9050
# 内部数据传输端口。
brpc_port = 8060
# 极速数据读取端口 (4.0 新特性)。
arrow_flight_sql_port = 8050
# HTTPS configures
enable_https = false
# path of certificate in PEM format.
ssl_certificate_path = "$DORIS_HOME/conf/cert.pem"
# path of private key in PEM format.
ssl_private_key_path = "$DORIS_HOME/conf/key.pem"
# Choose one if there are more than one ip except loopback address. 
# Note that there should at most one ip match this list.
# If no ip match this rule, will choose one randomly.
# use CIDR format, e.g. 10.10.10.0/24 or IP format, e.g. 10.10.10.1
# Default value is empty.
# 强制绑定内网网段
priority_networks = 192.168.221.0/24
# data root path, separate by ';'
# You can specify the storage type for each root path, HDD (cold data) or SSD (hot data)
# eg:
# 数据存储目录
storage_root_path = /data/doris/storage,medium:HDD
# storage_root_path = /home/disk1/doris,medium:SSD;/home/disk2/doris,medium:SSD;/home/disk2/doris,medium:HDD
# /home/disk2/doris,medium:HDD(default)
# 
# you also can specify the properties by setting '<property>:<value>', separate by ','
  # property 'medium' has a higher priority than the extension of path
  #
  # Default value is ${DORIS_HOME}/storage, you should create it by hand.
  # storage_root_path = ${DORIS_HOME}/storage
  # Default dirs to put jdbc drivers,default value is ${DORIS_HOME}/jdbc_drivers
  # 驱动目录分离
  jdbc_drivers_dir = /data/doris/jdbc_drivers
  # Advanced configurations
  # INFO, WARNING, ERROR, FATAL
  sys_log_level = INFO
  # sys_log_roll_mode = SIZE-MB-1024
  # sys_log_roll_num = 10
  # sys_log_verbose_modules = *
  # log_buffer_level = -1
  # aws sdk log level
  #    Off = 0,
  #    Fatal = 1,
  #    Error = 2,
  #    Warn = 3,
  #    Info = 4,
  #    Debug = 5,
  #    Trace = 6
  # Default to turn off aws sdk log, because aws sdk errors that need to be cared will be output through Doris logs
  aws_log_level = 2
  # azure sdk log level
  #    Verbose = 1,
  #    Informational = 2,
  #    Warning = 3,
  #    Error = 4
  azure_log_level = 4
  ## If you are not running in aws cloud, you can disable EC2 metadata
  AWS_EC2_METADATA_DISABLED=true
  # BE 进程总内存限制
  mem_limit = 80%
  # 开启垂直 Compaction
  enable_vertical_compaction = true
  # 开启 Segment Compaction 小文件合并
  enable_segcompaction = true
  # 提升 Kafka 导入并发
  routine_load_thread_pool_size = 10
  # 提升单次导入上限
  streaming_load_max_mb = 4096
  # 提升查询并行度
  fragment_pool_thread_num_max = 512
  fragment_pool_queue_size = 2048

分发配置文件至所有节点，启动BE服务后，通过SQL注册BE节点：

## 进入doris控制台
[root@bigdata-1 data]# mysql -h 127.0.0.1 -P 9030 -uroot
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.99 doris version doris-4.0.2-rc02-30d2df0459
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
## 向doris注册三台BE节点
mysql> ALTER SYSTEM ADD BACKEND "192.168.221.62:9050";
Query OK, 0 rows affected (0.01 sec)
mysql> ALTER SYSTEM ADD BACKEND "192.168.221.63:9050";
Query OK, 0 rows affected (0.01 sec)
mysql> ALTER SYSTEM ADD BACKEND "192.168.221.64:9050";
Query OK, 0 rows affected (0.01 sec)
mysql> SHOW PROC '/backends';

确认三台BE节点的Alive状态均为true，表示启动成功。

安全加固与验证

集群部署完成后，需进行安全加固：

• 修改默认密码：执行

  ## 修改 root 账户密码 (最高权限账户)
  SET PASSWORD FOR 'root' = PASSWORD('123456');
  ## 修改 admin 账户密码 (通常用于通过 WebUI 访问)
  SET PASSWORD FOR 'admin' = PASSWORD('123456');

  修改root密码。
• 验证登录：使用新密码连接数据库，确认权限正常。

最后，执行全链路验证，包括创建表、导入数据、执行查询，确保集群功能完整。

[AFFILIATE_SLOT_1]

性能调优与监控建议

生产环境中，建议启用以下优化：

• 开启向量化引擎：在fe.conf中设置enable_vectorized_engine=true，提升分析性能。
• 调整内存参数：根据物理内存大小，合理设置BE的mem_limit（建议为总内存的60%-80%）。
• 配置监控：集成Prometheus+Grafana，实时监控集群健康状态。

此外，Doris 4.x支持AI向量分析能力，可在后端架构中集成向量检索功能，拓展应用场景。

[AFFILIATE_SLOT_2]

总结

本文从架构选型、环境调优到FE/BE部署，完整记录了Apache Doris 4.x在3节点物理机上的生产级部署流程。通过存算一体架构与程序数据分离策略，实现了高可用、易维护的数据库集群。无论是作为中间件支撑实时分析，还是作为微服务生态的数据底座，Doris都能提供卓越性能。希望本指南能帮助你在后端架构中快速落地Doris，释放数据价值。

bigdata-1bigdata-2bigdata-3