有没有 MariaDB 5.5.56 对应 MySQL CONNECTION

有没有 MariaDB 对应 MySQL CONNECTION_CONTROL 插件

背景

写这篇文章的目的是因为昨晚半夜突然被call起来，有一套系统的mysql数据库启动失败了。尝试了重启服务器也不行。让我协助排查一下问题出在哪。

分析过程

一开始拿到服务器IP地址，就去数据库清单里面查找有没对应的数据库，发现没有，紧接着同事解释了原因，所以没有记录在清单。同事反馈说有100多套这种数据库，为了方便后续的维护管理，我还是建议同事帮忙梳理一份清单。

首先通过ps命令查看mysql进程，确实没有进程起来。

紧接着通过history命令查看历史操作记录，发现实际是一套 mariadb 5.5.56 版本的数据库。并通过历史命令找到了数据库的日志文件，其他也可以通过/etc/my.cnf查看日志文件路径。

通过日志文件查看到错误信息，数据库在启动的时候加载了connection-control插件，但是提示错误，找不到参数connection-control-failed-connections-threshold，接着数据库就aborting了。

250607 02:51:53 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
250607  2:51:53 [Note] /usr/libexec/mysqld (mysqld 5.5.56-MariaDB) starting as process 34467 ...
250607  2:51:54 InnoDB: The InnoDB memory heap is disabled
250607  2:51:54 InnoDB: Mutexes and rw_locks use GCC atomic builtins
250607  2:51:54 InnoDB: Compressed tables use zlib 1.2.7
250607  2:51:54 InnoDB: Using Linux native AIO
250607  2:51:54 InnoDB: Initializing buffer pool, size = 128.0M
250607  2:51:54 InnoDB: Completed initialization of buffer pool
250607  2:51:54 InnoDB: highest supported file format is Barracuda.
250607  2:51:54  InnoDB: Waiting for the background threads to start
250607  2:51:55 Percona XtraDB (http://www.percona.com) 5.5.52-MariaDB-38.3 started; log sequence number 75279716956
250607  2:51:55 [Note] Plugin 'FEEDBACK' is disabled.
250607  2:51:55 [ERROR] Function 'server_audit' already exists
250607  2:51:55 [Warning] Couldn't load plugin named 'server_audit' with soname 'server_audit.so'.
250607  2:51:55 server_audit: MariaDB Audit Plugin version 1.4.1 STARTED.
250607  2:51:55 server_audit: logging started to the file /var/log/mariadb/server_audit.log.
250607  2:51:55 [ERROR] /usr/libexec/mysqld: unknown variable 'connection-control-failed-connections-threshold=5'
250607  2:51:55 [ERROR] Aborting  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<

250607  2:51:55 server_audit: STOPPED
250607  2:51:55  InnoDB: Starting shutdown...
250607  2:51:59  InnoDB: Shutdown completed; log sequence number 75279716956
250607  2:51:59 [Note] /usr/libexec/mysqld: Shutdown complete

250607 02:51:59 mysqld_safe mysqld from pid file /var/run/mariadb/mariadb.pid ended

查看/etc/my.cnf配置信息，确实是增加连接控制的参数。同事反馈是由于去年底等保安全加固做的变更。

]# cat /etc/my.cnf
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links=0
# Settings user and group are ignored when systemd is used.
# If you need to run mysqld under a different user or group,
# customize your systemd unit file for mariadb according to the
# instructions in http://fedoraproject.org/wiki/Systemd
bind-address=127.0.0.1
#####MariaDB Audit plugin######
##加载审计插件
plugin_load=server_audit=server_audit.so
##启用审计日志
server_audit_logging=on
##设置审计日志目录
##server_audit_file_path='/usr/local/mysql/log'
server_audit_file_path='/var/log/mariadb/'
##默认记录所有SQL语句
##server_audit_events=CONNECT,TABLE,QUERY_DDL,QUERY_DCL,QUERY_DML_NO_SELECT
##日志转轮数量，默认9
server_audit_file_rotations=128
##现在审计日志文件大小，默认1000000byte
server_audit_file_rotate_size=1G
server_audit_file_rotate_now=ON

#connection-control-failed-connections-threshold=5  <<<<<<
#connection-control-min-connection-delay=108000  <<<<<<<
#max_password_errors=5

[mysqld_safe]
log-error=/var/log/mariadb/mariadb.log
pid-file=/var/run/mariadb/mariadb.pid

#
# include all files from the config directory
#
!includedir /etc/my.cnf.d

为了尽快恢复业务以及保存现场的环境，备份了my.cnf文件后，把连接控制的参数注释了，重启启动数据库正常。
数据库启动成功了，紧接着让业务重启服务，连接数据库成功，业务恢复正常。

