<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="firewall-reference">
      </a>
      8.4.7.4 MySQL Enterprise Firewall Reference
     </h4>
    </div>
   </div>
  </div>
  <p>
   The following sections provide a reference to MySQL Enterprise Firewall elements:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-reference.html#firewall-tables" title="MySQL Enterprise Firewall Tables">
       MySQL Enterprise Firewall Tables
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-reference.html#firewall-stored-routines" title="MySQL Enterprise Firewall Stored Procedures">
       MySQL Enterprise Firewall Stored Procedures
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-reference.html#firewall-functions" title="MySQL Enterprise Firewall Administrative Functions">
       MySQL Enterprise Firewall Administrative Functions
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-reference.html#firewall-system-variables" title="MySQL Enterprise Firewall System Variables">
       MySQL Enterprise Firewall System Variables
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="firewall-reference.html#firewall-status-variables" title="MySQL Enterprise Firewall Status Variables">
       MySQL Enterprise Firewall Status Variables
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-tables">
       </a>
       MySQL Enterprise Firewall Tables
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall maintains profile information on a per-group and
          per-account basis. It uses tables in the firewall database for
          persistent storage and
    <code class="literal">
     INFORMATION_SCHEMA
    </code>
    or Performance Schema tables to provide views into in-memory
          cached data. When enabled, the firewall bases operational
          decisions on the cached data. The firewall database can be the
    <code class="literal">
     mysql
    </code>
    system database or a custom schema
          (see
    <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
     Installing MySQL Enterprise Firewall
    </a>
    ).
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-tables-group" title="Firewall Group Profile Tables">
        Firewall Group Profile Tables
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-tables-account" title="Firewall Account Profile Tables">
        Firewall Account Profile Tables
       </a>
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-tables-group">
    </a>
    Firewall Group Profile Tables
   </h6>
   <p>
    MySQL Enterprise Firewall maintains group profile information using tables in the
          firewall database (
    <code class="literal">
     mysql
    </code>
    or custom) for
          persistent storage and Performance Schema tables to provide
          views into in-memory cached data.
   </p>
   <p>
    Each system and Performance Schema table is accessible only by
          accounts that have the
    <a class="link" href="privileges-provided.html#priv_select">
     <code class="literal">
      SELECT
     </code>
    </a>
    privilege for it.
   </p>
   <p>
    The
    <code class="literal">
     <em class="replaceable">
      <code>
       default-database
      </code>
     </em>
     .firewall_groups
    </code>
    table lists names and operational modes of registered firewall
          group profiles. The table has the following columns (with the
          corresponding Performance Schema
    <a class="link" href="performance-schema-firewall-groups-table.html" title="29.12.17.1 The firewall_groups Table">
     <code class="literal">
      firewall_groups
     </code>
    </a>
    table having
          similar but not necessarily identical columns):
   </p>
   <a class="indexterm" name="idm46045234075856">
   </a>
   <a class="indexterm" name="idm46045234074816">
   </a>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NAME
       </code>
      </p>
      <p>
       The group profile name.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MODE
       </code>
      </p>
      <p>
       The current operational mode for the profile. Permitted
              mode values are
       <code class="literal">
        OFF
       </code>
       ,
       <code class="literal">
        DETECTING
       </code>
       ,
       <code class="literal">
        PROTECTING
       </code>
       , and
       <code class="literal">
        RECORDING
       </code>
       . For details about their
              meanings, see
       <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
        Firewall Concepts
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        USERHOST
       </code>
      </p>
      <p>
       The training account for the group profile, to be used
              when the profile is in
       <code class="literal">
        RECORDING
       </code>
       mode.
              The value is
       <code class="literal">
        NULL
       </code>
       , or a
              non-
       <code class="literal">
        NULL
       </code>
       account that has the format
       <code class="literal">
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
       </code>
       :
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          If the value is
          <code class="literal">
           NULL
          </code>
          , the firewall
                  records allowlist rules for statements received from
                  any account that is a member of the group.
         </p>
        </li>
        <li class="listitem">
         <p>
          If the value is non-
          <code class="literal">
           NULL
          </code>
          , the
                  firewall records allowlist rules only for statements
                  received from the named account (which should be a
                  member of the group).
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     <em class="replaceable">
      <code>
       default-database
      </code>
     </em>
     .firewall_group_allowlist
    </code>
    table lists allowlist rules of registered firewall group
          profiles. The table has the following columns (with the
          corresponding Performance Schema
    <a class="link" href="performance-schema-firewall-group-allowlist-table.html" title="29.12.17.2 The firewall_group_allowlist Table">
     <code class="literal">
      firewall_group_allowlist
     </code>
    </a>
    table
          having similar but not necessarily identical columns):
   </p>
   <a class="indexterm" name="idm46045234051568">
   </a>
   <a class="indexterm" name="idm46045234050448">
   </a>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NAME
       </code>
      </p>
      <p>
       The group profile name.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        RULE
       </code>
      </p>
      <p>
       A normalized statement indicating an acceptable statement
              pattern for the profile. A profile allowlist is the union
              of its rules.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ID
       </code>
      </p>
      <p>
       An integer column that is a primary key for the table.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     <em class="replaceable">
      <code>
       default-database
      </code>
     </em>
     .firewall_membership
    </code>
    table lists the members (accounts) of registered firewall
          group profiles. The table has the following columns (with the
          corresponding Performance Schema
    <a class="link" href="performance-schema-firewall-membership-table.html" title="29.12.17.3 The firewall_membership Table">
     <code class="literal">
      firewall_membership
     </code>
    </a>
    table having
          similar but not necessarily identical columns):
   </p>
   <a class="indexterm" name="idm46045234039536">
   </a>
   <a class="indexterm" name="idm46045234038496">
   </a>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        GROUP_ID
       </code>
      </p>
      <p>
       The group profile name.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MEMBER_ID
       </code>
      </p>
      <p>
       The name of an account that is a member of the profile.
