Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have MonYog running and it is monitoring my DB Server. It gives me constant alerts that the number of refused connections has exceeded the threshold etc. Looking in the LySQL.Log I can see constant login failures for root@localhost.

This is on a hosted server out in the ether so I have been as strict as possible with access etc. Firstly, the 3306 port on the firewall is open only to a couple of selected IP addresses. All other users (for dev and testing etc) use SSH. Secondly, there is no 'root' user. I renamed the root account to something else. This new named account only has localhost access.

So from the above, I just dont see how any login attempts are getting to the DB from localhost. The 3306 port is closed to all but one IP address (mine) and I am not attempting any connect to the server all through the night as the logs are showing. And anyway, I never connect as the (new) root dba user unless I need to do some special admin task.

Is there any way of finding out where these login attempts are coming from (IP address, host name, application name etc...).

Or am I looking in the wrong place. I just cant work out where they are coming from but I am convinced it cant be good!

Thanks for your help Mark

share|improve this question
    
"constant alerts that the number of refused connections has exceeded the threshold etc." -- what? Please don't paraphrase... what exactly do these alerts say? –  Michael - sqlbot Sep 6 '13 at 12:07
add comment

1 Answer

A) You can check TCPdump output for MySQL port connection.

B) Also you can verify whether any script is running on MySQL server may be something like monit etc.. which continuously pings MySQL port.

share|improve this answer
    
Hi Mahesh. Thanks for the ideas. Ran Wireshark on the server. The Access denied messages are appearing with no network traffic at al so must be coming from local machine. I just cant work out where. You mention scripts running on the server. How do I find such things? –  Mark Ogier Sep 9 '13 at 6:10
    
I have myself got in this situation and we found out that monit script was a problem, you can check if any script is running which does activity on MySQL server .. check for monit, backup script etc.. –  Mahesh Patil Sep 10 '13 at 8:07
    
Thanks again. My server is a Windows server. Assume Monit is a linux thing? So how do I find any scripts set to run on my DB. I am not aware of setting any up but they may be there. I just dont know where to look to see if there are any. –  Mark Ogier Sep 11 '13 at 8:52
    
Ok .. you can check for any scheduled job running for a MySQL server .. like you might have started backup job which is not connecting or some store procedure calls etc .. –  Mahesh Patil Sep 12 '13 at 13:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.