You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Federal Information Processing Standards (FIPS) are a set of U.S. government standards that ensure the security of computer systems for non-military government agencies and contractors. These standards specify how to perform cryptographic operations, such as encryption, hashing, and digital signatures. FIPS mode is a mode of operation that enforces these standards and rejects any non-compliant algorithms or parameters.
6
+
7
+
Percona Server for MySQL implements the same level of FIPS support as MySQL. Percona Server for MySQL can run in FIPS mode if a FIPS-enabled OpenSSL library and FIPS Object Module are available at runtime or if compiled using a FIPS-validated version of OpenSSL. You can also receive this functionality by [building Percona Server for MySQL from source code](compile-percona-server.md).
8
+
9
+
## Prerequisites
10
+
11
+
To prepare Percona Server for MySQL for FIPS certification, do the following:
12
+
13
+
* Check that your operating system includes FIPS pre-approved OpenSSL library in version 3.0.x or higher. The following distributions includes FIPS pre-approved OpenSSL library in version 3.0.x or higher:
14
+
15
+
* RedHat Enterprise Linux 9 and derivatives
16
+
17
+
* Oracle Linux 9
18
+
19
+
The following distributions also includes OpenSSL library in version 3.0.x but do not have FIPS-approved crypto provider installed by default (you can build the crypto provider from the source for testing):
20
+
21
+
* Debian 12
22
+
23
+
* Ubuntu 22.04 Pro (the OpenSSL FIPS 140-3 certification is under implementation)
24
+
25
+
!!! note
26
+
27
+
If you enable FIPS on Ubuntu Pro with `$ sudo pro enable fips-updates` and then disable FIPS with `$ sudo pro disable fips-updates`, Percona Server for MySQL may stop operating properly. For example, if you disable FIPS on Ubuntu Pro with `$ sudo pro disable fips-updates` and enable the FIPS mode on Percona Server with `ssl-fips-mode=ON`, Percona Server may not load the SSL certificate.
28
+
29
+
* Deploy [Percona Server for MySQL from the Pro build](psmysql-pro.md), which is built and tested on operating systems with FIPS pre-approved OpenSSL packages.
30
+
31
+
## The FIPS mode variables
32
+
33
+
Percona Server for MySQL uses the same variables and values as MySQL. Percona Server for MySQL enables control of FIPS mode on the server side and the client side:
34
+
35
+
* The `ssl_fips_mode` system variable shows whether the server operates in FIPS mode. This variable is disabled by default.
36
+
37
+
The `ssl_fips_mode` system variable has these values:
38
+
39
+
*`0` - disables FIPS mode
40
+
*`1` - enables FIPS mode. The exact behavior of the enabled FIPS mode depends on the OpenSSL version. The server only specifies the FIPS value to OpenSSL.
41
+
*`2` - enables `strict` FIPS mode. This value provides more restrictions than the `1 ` value. The exact behavior of the `strict` FIPS mode depends on the OpenSSL version. The server only specifies the FIPS value to OpenSSL.
42
+
43
+
* The `--ssl-fips-mode` client/server option controls whether a given client operates in FIPS mode. This setting does not change the server setting. This option is disabled by default.
44
+
45
+
The `--ssl-fips-mode` client/server option has these values:
46
+
47
+
*`OFF` - disables FIPS mode
48
+
*`ON` - enables FIPS mode. The exact behavior of the enabled FIPS mode depends on the OpenSSL version. The server only specifies the FIPS value to OpenSSL.
49
+
*`STRICT` - enables `strict` FIPS mode. This value provides more restrictions than the `ON` value. The exact behavior of the `strict` FIPS mode depends on the OpenSSL version. The server only specifies the FIPS value to OpenSSL.
50
+
51
+
The server operation in FIPS mode does not depend on which crypto module (regular or FIPS-approved) is set as the default in the OpenSSL configuration file. The server always respects the value of `--ssl-fips-mode` server command line option (`OFF`, `ON`, or `STRICT`). The `ssl_fips_mode` global system variable is read-only and cannot be changed at runtime.