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-tables-account">
    </a>
    Firewall Account Profile Tables
   </h6>
   <p>
    MySQL Enterprise Firewall maintains account profile information using tables in
          the firewall database for persistent storage and
    <code class="literal">
     INFORMATION_SCHEMA
    </code>
    tables to provide views
          into in-memory cached data. The firewall database can be the
    <code class="literal">
     mysql
    </code>
    system database or a custom schema
          (see
    <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
     Installing MySQL Enterprise Firewall
    </a>
    ).
   </p>
   <p>
    Each default database table is accessible only by accounts
          that have the
    <a class="link" href="privileges-provided.html#priv_select">
     <code class="literal">
      SELECT
     </code>
    </a>
    privilege
          for it. The
    <code class="literal">
     INFORMATION_SCHEMA
    </code>
    tables are
          accessible by anyone.
   </p>
   <p>
    These tables are deprecated, and subject to removal in a
          future MySQL version. See
    <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
     Migrating Account Profiles to Group Profiles
    </a>
    .
   </p>
   <p>
    The
    <code class="literal">
     <em class="replaceable">
      <code>
       default-database
      </code>
     </em>
     .firewall_users
    </code>
    table lists names and operational modes of registered firewall
          account profiles. The table has the following columns (with
          the corresponding
    <a class="link" href="information-schema-mysql-firewall-users-table.html" title="28.7.2 The INFORMATION_SCHEMA MYSQL_FIREWALL_USERS Table">
     <code class="literal">
      MYSQL_FIREWALL_USERS
     </code>
    </a>
    table having
          similar but not necessarily identical columns):
   </p>
   <a class="indexterm" name="idm46045234022080">
   </a>
   <a class="indexterm" name="idm46045234021040">
   </a>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        USERHOST
       </code>
      </p>
      <p>
       The account profile name. Each account name has the format
       <code class="literal">
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MODE
       </code>
      </p>
      <p>
       The current operational mode for the profile. Permitted
              mode values are
       <code class="literal">
        OFF
       </code>
       ,
       <code class="literal">
        DETECTING
       </code>
       ,
       <code class="literal">
        PROTECTING
       </code>
       ,
       <code class="literal">
        RECORDING
       </code>
       , and
       <code class="literal">
        RESET
       </code>
       . For details about their
              meanings, see
       <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
        Firewall Concepts
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The
    <code class="literal">
     <em class="replaceable">
      <code>
       firewall-database
      </code>
     </em>
     .firewall_whitelist
    </code>
    table lists allowlist rules of registered firewall account
          profiles. The table has the following columns (with the
          corresponding
    <a class="link" href="information-schema-mysql-firewall-whitelist-table.html" title="28.7.3 The INFORMATION_SCHEMA MYSQL_FIREWALL_WHITELIST Table">
     <code class="literal">
      MYSQL_FIREWALL_WHITELIST
     </code>
    </a>
    table
          having similar but not necessarily identical columns):
   </p>
   <a class="indexterm" name="idm46045234006544">
   </a>
   <a class="indexterm" name="idm46045234005504">
   </a>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        USERHOST
       </code>
      </p>
      <p>
       The account profile name. Each account name has the format
       <code class="literal">
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        RULE
       </code>
      </p>
      <p>
       A normalized statement indicating an acceptable statement
              pattern for the profile. A profile allowlist is the union
              of its rules.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ID
       </code>
      </p>
      <p>
       An integer column that is a primary key for the table.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-stored-routines">
       </a>
       MySQL Enterprise Firewall Stored Procedures
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall stored procedures perform tasks such as registering
          profiles with the firewall, establishing their operational
          mode, and managing transfer of firewall data between the cache
          and persistent storage. These procedures invoke administrative
          functions that provide an API for lower-level tasks.
   </p>
   <p>
    Firewall stored procedures are created in the firewall
          database. The firewall database can be the
    <code class="literal">
     mysql
    </code>
    system database or a custom schema
          (see
    <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
     Installing MySQL Enterprise Firewall
    </a>
    ).
   </p>
   <p>
    To invoke a firewall stored procedure, either do so while the
          specified firewall database is the default database, or
          qualify the procedure name with the database name. For
          example, if
    <code class="literal">
     mysql
    </code>
    is the firewall database:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa32225470"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">group</em></span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">mode</em></span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    In MySQL 8.4, firewall stored procedures are
          transactional; if an error occurs during execution of a
          firewall stored procedure, all changes made by it up to that
          point are rolled back, and an error is reported.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     If you have installed MySQL Enterprise Firewall in a custom schema, then make
            appropriate substitution for your system. For example, if
            the firewall is installed in the
     <code class="literal">
      fwdb
     </code>
     schema, then execute the stored procedures like this:
    </p>
    <div class="copytoclipboard-wrapper">
     <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa72957546"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> fwdb<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token keyword"><em class="replaceable">group</em></span><span class="token punctuation">,</span> <span class="token keyword"><em class="replaceable">mode</em></span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
    </div>
    <p>
    </p>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-stored-routines-group" title="Firewall Group Profile Stored Procedures">
        Firewall Group Profile Stored Procedures
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-stored-routines-account" title="Firewall Account Profile Stored Procedures">
        Firewall Account Profile Stored Procedures
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-stored-routines-miscellaneous" title="Firewall Miscellaneous Stored Procedures">
        Firewall Miscellaneous Stored Procedures
       </a>
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-stored-routines-group">
    </a>
    Firewall Group Profile Stored Procedures
   </h6>
   <p>
    These stored procedures perform management operations on
          firewall group profiles:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        sp_firewall_group_delist(
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233977712">
      </a>
      <a class="indexterm" name="idm46045233976592">
      </a>
      <p>
       This stored procedure removes an account from a firewall
              group profile.
