Xtrabackup in Percona for MySQL 8.0.34

MySQL & MariaDB Percona XtraBackup
1

Hi

I am using encryption and below option to take backup and stream to cloud bucket directly

XTRABACKUP_OPTIONS="--backup --stream=xbstream --read-buffer-size=1G --parallel=4 --compress --compress-threads=4 --slave-info --no-lock --safe-slave-backup --extra-lsndir=${target_dir} --target-dir=${target_dir} ${extra_backup_option}"

When I trying to run backup, using below option , it is failing

 /backup/xtrabackup_gcs/fullbackup.sh "db-server-XX" "--host=127.0.0.1 --encrypt=AES256 --encrypt-key-file=/backup/xtrabackup_gcs/keyfile --encrypt-=2"eads

It is failing with below error in log

2024-09-30T00:01:10.194649-07:00 2 [Note] [MY-011825] [Xtrabackup] Done: Compressing, encrypting and streaming ./percona/stock_log.ibd
encryption: unable to set libgcrypt cipher key - User defined source 1 : Invalid key length

Fatal error: gcry_cipher_close: already closed/invalid handle
2024-09-30T07:01:10Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=
Thread pointer: 0x7fb1c80008c0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fb1ef7fd8b0 thread_stack 0x100000
2024-09-30T00:01:10.201514-07:00 4 [Note] [MY-011825] [Xtrabackup] Done: Compressing, encrypting and streaming ./recover_data/orXX_XXX_XX.ibd
encryption: unable to set libgcrypt cipher key - User defined source 1 : Invalid key length

Fatal error: gcry_cipher_close: already closed/invalid handle

I used below to generate the keyfile, please suggest on further option to overcome

openssl rand -base64 32 | tr -d '\n' > /backup/xtrabackup_gcs/keyfile
1 Like
2

Hi @virin_t,
It seems you’re hitting a bug that is explained here: [PXB-3051] - Percona JIRA
I could not see any workaround yet, but if you don’t need to compress option, you might remove it.

3

Thank you for thr update @yunus.uyanik

Is there a wrok around for this? or do you suggest any other ways to encrypt the backups while uploading to buckets.

4

are there any specific versions which are affected?

5

are there any specific versions which are affected?

Even the latest version has the same issue.

As a workaround, you can use the below to generate a key file; it works for me.

openssl rand -base64 24 | tr -d '\n' > /backup/xtrabackup_gcs/keyfile2

See the doc: Encrypt backups - Percona XtraBackup

6

You mean , keyfile is being helpful to encrypt backups if generated as above?