Skip to content
logo
Percona XtraBackup
Connection and Privileges Needed
Initializing search
    percona/pxb-docs
    percona/pxb-docs
    • Home
      • About Percona XtraBackup
      • How Percona XtraBackup Works
      • Understand version numbers
      • Installing Percona XtraBackup 2.4
      • Installing Percona XtraBackup on Debian and Ubuntu
      • Installing Percona XtraBackup on Red Hat Enterprise Linux and CentOS
      • Installing Percona XtraBackup from a Binary Tarball
      • Compiling and Installing from Source Code
      • Running Percona XtraBackup in a Docker container
      • Connection and Privileges Needed
        • Connecting to the server
          • Other Connection Options
        • Permissions and Privileges Needed
      • Configuring xtrabackup
      • The Backup Cycle - Full Backups
      • Incremental Backup
      • Compressed Backup
      • Encrypted Backup
      • Percona XtraBackup User Manual
      • Throttling Backups
      • Lockless binary log information
      • Encrypted InnoDB Tablespace Backups
      • `lock-ddl-per-table` Option Improvements
      • How-tos and Recipes
        • Release notes index
        • Percona XtraBackup 2.4.27 (2022-12-06)
        • Percona XtraBackup 2.4.26
        • Percona XtraBackup 2.4.25
        • Percona XtraBackup 2.4.24
        • Percona XtraBackup 2.4.23
        • Percona XtraBackup 2.4.22
        • Percona XtraBackup 2.4.21
        • Percona XtraBackup 2.4.20
        • Percona XtraBackup 2.4.19
        • Percona XtraBackup 2.4.18
        • Percona XtraBackup 2.4.17
        • Percona XtraBackup 2.4.16
        • Percona XtraBackup 2.4.15
        • Percona XtraBackup 2.4.14
        • Percona XtraBackup 2.4.13
        • Percona XtraBackup 2.4.12
        • Percona XtraBackup 2.4.11
        • Percona XtraBackup 2.4.10
        • Percona XtraBackup 2.4.9
        • Percona XtraBackup 2.4.8
        • Percona XtraBackup 2.4.7-2
        • Percona XtraBackup 2.4.7
        • Percona XtraBackup 2.4.6
        • Percona XtraBackup 2.4.5
        • Percona XtraBackup 2.4.4
        • Percona XtraBackup 2.4.3
        • Percona XtraBackup 2.4.2
        • Percona XtraBackup 2.4.1
      • The xtrabackup Option Reference
      • The innobackupex Option Reference
      • The xbcloud Binary
      • Exponential Backoff
      • Using the xbcloud binary with Microsoft Azure Cloud Storage
      • The xbcrypt binary
      • The xbstream binary
      • Known issues and limitations
      • Frequently Asked Questions
      • Glossary
      • Index of files created by Percona XtraBackup
      • Trademark policy
      • Copyright and licensing information
      • Version Checking

    • Connecting to the server
      • Other Connection Options
    • Permissions and Privileges Needed

    Connection and Privileges Needed¶

    Percona XtraBackup needs to be able to connect to the database server and perform operations on the server and the datadir when creating a backup, when preparing in some scenarios and when restoring it. In order to do so, there are privileges and permission requirements on its execution that must be fulfilled.

    Privileges refers to the operations that a system user is permitted to do in the database server. They are set at the database server and only apply to users in the database server.

    Permissions are those which permits a user to perform operations on the system, like reading, writing or executing on a certain directory or start/stop a system service. They are set at a system level and only apply to system users.

    Whether xtrabackup or innobackupex is used, there are two actors involved: the user invoking the program - a system user - and the user performing action in the database server - a database user. Note that these are different users in different places, even though they may have the same username.

    All the invocations of innobackupex and xtrabackup in this documentation assume that the system user has the appropriate permissions and you are providing the relevant options for connecting the database server - besides the options for the action to be performed - and the database user has adequate privileges.

    Connecting to the server¶

    The database user used to connect to the server and its password are specified by the xtrabackup --user and xtrabackup –password option:

    $ xtrabackup --user=DVADER --password=14MY0URF4TH3R --backup \
      --target-dir=/data/bkps/
    $ innobackupex --user=DBUSER --password=SECRET /path/to/backup/dir/
    $ innobackupex --user=LUKE  --password=US3TH3F0RC3 --stream=tar ./ | bzip2 -
    

    If you don’t use the xtrabackup --user option, Percona XtraBackup will assume the database user whose name is the system user executing it.

    Other Connection Options¶

    According to your system, you may need to specify one or more of the following options to connect to the server:

    Option Description
    –port The port to use when connecting to the database server with TCP/IP.
    –socket The socket to use when connecting to the local database.
    –host The host to use when connecting to the database server with TCP/IP.

    These options are passed to the mysql child process without alteration, see mysql --help for details.

    Note

    In case of multiple server instances the correct connection parameters (port, socket, host) must be specified in order for xtrabackup to talk to the correct server.

    Permissions and Privileges Needed¶

    Once connected to the server, in order to perform a backup you will need READ and EXECUTE permissions at a filesystem level in the server’s datadir.

    The database user needs the following privileges on the tables/databases to be backed up:

    • RELOAD and LOCK TABLES (unless the –no-lock option is specified) in order to FLUSH TABLES WITH READ LOCK and FLUSH ENGINE LOGS prior to start copying the files, and LOCK TABLES FOR BACKUP and LOCK BINLOG FOR BACKUP require this privilege when Backup Locks are used.

    • REPLICATION CLIENT in order to obtain the binary log position.

    • CREATE TABLESPACE in order to import tables (see Restoring Individual Tables).

    • PROCESS in order to run SHOW ENGINE INNODB STATUS (which is mandatory), and optionally to see all threads which are running on the server (see Improved FLUSH TABLES WITH READ LOCK handling).

    • SUPER in order to start/stop the replica threads in a replication environment, use XtraDB Changed Page Tracking for Incremental Backups and for Improved FLUSH TABLES WITH READ LOCK handling.

    • CREATE privilege in order to create the PERCONA_SCHEMA.xtrabackup_history database and table.

    • ALTER privilege in order to upgrade the PERCONA_SCHEMA.xtrabackup_history database and table.

    • INSERT privilege in order to add history records to the PERCONA_SCHEMA.xtrabackup_history table.

    • SELECT privilege in order to use innobackupex --incremental-history-name or innobackupex --incremental-history-uuid in order for the feature to look up the innodb_to_lsn values in the PERCONA_SCHEMA.xtrabackup_history table.

    The explanation of when these are used can be found in How Percona XtraBackup Works.

    An SQL example of creating a database user with the minimum privileges required to full backups would be:

    mysql> CREATE USER 'bkpuser'@'localhost' IDENTIFIED BY 's3cret';
    mysql> GRANT RELOAD, LOCK TABLES, PROCESS, REPLICATION CLIENT ON *.* TO
           'bkpuser'@'localhost';
    mysql> FLUSH PRIVILEGES;
    

    Contact us

    For free technical help, visit the Percona Community Forum.

    To report bugs or submit feature requests, open a JIRA ticket.

    For paid support and managed or consulting services , contact Percona Sales.


    Last update: 2022-11-10
    Percona LLC, © 2023
    Made with Material for MkDocs

    Cookie consent

    We use cookies to recognize your repeated visits and preferences, as well as to measure the effectiveness of our documentation and whether users find what they're searching for. With your consent, you're helping us to make our documentation better.