      </p>
      <p>
       If the call succeeds, the change in group membership is
              made to both the in-memory cache and persistent storage.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the
                  affected group profile.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The account to
                  remove, as a string in
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          format.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa10033178"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_delist<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sp_firewall_group_enlist(
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233965568">
      </a>
      <a class="indexterm" name="idm46045233964448">
      </a>
      <p>
       This stored procedure adds an account to a firewall group
              profile. It is not necessary to register the account
              itself with the firewall before adding the account to the
              group.
      </p>
      <p>
       If the call succeeds, the change in group membership is
              made to both the in-memory cache and persistent storage.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the
                  affected group profile.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The account to add,
                  as a string in
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          format.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa33087814"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sp_reload_firewall_group_rules(
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233953744">
      </a>
      <a class="indexterm" name="idm46045233952608">
      </a>
      <p>
       This stored procedure provides control over firewall
              operation for individual group profiles. The procedure
              uses firewall administrative functions to reload the
              in-memory rules for a group profile from the rules stored
              in the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_group_allowlist
       </code>
       table.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the
                  affected group profile.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa18323832"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_reload_firewall_group_rules<span class="token punctuation">(</span><span class="token string">'myapp'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Warning
       </div>
       <p>
        This procedure clears the group profile in-memory
                allowlist rules before reloading them from persistent
                storage, and sets the profile mode to
        <code class="literal">
         OFF
        </code>
        . If the profile mode was not
        <code class="literal">
         OFF
        </code>
        prior to the
        <code class="literal">
         sp_reload_firewall_group_rules()
        </code>
        call, use
        <code class="literal">
         sp_set_firewall_group_mode()
        </code>
        to
                restore its previous mode after reloading the rules. For
                example, if the profile was in
        <code class="literal">
         PROTECTING
        </code>
        mode, that is no longer
                true after calling
        <code class="literal">
         sp_reload_firewall_group_rules()
        </code>
        and
                you must set it to
        <code class="literal">
         PROTECTING
        </code>
        again
                explicitly.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sp_set_firewall_group_mode(
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          mode
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233937152">
      </a>
      <a class="indexterm" name="idm46045233936032">
      </a>
      <p>
       This stored procedure establishes the operational mode for
              a firewall group profile, after registering the profile
              with the firewall if it was not already registered. The
              procedure also invokes firewall administrative functions
              as necessary to transfer firewall data between the cache
              and persistent storage. This procedure may be called even
              if the
       <code class="literal">
        mysql_firewall_mode
       </code>
       system
              variable is
       <code class="literal">
        OFF
       </code>
       , although setting the
              mode for a profile has no operational effect until the
              firewall is enabled.
      </p>
      <p>
       If the profile previously existed, any recording
              limitation for it remains unchanged. To set or clear the
              limitation, call
       <code class="literal">
        sp_set_firewall_group_mode_and_user()
       </code>
       instead.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the
                  affected group profile.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            mode
           </code>
          </em>
          : The operational mode
                  for the profile, as a string. Permitted mode values
                  are
          <code class="literal">
           OFF
          </code>
          ,
          <code class="literal">
           DETECTING
          </code>
          ,
          <code class="literal">
           PROTECTING
          </code>
          , and
          <code class="literal">
           RECORDING
          </code>
          . For details about their
                  meanings, see
          <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
           Firewall Concepts
          </a>
          .
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa99067349"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'myapp'</span><span class="token punctuation">,</span> <span class="token string">'PROTECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sp_set_firewall_group_mode_and_user(
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          mode
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233919584">
      </a>
      <a class="indexterm" name="idm46045233918448">
      </a>
      <p>
       This stored procedure registers a group with the firewall
              and establishes its operational mode, similar to
       <code class="literal">
        sp_set_firewall_group_mode()
       </code>
       , but also
              specifies the training account to be used when the group
              is in
       <code class="literal">
        RECORDING
       </code>
       mode.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the
                  affected group profile.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            mode
           </code>
          </em>
          : The operational mode
                  for the profile, as a string. Permitted mode values
                  are
          <code class="literal">
           OFF
          </code>
          ,
          <code class="literal">
           DETECTING
          </code>
          ,
          <code class="literal">
           PROTECTING
          </code>
          , and
          <code class="literal">
           RECORDING
          </code>
          . For details about their
                  meanings, see
          <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
           Firewall Concepts
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The training account
                  for the group profile, to be used when the profile is
                  in
          <code class="literal">
           RECORDING
          </code>
          mode. The value is
          <code class="literal">
           NULL
          </code>
          , or a
                  non-
          <code class="literal">
           NULL
          </code>
          account that has the
                  format
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          :
         </p>
         <div class="itemizedlist">
          <ul class="itemizedlist" style="list-style-type: square; ">
           <li class="listitem">
            <p>
             If the value is
             <code class="literal">
              NULL
             </code>
             , the
                      firewall records allowlist rules for statements
                      received from any account that is a member of the
                      group.
