> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> Shows the open client connections of the native TCP and HTTP query interfaces. A connection is `active` when a query runs. A connection is `idle` when it waits for the next query.

# system.connections

## Description

Shows the open client connections of the native TCP and HTTP query interfaces.
A connection is `active` when a query runs. A connection is `idle` when it waits for the next query.

The table does not show these connections:

* Connections of other protocols, for example MySQL, PostgreSQL, and gRPC.
* Interserver connections.
* HTTP connections that did not run a query, for example `/ping` and Prometheus connections.

The server collects the connections only if the server setting `collect_connection_metrics` is `true`. If the setting is `false`, the table is empty.
You can change the setting without a restart (`SYSTEM RELOAD CONFIG`):

* When you change the setting to `false`, the table becomes empty and the server stops the registration of new connections.
* When you change the setting to `true`, an open connection shows in the table on its next query.

The server adds a TCP connection to the table after authentication. The server removes the connection when it closes.
The server adds an HTTP connection to the table on its first query. The server removes the connection when the socket closes.
Thus, the table shows an HTTP keep-alive connection as `idle` between the requests.

A user without the `SHOW CONNECTIONS` privilege sees only the connections of this user.
The check uses the user ID, not the name. Thus, a renamed user keeps its connections, and a new user with the old name does not get them.

`connection_id` is a random UUID. Thus, it is unique across servers, and you can combine the tables of many replicas, for example with `clusterAllReplicas`.

`connected_time` has the same meaning for TCP and HTTP: the time when the server started to handle the socket.
This time is before the TCP handshake, the authentication, and the first query. Thus, it can be earlier than the time when the connection shows in the table.

## Columns

* `connection_id` ([UUID](/docs/reference/data-types/uuid)) — Unique identifier of the connection: a random UUID. It is unique across servers, for example in `clusterAllReplicas`. A TCP connection gets the identifier after authentication. An HTTP connection gets the identifier on its first query.
* `protocol` ([LowCardinality(String)](/docs/reference/data-types/lowcardinality)) — Protocol of the connection: TCP (native protocol) or HTTP.
* `client_address` ([IPv6](/docs/reference/data-types/ipv6)) — IP address of the client. Behind a proxy, this is the address of the client if the server trusts the PROXY protocol or the `X-Forwarded-For` header. For HTTP, this is the address of the last request.
* `client_port` ([UInt16](/docs/reference/data-types/int-uint)) — TCP port of the client. Behind a proxy, this is the port from the PROXY protocol or the `X-Forwarded-For` header if the server trusts them. For HTTP, this is the port of the last request.
* `server_port` ([UInt16](/docs/reference/data-types/int-uint)) — Server port that accepted the connection.
* `user` ([String](/docs/reference/data-types/string)) — Name of the authenticated user. For an HTTP connection, this is the user of the last request. Each request on a keep-alive connection has its own authentication. If the user is renamed, this column shows the old name until the next authentication. The access check uses the user ID, not the name.
* `status` ([LowCardinality(String)](/docs/reference/data-types/lowcardinality)) — Status of the connection. `active`: a query runs now. `idle`: the connection is open and waits for the next query or the next HTTP request.
* `query_id` ([String](/docs/reference/data-types/string)) — Identifier of the query that runs now. Empty if the connection is idle.
* `client_name` ([String](/docs/reference/data-types/string)) — Name of the client application. A TCP client sends this name in the handshake. For HTTP, this is the `User-Agent` header of the last request.
* `client_version_major` ([UInt64](/docs/reference/data-types/int-uint)) — Major version of the client from the TCP handshake. 0 for HTTP connections.
* `client_version_minor` ([UInt64](/docs/reference/data-types/int-uint)) — Minor version of the client from the TCP handshake. 0 for HTTP connections.
* `client_version_patch` ([UInt64](/docs/reference/data-types/int-uint)) — Patch version of the client from the TCP handshake. 0 for HTTP connections.
* `connected_time` ([DateTime](/docs/reference/data-types/datetime)) — Time when the server started to handle the socket. This time is the same for TCP and HTTP: before the handshake, the authentication, and the first query.
* `last_query_time` ([Nullable(DateTime)](/docs/reference/data-types/nullable)) — Start time of the last query on this connection. NULL if the connection did not run a query.

## Examples

```sql theme={null}
SELECT connection_id, protocol, user, status, query_id, client_name, connected_time, last_query_time
FROM system.connections
FORMAT Vertical;
```

```sql theme={null}
SELECT hostName(), protocol, status, count()
FROM clusterAllReplicas(default, system.connections)
GROUP BY ALL;
```

```response theme={null}
Row 1:
──────
connection_id:   0d6c1b7e-31a2-4f5c-9a43-7e2b8c5d1f90
protocol:        TCP
user:            default
status:          active
query_id:        845dcadd-7249-4ce4-8c3d-c08032594155
client_name:     ClickHouse client
connected_time:  2026-03-17 09:18:18
last_query_time: 2026-03-17 09:18:27

Row 2:
──────
connection_id:   a4f3e2d1-8b7c-4c6d-9e5f-1a2b3c4d5e6f
protocol:        HTTP
user:            default
status:          idle
query_id:
client_name:     curl/8.5.0
connected_time:  2026-03-17 09:18:14
last_query_time: 2026-03-17 09:18:14
```