I know how to run pt-kill as systemd service:
[Unit]
Description = pt-kill myUser
After=syslog.target mysql.service
Requires=mysql.service
[Service]
Type = simple
PIDFile = /var/run/ptkill.pid
ExecStart = /usr/bin/pt-kill -uxxx -pxxx --daemonize --pid=/var/run/ptkill.pid --log=/var/log/ptkill.log --match-user myUser --match-state "Sending data" --busy-time 640 --kill-query --print
Restart=on-abort
[Install]
WantedBy=multi-user.target
However, this way another system user can see the mysql root password via ps -e -o pid,unit,cmd
:
7786 ptkill.service perl /usr/bin/pt-kill -uxxx -pxxx --daemonize --pid=/var/run/ptkill.pid --log=/var/log
I tried adding User=root
to the [Service]
-section, because root user has protected /root/.my.cnf
where passwordless access to mysql is configured. Sadly this doesn't work (I got no permission to access mysql without specifying user... when starting ptkill.service
, I think the protected .my.cnf
does not get loaded when starting the ptkill.service).
I also tried adding parameters "-umyUser -p`cat /path/to/my/password`" which does not work either.
How to securely run pt-kill as a system service pt-kill and how to securely let it access the mysql server?