            </p>
           </li>
           <li class="listitem">
            <p>
             If the value is non-
             <code class="literal">
              NULL
             </code>
             , the
                      firewall records allowlist rules only for
                      statements received from the named account (which
                      should be a member of the group).
            </p>
           </li>
          </ul>
         </div>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa54995887"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> mysql<span class="token punctuation">.</span>sp_set_firewall_group_mode_and_user<span class="token punctuation">(</span><span class="token string">'myapp'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">,</span> <span class="token string">'myapp_user1@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-stored-routines-account">
    </a>
    Firewall Account Profile Stored Procedures
   </h6>
   <p>
    These stored procedures perform management operations on
          firewall account profiles:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        sp_reload_firewall_rules(
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233893728">
      </a>
      <a class="indexterm" name="idm46045233892608">
      </a>
      <p>
       This stored procedure provides control over firewall
              operation for individual account profiles. The procedure
              uses firewall administrative functions to reload the
              in-memory rules for an account profile from the rules
              stored in the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_whitelist
       </code>
       table.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The name of the
                  affected account profile, as a string in
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          format.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa66121744"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> sp_reload_firewall_rules<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Warning
       </div>
       <p>
        This procedure clears the account profile in-memory
                allowlist rules before reloading them from persistent
                storage, and sets the profile mode to
        <code class="literal">
         OFF
        </code>
        . If the profile mode was not
        <code class="literal">
         OFF
        </code>
        prior to the
        <code class="literal">
         sp_reload_firewall_rules()
        </code>
        call, use
        <code class="literal">
         sp_set_firewall_mode()
        </code>
        to restore its
                previous mode after reloading the rules. For example, if
                the profile was in
        <code class="literal">
         PROTECTING
        </code>
        mode,
                that is no longer true after calling
        <code class="literal">
         sp_reload_firewall_rules()
        </code>
        and you
                must set it to
        <code class="literal">
         PROTECTING
        </code>
        again
                explicitly.
       </p>
      </div>
      <p>
       This procedure is deprecated, and subject to removal in a
              future MySQL version. See
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sp_set_firewall_mode(
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          mode
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233874624">
      </a>
      <a class="indexterm" name="idm46045233873504">
      </a>
      <p>
       This stored procedure establishes the operational mode for
              a firewall account profile, after registering the profile
              with the firewall if it was not already registered. The
              procedure also invokes firewall administrative functions
              as necessary to transfer firewall data between the cache
              and persistent storage. This procedure may be called even
              if the
       <code class="literal">
        mysql_firewall_mode
       </code>
       system
              variable is
       <code class="literal">
        OFF
       </code>
       , although setting the
              mode for a profile has no operational effect until the
              firewall is enabled.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The name of the
                  affected account profile, as a string in
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          format.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            mode
           </code>
          </em>
          : The operational mode
                  for the profile, as a string. Permitted mode values
                  are
          <code class="literal">
           OFF
          </code>
          ,
          <code class="literal">
           DETECTING
          </code>
          ,
          <code class="literal">
           PROTECTING
          </code>
          ,
          <code class="literal">
           RECORDING
          </code>
          , and
          <code class="literal">
           RESET
          </code>
          . For details about their
                  meanings, see
          <a class="xref" href="firewall-usage.html#firewall-concepts" title="Firewall Concepts">
           Firewall Concepts
          </a>
          .
         </p>
        </li>
       </ul>
      </div>
      <p>
       Switching an account profile to any mode but
       <code class="literal">
        RECORDING
       </code>
       synchronizes its firewall
              cache data to the firewall database tables that provide
              persistent underlying storage (
       <code class="literal">
        mysql
       </code>
       or
              custom). Switching the mode from
       <code class="literal">
        OFF
       </code>
       to
       <code class="literal">
        RECORDING
       </code>
       reloads the allowlist from
              the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_whitelist
       </code>
       table into the cache.