从启动日志中，可以看到还是有几个ERROR的出现，提示mysql.user, mysql.proc表应该是有损坏了。由于没有影响到业务，所以就没有继续处理。

250607 03:01:53 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
250607  3:01:53 [Note] /usr/libexec/mysqld (mysqld 5.5.56-MariaDB) starting as process 54307 ...
250607  3:01:53 InnoDB: The InnoDB memory heap is disabled
250607  3:01:53 InnoDB: Mutexes and rw_locks use GCC atomic builtins
250607  3:01:53 InnoDB: Compressed tables use zlib 1.2.7
250607  3:01:53 InnoDB: Using Linux native AIO
250607  3:01:53 InnoDB: Initializing buffer pool, size = 128.0M
250607  3:01:53 InnoDB: Completed initialization of buffer pool
250607  3:01:53 InnoDB: highest supported file format is Barracuda.
250607  3:01:53  InnoDB: Waiting for the background threads to start
250607  3:01:54 Percona XtraDB (http://www.percona.com) 5.5.52-MariaDB-38.3 started; log sequence number 75279716956
250607  3:01:54 [Note] Plugin 'FEEDBACK' is disabled.
250607  3:01:54 [ERROR] Function 'server_audit' already exists
250607  3:01:54 [Warning] Couldn't load plugin named 'server_audit' with soname 'server_audit.so'.
250607  3:01:54 server_audit: MariaDB Audit Plugin version 1.4.1 STARTED.
250607  3:01:54 server_audit: logging started to the file /var/log/mariadb/server_audit.log.
250607  3:01:54 [Note] Server socket created on IP: '127.0.0.1'.
250607  3:01:54 [ERROR] mysqld: Table './mysql/user' is marked as crashed and should be repaired
250607  3:01:54 [Warning] Checking table:   './mysql/user'
250607  3:01:54 [ERROR] mysql.user: 1 client is using or hasn't closed the table properly
250607  3:01:54 [Note] Event Scheduler: Loaded 0 events
250607  3:01:54 [Note] /usr/libexec/mysqld: ready for connections.
Version: '5.5.56-MariaDB'  socket: '/var/lib/mysql/mysql.sock'  port: 3306  MariaDB Server
250607 11:51:36 [ERROR] mysqld: Table './mysql/proc' is marked as crashed and should be repaired
250607 11:51:36 [Warning] Checking table:   './mysql/proc'

第二天继续排查连接控制参数的问题，发现plugins目录下没有connection_control.so插件，应该是当时同事为了等保，直接在my.cnf文件里面添加了配置，而没有考虑到需要先安装connection_control.so插件。

在测试环境安装了一套同样版本的mariadb数据库，安装完同样发现是没有connection_control.so插件的。为了验证这个问题，需要找到mariadb对应的插件。

找到以下一个案例:
https://mariadb.com/kb/en/is-there-a-mariadb-equivalent-to-mysql-connection_control-plugin/

在这里插入图片描述
经过一番搜索，mysql在5.6.35版本开始加入了这个连接插件。

从其他网站上找到相关的案例 MySQL 与 mariadb的 connection_control插件并不通用。
在这里插入图片描述

尝试安装MySQL的connection_control.so插件

尝试从mysql5.6.35版本的lib目录下的connection_control.so文件拷贝到到mariadb的lib/plugin目录，但是在安装的时候出现错误了，验证不能通用。

[root@exam01 plugin]# mysql -uroot -hexam01 -proot
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2021, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> INSTALL PLUGIN CONNECTION_CONTROL SONAME 'connection_control.so';
ERROR 1126 (HY000): Can't open shared library '/mariadb/lib/plugin/connection_control.so' (errno: 2, undefined symbol: my_getsystime)
mysql> 
mysql> INSTALL PLUGIN CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS SONAME 'connection_control.so';
ERROR 1126 (HY000): Can't open shared library '/mariadb/lib/plugin/connection_control.so' (errno: 2, undefined symbol: my_getsystime)
mysql> 
mysql>

参考文档：
chrome-extension://jkhojcaggkaojlhfddocjkkphfdkejeg/pdf/viewer.html?file=https%3A%2F%2Fdownloads.mysql.com%2Fdocs%2Fmysql-5.6-relnotes-en.a4.pdf

https://dev.mysql.com/doc/refman/5.7/en/connection-control-plugin-installation.html

https://docs.oracle.com/cd/E19957-01/mysql-refman-5.5/