52
+
53
+
### Enable the FIPS mode
54
+
55
+
To enable the FIPS mode, pass `--ssl-fips-mode=ON` or `--ssl-fips-mode=STRICT` to mysqld as a command line argument or add `ssl-fips-mode=ON` or `--ssl-fips-mode=STRICT` to the configuration file. Ignore the warning that the `--ssl-fips-mode` client/server option is deprecated.
56
+
57
+
## Check that FIPS mode is enabled
58
+
59
+
To ensure that the FIPS mode is enabled, do the following:
60
+
61
+
* Pass `--log-error-verbosity=3` to mysqld as a command line argument or add `log-error-verbosity=3` to the configuration file.
62
+
63
+
* Check that the error log contains the following message:
64
+
65
+
```{.text .no-copy}
66
+
A FIPS-approved version of the OpenSSL cryptographic library has been detected in the operating system with a properly configured FIPS module available for loading. Percona Server for MySQL will load this module and run in FIPS mode.
67
+
```
68
+
69
+
## Next steps
70
+
71
+
[Install Percona Server for MySQL Pro :material-arrow-right:](install-pro.md){.md-button}
72
+
73
+
If you already use Percona Server for MySQL, you can
74
+
75
+
[Upgrade to Percona Server for MySQL Pro :material-arrow-right:](upgrade-pro.md){.md-button}
This document provides guidelines how to install Pro packages of Percona Server for MySQL from Percona repositories. [Check files in packages built for Percona Server for MySQL Pro :material-arrow-right:](pro-files.md){.md-button}
6
+
7
+
## Procedure
8
+
9
+
1. Request the access to the pro repository from Percona Support. You will receive the client ID and the access token which you use when downloading the packages.
10
+
11
+
2. Configure the repository and install Percona Server for MySQL packages
Copy file name to clipboardexpand all lines: docs/installation.md
-2
Original file line number
Diff line number
Diff line change
@@ -6,8 +6,6 @@ We gather [Telemetry data] in the Percona packages and Docker images.
6
6
7
7
## Install Percona Server for MySQL from Repositories
8
8
9
-
--8<--- "percona-release.md"
10
-
11
9
Percona provides repositories for yum (`RPM` packages for Red Hat, CentOS and Amazon Linux AMI) and apt (`.deb` packages for Ubuntu and Debian) for software such as Percona Server for MySQL, Percona XtraBackup, and Percona Toolkit. This makes it easy to install and update your software and its dependencies through your operating system’s package manager. This is the recommended way of installing where possible.
12
10
13
11
The following guides describe the installation process for using the official Percona repositories for the `.deb` and `.rpm` packages.
Copy file name to clipboardexpand all lines: docs/kill-idle-trx.md
+59-7
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,60 @@
1
-
# Kill idle transactions
1
+
# Kill idle transaction
2
2
3
-
This feature limits the age of idle transactions, for all transactional storage
4
-
engines. If a transaction is idle for more seconds than the threshold
5
-
specified, it will be killed. This prevents users from blocking *InnoDB* purge
6
-
by mistake.
3
+
Database servers face a constant challenge: managing resources efficiently while maintaining system stability. The kill idle transactions timeout option is a strategic tool to address this challenge. When you set a time limit, any transaction that stays inactive beyond this limit is automatically stopped. This action prevents forgotten or stuck transactions from slowing down your database by blocking critical cleanup processes.