      </p>
      <p>
       If an account profile has an empty allowlist, its mode
              cannot be set to
       <code class="literal">
        PROTECTING
       </code>
       because the
              profile would reject every statement, effectively
              prohibiting the account from executing statements. In
              response to such a mode-setting attempt, the firewall
              produces a diagnostic message that is returned as a result
              set rather than as an SQL error:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa4621723"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CALL</span> sp_set_firewall_mode<span class="token punctuation">(</span><span class="token string">'a@b'</span><span class="token punctuation">,</span><span class="token string">'PROTECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> set_firewall_mode(arg_userhost, arg_mode)                            <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> ERROR: PROTECTING mode requested for a@b but the allowlist is empty. <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
      <p>
       This procedure is deprecated, and subject to removal in a
              future MySQL version. See
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-stored-routines-miscellaneous">
    </a>
    Firewall Miscellaneous Stored Procedures
   </h6>
   <p>
    These stored procedures perform miscellaneous firewall
          management operations.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        sp_migrate_firewall_user_to_group(
        <em class="replaceable">
         <code>
          user
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          group
         </code>
        </em>
        )
       </code>
      </p>
      <a class="indexterm" name="idm46045233846832">
      </a>
      <a class="indexterm" name="idm46045233845696">
      </a>
      <p>
       The
       <code class="literal">
        sp_migrate_firewall_user_to_group()
       </code>
       stored procedure converts a firewall account profile to a
              group profile with the account as its single enlisted
              member. Run the
       <code class="filename">
        firewall_profile_migration.sql
       </code>
       script
              to install it. The conversion procedure is discussed in
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
      <p>
       This routine requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            user
           </code>
          </em>
          : The name of the
                  account profile to convert to a group profile, as a
                  string in
          <code class="literal">
           <em class="replaceable">
            <code>
             user_name
            </code>
           </em>
           @
           <em class="replaceable">
            <code>
             host_name
            </code>
           </em>
          </code>
          format. The account profile must exist, and must not
                  currently be in
          <code class="literal">
           RECORDING
          </code>
          mode.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            group
           </code>
          </em>
          : The name of the new
                  group profile, which must not already exist. The new
                  group profile has the named account as its single
                  enlisted member, and that member is set as the group
                  training account. The group profile operational mode
                  is taken from the account profile operational mode.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa93791596"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CALL</span> sp_migrate_firewall_user_to_group<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> 'mygroup<span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-functions">
       </a>
       MySQL Enterprise Firewall Administrative Functions
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall administrative functions provide an API for lower-level
          tasks such as synchronizing the firewall cache with the
          underlying system tables.
   </p>
   <p>
    <span class="emphasis">
     <em>
      Under normal operation, these functions are invoked
          by the firewall stored procedures, not directly by
          users.
     </em>
    </span>
    For that reason, these function descriptions
          do not include details such as information about their
          arguments and return types.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-functions-group" title="Firewall Group Profile Functions">
        Firewall Group Profile Functions
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-functions-account" title="Firewall Account Profile Functions">
        Firewall Account Profile Functions
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="firewall-reference.html#firewall-functions-miscellaneous" title="Firewall Miscellaneous Functions">
        Firewall Miscellaneous Functions
       </a>
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-functions-group">
    </a>
    Firewall Group Profile Functions
   </h6>
   <p>
    These functions perform management operations on firewall
          group profiles:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="function_firewall-group-delist">
       </a>
       <a class="link" href="firewall-reference.html#function_firewall-group-delist">
        <code class="literal">
         firewall_group_delist(
         <em class="replaceable">
          <code>
           group
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233820368">
      </a>
      <a class="indexterm" name="idm46045233819248">
      </a>
      <p>
       This function removes an account from a group profile. It
              requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa84127619"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> firewall_group_delist<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="function_firewall-group-enlist">
       </a>
       <a class="link" href="firewall-reference.html#function_firewall-group-enlist">
        <code class="literal">
         firewall_group_enlist(
         <em class="replaceable">
          <code>
           group
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233811168">
      </a>
      <a class="indexterm" name="idm46045233810048">
      </a>
      <p>
       This function adds an account to a group profile. It
              requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       It is not necessary to register the account itself with
              the firewall before adding the account to the group.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa48490624"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> firewall_group_enlist<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="function_read-firewall-group-allowlist">
       </a>
       <a class="link" href="firewall-reference.html#function_read-firewall-group-allowlist">
        <code class="literal">
         read_firewall_group_allowlist(
         <em class="replaceable">
          <code>
           group
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           rule
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233801392">
      </a>
      <a class="indexterm" name="idm46045233800272">
      </a>
      <p>
       This aggregate function updates the recorded-statement
              cache for the named group profile through a
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statement on the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_group_allowlist
       </code>
       table. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa74562396"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> read_firewall_group_allowlist<span class="token punctuation">(</span><span class="token string">'my_fw_group'</span><span class="token punctuation">,</span> fgw<span class="token punctuation">.</span>rule<span class="token punctuation">)</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span>firewall_group_allowlist <span class="token keyword">AS</span> fgw
<span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">=</span> <span class="token string">'my_fw_group'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="function_read-firewall-groups">
       </a>
       <a class="link" href="firewall-reference.html#function_read-firewall-groups">
        <code class="literal">
         read_firewall_groups(
         <em class="replaceable">
          <code>
           group
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           mode
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233789184">
      </a>
      <a class="indexterm" name="idm46045233788064">
      </a>
      <p>
       This aggregate function updates the firewall group profile
              cache through a
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statement on the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_groups
       </code>
       table. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa39162298"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> read_firewall_groups<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">,</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">)</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span>firewall_groups<span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="function_set-firewall-group-mode">
       </a>
       <a class="link" href="firewall-reference.html#function_set-firewall-group-mode">
        <code class="literal">
         set_firewall_group_mode(
         <em class="replaceable">
          <code>
           group
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           mode
          </code>
         </em>
         [,
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         ])
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233777136">
      </a>
      <a class="indexterm" name="idm46045233776016">
      </a>
      <p>
       This function manages the group profile cache, establishes
              the profile operational mode, and optionally specifies the
              profile training account. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       If the optional
       <em class="replaceable">
        <code>
         user
        </code>
       </em>
       argument
              is not given, any previous
       <em class="replaceable">
        <code>
         user
        </code>
       </em>
       setting for the profile remains unchanged. To change the
              setting, call the function with a third argument.
