PT-SHOW-GRANTS(1) User Contributed Perl Documentation PT-SHOW-GRANTS(1)NAMEpt-show-grants - Canonicalize and print MySQL grants so you can
effectively replicate, compare and version-control them.
SYNOPSIS
Usage: pt-show-grants [OPTIONS] [DSN]
pt-show-grants shows grants (user privileges) from a MySQL server.
Examples:
pt-show-grants
pt-show-grants --separate --revoke | diff othergrants.sql -
RISKS
Percona Toolkit is mature, proven in the real world, and well tested,
but all database tools can pose a risk to the system and the database
server. Before using this tool, please:
· Read the tool's documentation
· Review the tool's known "BUGS"
· Test the tool on a non-production server
· Backup your production server and verify the backups
DESCRIPTIONpt-show-grants extracts, orders, and then prints grants for MySQL user
accounts.
Why would you want this? There are several reasons.
The first is to easily replicate users from one server to another; you
can simply extract the grants from the first server and pipe the output
directly into another server.
The second use is to place your grants into version control. If you do
a daily automated grant dump into version control, you'll get lots of
spurious changesets for grants that don't change, because MySQL prints
the actual grants out in a seemingly random order. For instance, one
day it'll say
GRANT DELETE, INSERT, UPDATE ON `test`.* TO 'foo'@'%';
And then another day it'll say
GRANT INSERT, DELETE, UPDATE ON `test`.* TO 'foo'@'%';
The grants haven't changed, but the order has. This script sorts the
grants within the line, between 'GRANT' and 'ON'. If there are
multiple rows from SHOW GRANTS, it sorts the rows too, except that it
always prints the row with the user's password first, if it exists.
This removes three kinds of inconsistency you'll get from running SHOW
GRANTS, and avoids spurious changesets in version control.
Third, if you want to diff grants across servers, it will be hard
without "canonicalizing" them, which pt-show-grants does. The output
is fully diff-able.
With the "--revoke", "--separate" and other options, pt-show-grants
also makes it easy to revoke specific privileges from users. This is
tedious otherwise.
OPTIONS
This tool accepts additional command-line arguments. Refer to the
"SYNOPSIS" and usage information for details.
--ask-pass
Prompt for a password when connecting to MySQL.
--charset
short form: -A; type: string
Default character set. If the value is utf8, sets Perl's binmode
on STDOUT to utf8, passes the mysql_enable_utf8 option to
DBD::mysql, and runs SET NAMES UTF8 after connecting to MySQL. Any
other value sets binmode on STDOUT without the utf8 layer, and runs
SET NAMES after connecting to MySQL.
--config
type: Array
Read this comma-separated list of config files; if specified, this
must be the first option on the command line.
--database
short form: -D; type: string
The database to use for the connection.
--defaults-file
short form: -F; type: string
Only read mysql options from the given file. You must give an
absolute pathname.
--drop
Add DROP USER before each user in the output.
--flush
Add FLUSH PRIVILEGES after output.
You might need this on pre-4.1.1 servers if you want to drop a user
completely.
--[no]header
default: yes
Print dump header.
The header precedes the dumped grants. It looks like:
-- Grants dumped by pt-show-grants 1.0.19
-- Dumped from server Localhost via UNIX socket, MySQL 5.0.82-log at 2009-10-26 10:01:04
See also "--[no]timestamp".
--help
Show help and exit.
--host
short form: -h; type: string
Connect to host.
--ignore
type: array
Ignore this comma-separated list of users.
--only
type: array
Only show grants for this comma-separated list of users.
--password
short form: -p; type: string
Password to use when connecting.
--pid
type: string
Create the given PID file. The tool won't start if the PID file
already exists and the PID it contains is different than the
current PID. However, if the PID file exists and the PID it
contains is no longer running, the tool will overwrite the PID file
with the current PID. The PID file is removed automatically when
the tool exits.
--port
short form: -P; type: int
Port number to use for connection.
--revoke
Add REVOKE statements for each GRANT statement.
