3

We have a corporate monitoring system based in Zabbix. Its MySQL monitoring is quite basic, so I want to add more info. To do so, I've done a script that retrieves this info from MySQL and sends it to Zabbix.

Among the retrieved info, I want to get current connections, but I've only managed to do so with the root user. I've created a zabbix user with SELECT and PROCESS permissions* and tried mysqladmin -u zabbix processlist, but I get Access denied; you need the PROCESS privilege for this operation. 

show grants for 'zabbix'@'%';
+----------------------------------------------+
| Grants for zabbix@%                          |
+----------------------------------------------+
| GRANT SELECT, PROCESS ON *.* TO 'zabbix'@'%' |
+----------------------------------------------+
SELECT USER(), CURRENT_USER();
+----------------+----------------+
| USER()         | CURRENT_USER() |
+----------------+----------------+
| root@localhost | root@localhost |
+----------------+----------------+

How can I get zabbix user to retrieve processlist?

* Yes, I've flushed permissions

Juanma
  • 53
  • 1
  • 6
  • Would you please edit and add: the particular query you're trying to run; also, the output of SELECT USER(), CURRENT_USER() – Shlomi Noach Feb 05 '13 at 11:33

1 Answers1

2

Perhaps you can create a DB user whose sole purpose in life is to collect the processlist.

Your error message indicates that zabbix does not have the PROCESS privilege.

Without the PROCESS privilege, zabbix can only view the processlist of zabbix users. Not much fun, eh?

But WAIT, you said

mysqladmin -u zabbix processlist

That will attempt to connect as zabbix@localhost which you did not define. Please note:

  • zabbix@localhost will authenticate via the socket file
  • zabbix@'%' will authenticate via TCP/IP

Simply run

GRANT SELECT, PROCESS ON *.* TO 'zabbix'@'localhost';

and your troubles should be over.

Without adding another MySQL user, just specify the TCP/IP protocol

mysqladmin -u zabbix --protocol=tcp processlist
RolandoMySQLDBA
  • 182,700
  • 33
  • 317
  • 520
  • so, maybe this is a stupid question but... doesn't 'zabbix'@'%' include 'zabbix'@'localhost'? – Juanma Feb 05 '13 at 15:21
  • 1
    They are not the same. Using localhost will authenticate a DB Connection via socket file. Using % implies that TCP/IP must be used. See my post http://dba.stackexchange.com/a/17110/877 for a detailed explanation on user authentication. I also updated my answer to address authenticating with TCP/IP. – RolandoMySQLDBA Feb 05 '13 at 15:45
  • 1
    Saying GRANT SELECT, PROCESS ON *.* you give zabbix permission to read from any database and table (*.*), don't you? – AntonioK Dec 11 '15 at 13:45