      </p>
      <p>
       If the optional
       <em class="replaceable">
        <code>
         user
        </code>
       </em>
       argument
              is given, it specifies the training account for the group
              profile, to be used when the profile is in
       <code class="literal">
        RECORDING
       </code>
       mode. The value is
       <code class="literal">
        NULL
       </code>
       , or a non-
       <code class="literal">
        NULL
       </code>
       account that has the format
       <code class="literal">
        <em class="replaceable">
         <code>
          user_name
         </code>
        </em>
        @
        <em class="replaceable">
         <code>
          host_name
         </code>
        </em>
       </code>
       :
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          If the value is
          <code class="literal">
           NULL
          </code>
          , the firewall
                  records allowlist rules for statements received from
                  any account that is a member of the group.
         </p>
        </li>
        <li class="listitem">
         <p>
          If the value is non-
          <code class="literal">
           NULL
          </code>
          , the
                  firewall records allowlist rules only for statements
                  received from the named account (which should be a
                  member of the group).
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa63474900"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> set_firewall_group_mode<span class="token punctuation">(</span><span class="token string">'g'</span><span class="token punctuation">,</span> <span class="token string">'DETECTING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-functions-account">
    </a>
    Firewall Account Profile Functions
   </h6>
   <p>
    These functions perform management operations on firewall
          account profiles:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="function_read-firewall-users">
       </a>
       <a class="link" href="firewall-reference.html#function_read-firewall-users">
        <code class="literal">
         read_firewall_users(
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           mode
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233755872">
      </a>
      <a class="indexterm" name="idm46045233754752">
      </a>
      <p>
       This aggregate function updates the firewall account
              profile cache through a
       <code class="literal">
        SELECT
       </code>
       statement on the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_users
       </code>
       table. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege or
              the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa33981938"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> read_firewall_users<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span>firewall_users<span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This function is deprecated, and subject to removal in a
              future MySQL version. See
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="function_read-firewall-whitelist">
       </a>
       <a class="link" href="firewall-reference.html#function_read-firewall-whitelist">
        <code class="literal">
         read_firewall_whitelist(
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           rule
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233742304">
      </a>
      <a class="indexterm" name="idm46045233741184">
      </a>
      <p>
       This aggregate function updates the recorded-statement
              cache for the named account profile through a
       <code class="literal">
        SELECT
       </code>
       statement on the
       <code class="literal">
        <em class="replaceable">
         <code>
          firewall-database
         </code>
        </em>
        .firewall_whitelist
       </code>
       table. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege or
              the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25569961"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> read_firewall_whitelist<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> fw<span class="token punctuation">.</span>rule<span class="token punctuation">)</span>
<span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span>firewall_whitelist <span class="token keyword">AS</span> fw
<span class="token keyword">WHERE</span> USERHOST <span class="token operator">=</span> <span class="token string">'fwuser@localhost'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This function is deprecated, and subject to removal in a
              future MySQL version. See
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="function_set-firewall-mode">
       </a>
       <a class="link" href="firewall-reference.html#function_set-firewall-mode">
        <code class="literal">
         set_firewall_mode(
         <em class="replaceable">
          <code>
           user
          </code>
         </em>
         ,
         <em class="replaceable">
          <code>
           mode
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233728576">
      </a>
      <a class="indexterm" name="idm46045233727472">
      </a>
      <p>
       This function manages the account profile cache and
              establishes the profile operational mode. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege or
              the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa95653569"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> set_firewall_mode<span class="token punctuation">(</span><span class="token string">'fwuser@localhost'</span><span class="token punctuation">,</span> <span class="token string">'RECORDING'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       This function is deprecated, and subject to removal in a
              future MySQL version. See
       <a class="xref" href="firewall-usage.html#firewall-account-profile-migration" title="Migrating Account Profiles to Group Profiles">
        Migrating Account Profiles to Group Profiles
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="firewall-functions-miscellaneous">
    </a>
    Firewall Miscellaneous Functions
   </h6>
   <p>
    These functions perform miscellaneous firewall operations:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="function_mysql-firewall-flush-status">
       </a>
       <a class="link" href="firewall-reference.html#function_mysql-firewall-flush-status">
        <code class="literal">
         mysql_firewall_flush_status()
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233715600">
      </a>
      <a class="indexterm" name="idm46045233714480">
      </a>
      <p>
       This function resets several firewall status variables to
              0:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <a class="link" href="firewall-reference.html#statvar_Firewall_access_denied">
           <code class="literal">
            Firewall_access_denied
           </code>
          </a>
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="firewall-reference.html#statvar_Firewall_access_granted">
           <code class="literal">
            Firewall_access_granted
           </code>
          </a>
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="firewall-reference.html#statvar_Firewall_access_suspicious">
           <code class="literal">
            Firewall_access_suspicious
           </code>
          </a>
         </p>
        </li>
       </ul>
      </div>
      <p>
       This function requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege or
              the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa23411782"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> mysql_firewall_flush_status<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="function_normalize-statement">
       </a>
       <a class="link" href="firewall-reference.html#function_normalize-statement">
        <code class="literal">
         normalize_statement(
         <em class="replaceable">
          <code>
           stmt
          </code>
         </em>
         )
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233698480">
      </a>
      <a class="indexterm" name="idm46045233697360">
      </a>
      <p>
       This function normalizes an SQL statement into the digest
              form used for allowlist rules. It requires the
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
       privilege or
              the deprecated
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa18629669"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> normalize_statement<span class="token punctuation">(</span><span class="token string">'SELECT * FROM t1 WHERE c1 &gt; 2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The same digest functionality is available outside
                firewall context using the
        <a class="link" href="encryption-functions.html#function_statement-digest-text">
         <code class="literal">
          STATEMENT_DIGEST_TEXT()
         </code>
        </a>
        SQL function.