--separate
List each GRANT or REVOKE separately.
The default output from MySQL's SHOW GRANTS command lists many
privileges on a single line. With "--flush", places a FLUSH
PRIVILEGES after each user, instead of once at the end of all the
output.
--set-vars
type: Array
Set the MySQL variables in this comma-separated list of
"variable=value" pairs.
By default, the tool sets:
wait_timeout=10000
Variables specified on the command line override these defaults.
For example, specifying "--set-vars wait_timeout=500" overrides the
defaultvalue of 10000.
The tool prints a warning and continues if a variable cannot be
set.
--socket
short form: -S; type: string
Socket file to use for connection.
--[no]timestamp
default: yes
Add timestamp to the dump header.
See also "--[no]header".
--user
short form: -u; type: string
User for login if not current user.
--version
Show version and exit.
DSN OPTIONS
These DSN options are used to create a DSN. Each option is given like
"option=value". The options are case-sensitive, so P and p are not the
same option. There cannot be whitespace before or after the "=" and if
the value contains whitespace it must be quoted. DSN options are
comma-separated. See the percona-toolkit manpage for full details.
· A
dsn: charset; copy: yes
Default character set.
· D
dsn: database; copy: yes
Default database.
· F
dsn: mysql_read_default_file; copy: yes
Only read default options from the given file
· h
dsn: host; copy: yes
Connect to host.
· p
dsn: password; copy: yes
Password to use when connecting.
· P
dsn: port; copy: yes
Port number to use for connection.
· S
dsn: mysql_socket; copy: yes
Socket file to use for connection.
· u
dsn: user; copy: yes
User for login if not current user.
ENVIRONMENT
The environment variable "PTDEBUG" enables verbose debugging output to
STDERR. To enable debugging and capture all output to a file, run the
tool like:
PTDEBUG=1 pt-show-grants ... > FILE 2>&1
Be careful: debugging output is voluminous and can generate several
megabytes of output.
SYSTEM REQUIREMENTS
You need Perl, DBI, DBD::mysql, and some core packages that ought to be
installed in any reasonably new version of Perl.
BUGS
For a list of known bugs, see
<http://www.percona.com/bugs/pt-show-grants>.
Please report bugs at <https://bugs.launchpad.net/percona-toolkit>.
Include the following information in your bug report:
· Complete command-line used to run the tool
· Tool "--version"
· MySQL version of all servers involved
· Output from the tool including STDERR
· Input files (log/dump/config files, etc.)
If possible, include debugging output by running the tool with
"PTDEBUG"; see "ENVIRONMENT".
DOWNLOADING
Visit <http://www.percona.com/software/percona-toolkit/> to download
the latest release of Percona Toolkit. Or, get the latest release from
the command line:
wget percona.com/get/percona-toolkit.tar.gz
wget percona.com/get/percona-toolkit.rpm
wget percona.com/get/percona-toolkit.deb
You can also get individual tools from the latest release:
wget percona.com/get/TOOL
Replace "TOOL" with the name of any tool.
AUTHORS
Baron Schwartz
ABOUT PERCONA TOOLKIT
This tool is part of Percona Toolkit, a collection of advanced command-
line tools for MySQL developed by Percona. Percona Toolkit was forked
from two projects in June, 2011: Maatkit and Aspersa. Those projects
were created by Baron Schwartz and primarily developed by him and
Daniel Nichter. Visit <http://www.percona.com/software/> to learn
about other free, open-source software from Percona.
COPYRIGHT, LICENSE, AND WARRANTY
This program is copyright 2011-2015 Percona LLC and/or its affiliates,
2007-2011 Baron Schwartz.
THIS PROGRAM IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
This program is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the
Free Software Foundation, version 2; OR the Perl Artistic License. On
UNIX and similar systems, you can issue `man perlgpl' or `man
perlartistic' to read these licenses.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
VERSIONpt-show-grants 2.2.14
perl v5.20.2 2015-04-10 PT-SHOW-GRANTS(1)
