3

We have a corporate monitoring system based in Zabbix. Its MySQL monitoring is quite basic, so I want to add more info. To do so, I've done a script that retrieves this info from MySQL and sends it to Zabbix.

Among the retrieved info, I want to get current connections, but I've only managed to do so with the root user. I've created a zabbix user with SELECT and PROCESS permissions* and tried mysqladmin -u zabbix processlist, but I get Access denied; you need the PROCESS privilege for this operation.

show grants for 'zabbix'@'%';
+----------------------------------------------+
| Grants for zabbix@%                          |
+----------------------------------------------+
| GRANT SELECT, PROCESS ON *.* TO 'zabbix'@'%' |
+----------------------------------------------+
SELECT USER(), CURRENT_USER();
+----------------+----------------+
| USER()         | CURRENT_USER() |
+----------------+----------------+
| root@localhost | root@localhost |
+----------------+----------------+

How can I get zabbix user to retrieve processlist?

* Yes, I've flushed permissions

1
  • Would you please edit and add: the particular query you're trying to run; also, the output of SELECT USER(), CURRENT_USER() Commented Feb 5, 2013 at 11:33

1 Answer 1

2

Perhaps you can create a DB user whose sole purpose in life is to collect the processlist.

Your error message indicates that zabbix does not have the PROCESS privilege.

Without the PROCESS privilege, zabbix can only view the processlist of zabbix users. Not much fun, eh?

But WAIT, you said

mysqladmin -u zabbix processlist

That will attempt to connect as zabbix@localhost which you did not define. Please note:

  • zabbix@localhost will authenticate via the socket file
  • zabbix@'%' will authenticate via TCP/IP

Simply run

GRANT SELECT, PROCESS ON *.* TO 'zabbix'@'localhost';

and your troubles should be over.

Without adding another MySQL user, just specify the TCP/IP protocol

mysqladmin -u zabbix --protocol=tcp processlist
3
  • so, maybe this is a stupid question but... doesn't 'zabbix'@'%' include 'zabbix'@'localhost'?
    – Juanma
    Commented Feb 5, 2013 at 15:21
  • 1
    They are not the same. Using localhost will authenticate a DB Connection via socket file. Using % implies that TCP/IP must be used. See my post dba.stackexchange.com/a/17110/877 for a detailed explanation on user authentication. I also updated my answer to address authenticating with TCP/IP. Commented Feb 5, 2013 at 15:45
  • 1
    Saying GRANT SELECT, PROCESS ON *.* you give zabbix permission to read from any database and table (*.*), don't you?
    – AntonioK
    Commented Dec 11, 2015 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.