       </p>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-system-variables">
       </a>
       MySQL Enterprise Firewall System Variables
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall supports the following system variables. Use them to
          configure firewall operation. These variables are unavailable
          unless the firewall is installed (see
    <a class="xref" href="firewall-installation.html" title="8.4.7.2 Installing or Uninstalling MySQL Enterprise Firewall">
     Section 8.4.7.2, “Installing or Uninstalling MySQL Enterprise Firewall”
    </a>
    ).
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="sysvar_mysql_firewall_database">
       </a>
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_database">
        <code class="literal">
         mysql_firewall_database
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233683584">
      </a>
      <a class="indexterm" name="idm46045233682544">
      </a>
      <div class="informaltable">
       <table frame="box" rules="all" summary="Properties for mysql_firewall_database">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <tbody>
         <tr>
          <th>
           Command-Line Format
          </th>
          <td>
           <code class="literal">
            --mysql-firewall-database[=value]
           </code>
          </td>
         </tr>
         <tr>
          <th>
           System Variable
          </th>
          <td>
           <code class="literal">
            <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_database">
             mysql_firewall_database
            </a>
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Scope
          </th>
          <td>
           Global
          </td>
         </tr>
         <tr>
          <th>
           Dynamic
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
            <code class="literal">
             SET_VAR
            </code>
           </a>
           Hint Applies
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           Type
          </th>
          <td>
           String
          </td>
         </tr>
         <tr>
          <th>
           Default Value
          </th>
          <td>
           <code class="literal">
            mysql
           </code>
          </td>
         </tr>
        </tbody>
       </table>
      </div>
      <p>
       Specifies the database from which MySQL Enterprise Firewall reads data.
              Typically, the
       <code class="literal">
        MYSQL_FIREWALL
       </code>
       server-side plugin stores its internal data (tables,
              stored procedures, and functions) in the
       <code class="literal">
        mysql
       </code>
       system database, but you can
              create and use a custom schema instead (see
       <a class="xref" href="firewall-installation.html#firewall-install" title="Installing MySQL Enterprise Firewall">
        Installing MySQL Enterprise Firewall
       </a>
       ). This variable permits
              specifying an alternative database name at startup.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="sysvar_mysql_firewall_mode">
       </a>
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_mode">
        <code class="literal">
         mysql_firewall_mode
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233655456">
      </a>
      <a class="indexterm" name="idm46045233654416">
      </a>
      <div class="informaltable">
       <table frame="box" rules="all" summary="Properties for mysql_firewall_mode">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <tbody>
         <tr>
          <th>
           Command-Line Format
          </th>
          <td>
           <code class="literal">
            --mysql-firewall-mode[={OFF|ON}]
           </code>
          </td>
         </tr>
         <tr>
          <th>
           System Variable
          </th>
          <td>
           <code class="literal">
            <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_mode">
             mysql_firewall_mode
            </a>
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Scope
          </th>
          <td>
           Global
          </td>
         </tr>
         <tr>
          <th>
           Dynamic
          </th>
          <td>
           Yes
          </td>
         </tr>
         <tr>
          <th>
           <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
            <code class="literal">
             SET_VAR
            </code>
           </a>
           Hint Applies
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           Type
          </th>
          <td>
           Boolean
          </td>
         </tr>
         <tr>
          <th>
           Default Value
          </th>
          <td>
           <code class="literal">
            ON
           </code>
          </td>
         </tr>
        </tbody>
       </table>
      </div>
      <p>
       Whether MySQL Enterprise Firewall is enabled (the default) or disabled.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="sysvar_mysql_firewall_reload_interval_seconds">
       </a>
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_reload_interval_seconds">
        <code class="literal">
         mysql_firewall_reload_interval_seconds
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233629680">
      </a>
      <a class="indexterm" name="idm46045233628592">
      </a>
      <div class="informaltable">
       <table frame="box" rules="all" summary="Properties for mysql_firewall_reload_interval_seconds">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <tbody>
         <tr>
          <th>
           Command-Line Format
          </th>
          <td>
           <code class="literal">
            --mysql-firewall-reload-interval-seconds[=value]
           </code>
          </td>
         </tr>
         <tr>
          <th>
           System Variable
          </th>
          <td>
           <code class="literal">
            <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_reload_interval_seconds">
             mysql_firewall_reload_interval_seconds
            </a>
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Scope
          </th>
          <td>
           Global
          </td>
         </tr>
         <tr>
          <th>
           Dynamic
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
            <code class="literal">
             SET_VAR
            </code>
           </a>
           Hint Applies
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           Type
          </th>
          <td>
           Integer
          </td>
         </tr>
         <tr>
          <th>
           Default Value
          </th>
          <td>
           <code class="literal">
            0
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Minimum Value
          </th>
          <td>
           <code class="literal">
            60 (unless 0: OFF)
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Maximum Value
          </th>
          <td>
           <code class="literal">
            INT_MAX
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Unit
          </th>
          <td>
           seconds
          </td>
         </tr>
        </tbody>
       </table>
      </div>
      <p>
       Specifies the interval (in seconds) that the server-side
              plugin uses to reload its internal cache from firewall
              tables. When
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_reload_interval_seconds">
        <code class="literal">
         mysql_firewall_reload_interval_seconds
        </code>
       </a>
       has a value of zero (the default), no periodic reloading
              of data from tables occurs at runtime. Values between
       <code class="literal">
        0
       </code>
       and
       <code class="literal">
        60
       </code>
       (1 to 59)
              are not acknowledged by the plugin. Instead, these values
              adjust to
       <code class="literal">
        60
       </code>
       automatically.
