MariaDB PMM Client Commands Access Denied

[_Joe_Keilty]

Description:

Running PMM 2.42 server/client and MariaDB 10.11.

Have created a pmm@127.0.0.1 user with following privileges:
GRANT SELECT, RELOAD, PROCESS, SLAVE MONITOR ON . TO pmm@127.0.0.1 IDENTIFIED BY PASSWORD ‘hunter2’ WITH MAX_USER_CONNECTIONS 10

This was following the instructions on documentation.

Generally things look okay, but on the MySQL User Details dashboard powered by Userstats plugin, I can see that the pmm user is issuing commands and receiving Access Denied at a rate of 0.1 per second.

Steps to Reproduce:

Run MariaDB 10.11, create PMM user as defined, run PMM client and add mysql service (using performance schema as source - followed the standard instructions in docs).

Version:

2.42.0

Logs:

pmm-admin status gives:

PMM Server:
        URL    : https://10.1.0.91:8443/
        Version: 2.42.0

PMM Client:
        Connected        : true
        Time drift       : 305.244µs
        Latency          : 454.094µs
        Connection uptime: 100
        pmm-admin version: 2.42.0
        pmm-agent version: 2.42.0
Agents:
        /agent_id/0ae7f099-cdf1-41af-9bde-984a04fa8943 mysql_perfschema_agent Running 0
        /agent_id/6424216b-230d-4dcf-aa33-4ec604414b68 vmagent Running 42000
        /agent_id/b52ccc5e-ff46-4bab-8eb6-a71143547de3 mysqld_exporter Running 42001
        /agent_id/d5ee4b80-e502-4b70-9943-fb5d7917393c node_exporter Running 42002

logs for pmm agent service:

Aug 27 13:12:11 database-staging systemd[1]: Started pmm-agent.service - pmm-agent.
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.182+00:00" level=info msg="Loading configuration file /usr/local/percona/pmm2/config/pmm-agent.yaml." component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/node_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/mysqld_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/mongodb_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/postgres_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/proxysql_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/rds_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/azure_exporter" component=main
Aug 27 13:12:11 database-staging pmm-agent[231076]: time="2024-08-27T13:12:11.183+00:00" level=info msg="Using /usr/local/percona/pmm2/exporters/vmagent" component=main
Aug 27 13:12:12 database-staging pmm-agent[231076]: time="2024-08-27T13:12:12.323+00:00" level=warning msg="ts=2024-08-27T13:12:12.323Z caller=node_exporter.go:186 level=warn msg=\"Node Exporter is running>

Expected Result:

I would expect to see nothing in the Access Denied graph for pmm user

Actual Result:

Additional Information:

Couldn’t find anything in mariadb server error log and nothing came up googling to figure out how to debug

[matthewb]

In MySQL, you can increase log verbosity to see login failures. Maybe MariaDB has something similar?

[_Joe_Keilty]

These ones don’t seem to be login failures - they seem to be pmm issuing a command and not having the privileges to execute it

I am going to try granting BINLOG MONITOR privilege in addition to REPLICA MONITOR as this is what my previous vanilla mysqld exporter had. I’ll let you know if that works!

[_Joe_Keilty]

BINLOG MONITOR sorted it for me.

I noticed your docs are open source so I can contribute a pull request with the changes for MariaDB

[matthewb]

That would be awesome! Thanks for helping!