* Prevents resource hogging by abandoned or forgotten transactions
10
+
11
+
* Frees up database connection pools
12
+
13
+
* Reduces unnecessary memory consumption
14
+
15
+
* Protects against potential connection leaks
16
+
17
+
* Prevents unnecessary server load from dormant sessions
18
+
19
+
You must also be consider the following:
20
+
21
+
* May interrupt legitimate long-running queries
22
+
23
+
* Requires careful configuration to avoid disrupting critical processes
24
+
25
+
* Can cause unexpected application behavior if timeout is too aggressive
26
+
27
+
* Might create additional overhead in monitoring and logging
28
+
29
+
* Requires precise tuning for different application requirements
30
+
31
+
32
+
We recommend that you start with conservative timeout settings and review the logs frequently to track terminated transactions.
33
+
34
+
This feature works with all types of database storage that support transactions.
35
+
36
+
## Determine the idle transaction threshold
37
+
38
+
When setting up a database, you must decide how long to let inactive transactions sit before ending them. This decision affects the database's performance.
| How your database is used | Look at how long transactions usually take and how often they happen. If most transactions finish quickly, you should end idle ones sooner. |
43
+
| How many things happen at once | Count how many transactions your system handles simultaneously. If it's a lot, you might need to end idle transactions faster to free up space for new ones. |
44
+
| How it affects speed | Watch how idle transactions change your database's speed. If they slow things down a lot, ending them sooner can help keep everything running smoothly. |
45
+
| What your business needs | Consider what's important for your work. Some important transactions might need more time, so you shouldn't end them too quickly. |
46
+
47
+
## InnoDB purge
48
+
49
+
The InnoDB purge process in MySQL removes outdated row versions (undo logs) from the system. When a transaction modifies data, InnoDB keeps old row versions for rollback and to support transactions running with multi-version concurrency control (MVCC). Once these versions are no longer needed, the purge process deletes them to free up space and improve performance.
50
+
51
+
Blocking the InnoDB purge can lead to increased disk space usage and potential performance degradation. This feature helps prevent issues such by:
52
+
53
+
* Limiting idle transactions: It kills any idle transaction after a specified threshold, ensuring transactions don’t remain idle for too long.
54
+
55
+
* Preventing mistakes: Users can’t accidentally block the InnoDB purge by leaving transactions idle.
56
+
57
+
* Improving performance: Keeping the purge process running smoothly helps maintain optimal database performance.
7
58
8
59
## System variables
9
60
@@ -16,6 +67,7 @@ by mistake.
16
67
| Dynamic: | Yes |
17
68
| Data type | Integer |
18
69
| Default value | 0 (disabled) |
19
-
| Units | Seconds |
70
+
| Unit | Seconds |
71
+
72
+
If set to a non-zero value, the server kills any idle transaction after it stays idle for this number of seconds.
20
73
21
-
If non-zero, any idle transaction will be killed after being idle for this many seconds.
Copy file name to clipboardexpand all lines: docs/myrocks-server-variables.md
+1-5
Original file line number
Diff line number
Diff line change
@@ -888,10 +888,6 @@ Allowed range is from `-1` to `9223372036854775807`.
888
888
| Data type | Numeric |
889
889
| Default | 150000 |
890
890
891
-
!!! note
892
-
893
-
In version [Percona Server for MySQL 8.0.36-28](.//release-notes/8.0.36-28.md) and later, the default value is changed from `0` to `150000`.
894
-
895
891
Specifies the size of the window for counting delete markers by `rocksdb_compaction_sequential_deletes`. Default value is `150000`.
896
892
897
893
Allowed range is up to `2000000` (two million).
@@ -2886,7 +2882,7 @@ This variable is disabled (OFF) by default.
2886
2882
| Data type | Boolean |
2887
2883
| Default | OFF |
2888
2884
2889
-
This variable is [tech preview](../glossary.md/#tech-preview) and may be removed in the future releases.
2885
+
This variable is [tech preview](./glossary.md#tech-preview) and may be removed in the future releases.
2890
2886
2891
2887
Allows to turn on the write buffer manager (WriteBufferManager) from `cnf` files. This variable is related to [`rocksdb_charge_memory`](#rocksdbchargememory).
0 commit comments