      </p>
      <p>
       This variable requires that the
       <code class="literal">
        scheduler
       </code>
       component be enabled
              (
       <code class="literal">
        ON
       </code>
       ). For more information, see
       <a class="xref" href="firewall-usage.html#firewall-schedule-reloads" title="Scheduling Firewall Cache Reloads">
        Scheduling Firewall Cache Reloads
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="sysvar_mysql_firewall_trace">
       </a>
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
        <code class="literal">
         mysql_firewall_trace
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233590704">
      </a>
      <a class="indexterm" name="idm46045233589664">
      </a>
      <div class="informaltable">
       <table frame="box" rules="all" summary="Properties for mysql_firewall_trace">
        <colgroup>
         <col style="width: 30%"/>
         <col style="width: 70%"/>
        </colgroup>
        <tbody>
         <tr>
          <th>
           Command-Line Format
          </th>
          <td>
           <code class="literal">
            --mysql-firewall-trace[={OFF|ON}]
           </code>
          </td>
         </tr>
         <tr>
          <th>
           System Variable
          </th>
          <td>
           <code class="literal">
            <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
             mysql_firewall_trace
            </a>
           </code>
          </td>
         </tr>
         <tr>
          <th>
           Scope
          </th>
          <td>
           Global
          </td>
         </tr>
         <tr>
          <th>
           Dynamic
          </th>
          <td>
           Yes
          </td>
         </tr>
         <tr>
          <th>
           <a class="link" href="optimizer-hints.html#optimizer-hints-set-var" title="Variable-Setting Hint Syntax">
            <code class="literal">
             SET_VAR
            </code>
           </a>
           Hint Applies
          </th>
          <td>
           No
          </td>
         </tr>
         <tr>
          <th>
           Type
          </th>
          <td>
           Boolean
          </td>
         </tr>
         <tr>
          <th>
           Default Value
          </th>
          <td>
           <code class="literal">
            OFF
           </code>
          </td>
         </tr>
        </tbody>
       </table>
      </div>
      <p>
       Whether the MySQL Enterprise Firewall trace is enabled or disabled (the
              default). When
       <a class="link" href="firewall-reference.html#sysvar_mysql_firewall_trace">
        <code class="literal">
         mysql_firewall_trace
        </code>
       </a>
       is
              enabled, for
       <code class="literal">
        PROTECTING
       </code>
       mode, the
              firewall writes rejected statements to the error log.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="firewall-status-variables">
       </a>
       MySQL Enterprise Firewall Status Variables
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Firewall supports the following status variables. Use them to
          obtain information about firewall operational status. These
          variables are unavailable unless the firewall is installed
          (see
    <a class="xref" href="firewall-installation.html" title="8.4.7.2 Installing or Uninstalling MySQL Enterprise Firewall">
     Section 8.4.7.2, “Installing or Uninstalling MySQL Enterprise Firewall”
    </a>
    ). Firewall status
          variables are set to 0 whenever the
    <code class="literal">
     MYSQL_FIREWALL
    </code>
    plugin is installed or the
          server is started. Many of them are reset to zero by the
    <a class="link" href="firewall-reference.html#function_mysql-firewall-flush-status">
     <code class="literal">
      mysql_firewall_flush_status()
     </code>
    </a>
    function (see
    <a class="xref" href="firewall-reference.html#firewall-functions" title="MySQL Enterprise Firewall Administrative Functions">
     MySQL Enterprise Firewall Administrative Functions
    </a>
    ).
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="statvar_Firewall_access_denied">
       </a>
       <a class="link" href="firewall-reference.html#statvar_Firewall_access_denied">
        <code class="literal">
         Firewall_access_denied
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233557136">
      </a>
      <a class="indexterm" name="idm46045233556096">
      </a>
      <p>
       The number of statements rejected by MySQL Enterprise Firewall.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="statvar_Firewall_access_granted">
       </a>
       <a class="link" href="firewall-reference.html#statvar_Firewall_access_granted">
        <code class="literal">
         Firewall_access_granted
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233551600">
      </a>
      <a class="indexterm" name="idm46045233550560">
      </a>
      <p>
       The number of statements accepted by MySQL Enterprise Firewall.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="statvar_Firewall_access_suspicious">
       </a>
       <a class="link" href="firewall-reference.html#statvar_Firewall_access_suspicious">
        <code class="literal">
         Firewall_access_suspicious
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233546160">
      </a>
      <a class="indexterm" name="idm46045233545056">
      </a>
      <p>
       The number of statements logged by MySQL Enterprise Firewall as suspicious
              for users who are in
       <code class="literal">
        DETECTING
       </code>
       mode.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="statvar_Firewall_cached_entries">
       </a>
       <a class="link" href="firewall-reference.html#statvar_Firewall_cached_entries">
        <code class="literal">
         Firewall_cached_entries
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045233539792">
      </a>
      <a class="indexterm" name="idm46045233538752">
      </a>
      <p>
       The number of statements recorded by MySQL Enterprise Firewall, including
              duplicates.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
