Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way in MySQL 5.5 (on Redhat 6.x) to log the IP address from where a particular query has been run? And have that appear in the general log or even relay and bin logs? I am trying to track down the offending app server.

I googled around, and checked documentation but most of the discussion surrounded using IP Addresses as data in tables.

share|improve this question
up vote 4 down vote accepted

If you have shell access to the server on which mysql is running, you can use tcpdump + pt-query-digest. First, do a tcpdump with the appropriate switches necessary for pt-query-digest: tcpdump -i [your interface] port [3306,etc] -s 65535 -x -nn -q -tttt > tcpdump.out

Then, after you are done with your packet capture, do this:

pt-query-digest tcpdump.out --type=tcpdump --group-by=fingerprint --print --no-report

That will give you the raw digest of all queries and the hosts from which they originated. More information can be found at:

share|improve this answer
Thanks for the suggestion. Mostly out of curiosity, I'm wondering why this is not a core feature in MySQL. Seems like it would be useful. WDYT? – KM. Jan 17 '13 at 14:52
While MySQL is much more feature-rich than it was in its pre-5.x days, it is still a pretty bare-bones RDBMS compared to Oracle, MS SQL, DB2, etc. Generally, the skill-sets of a senior-level MySQL DBA include Linux and networking. Generally, the first thing to do when looking trying to do something with MySQL is search the Internet for solutions (ie: Open source or proprietary software, or one-off scripts). You'll find that a basic knowledge of Bash-scripting is beneficial. – potto Jan 17 '13 at 17:57
What then might be the proper avenue for requesting this as a feature? It is to report a "bug" at ... ? – KM. Jan 17 '13 at 18:22
Yeah - [] ( is where you'd put in such a request. They're not the most responsive -- I've watched hardcore bugs linger for 2-3 years... :) – potto Jan 17 '13 at 20:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.