<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="connection-control-installation">
      </a>
      8.4.2.1 Connection-Control Plugin Installation
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045242132656">
  </a>
  <a class="indexterm" name="idm46045242131152">
  </a>
  <a class="indexterm" name="idm46045242129664">
  </a>
  <a class="indexterm" name="idm46045242128144">
  </a>
  <p>
   This section describes how to install the connection-control
        plugins,
   <code class="literal">
    CONNECTION_CONTROL
   </code>
   and
   <code class="literal">
    CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
   </code>
   . For
        general information about installing plugins, see
   <a class="xref" href="plugin-loading.html" title="7.6.1 Installing and Uninstalling Plugins">
    Section 7.6.1, “Installing and Uninstalling Plugins”
   </a>
   .
  </p>
  <p>
   To be usable by the server, the plugin library file must be
        located in the MySQL plugin directory (the directory named by
        the
   <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
    <code class="literal">
     plugin_dir
    </code>
   </a>
   system
        variable). If necessary, configure the plugin directory location
        by setting the value of
   <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
    <code class="literal">
     plugin_dir
    </code>
   </a>
   at server startup.
  </p>
  <p>
   The plugin library file base name is
   <code class="literal">
    connection_control
   </code>
   . The file name suffix
        differs per platform (for example,
   <code class="filename">
    .so
   </code>
   for
        Unix and Unix-like systems,
   <code class="filename">
    .dll
   </code>
   for
        Windows).
  </p>
  <p>
   To load the plugins at server startup, use the
   <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
    <code class="option">
     --plugin-load-add
    </code>
   </a>
   option to name
        the library file that contains them. With this plugin-loading
        method, the option must be given each time the server starts.
        For example, put these lines in the server
   <code class="filename">
    my.cnf
   </code>
   file, adjusting the
   <code class="filename">
    .so
   </code>
   suffix for your platform as necessary:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa35213923"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>connection_control.so</span></code></pre>
  </div>
  <p>
   After modifying
   <code class="filename">
    my.cnf
   </code>
   , restart the server
        to cause the new settings to take effect.
  </p>
  <p>
   Alternatively, to load the plugins at runtime, use these
        statements, adjusting the
   <code class="filename">
    .so
   </code>
   suffix for
        your platform as necessary:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa24626543"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">INSTALL</span> <span class="token keyword">PLUGIN</span> CONNECTION_CONTROL
  <span class="token keyword">SONAME</span> <span class="token string">'connection_control.so'</span><span class="token punctuation">;</span>
<span class="token keyword">INSTALL</span> <span class="token keyword">PLUGIN</span> CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
  <span class="token keyword">SONAME</span> <span class="token string">'connection_control.so'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
    <code class="literal">
     INSTALL PLUGIN
    </code>
   </a>
   loads the plugin
        immediately, and also registers it in the
   <code class="literal">
    mysql.plugins
   </code>
   system table to cause the
        server to load it for each subsequent normal startup without the
        need for
   <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
    <code class="option">
     --plugin-load-add
    </code>
   </a>
   .
  </p>
  <p>
   To verify plugin installation, examine the Information Schema
   <a class="link" href="information-schema-plugins-table.html" title="28.3.22 The INFORMATION_SCHEMA PLUGINS Table">
    <code class="literal">
     PLUGINS
    </code>
   </a>
   table or use the
   <a class="link" href="show-plugins.html" title="15.7.7.27 SHOW PLUGINS Statement">
    <code class="literal">
     SHOW PLUGINS
    </code>
   </a>
   statement (see
   <a class="xref" href="obtaining-plugin-information.html" title="7.6.2 Obtaining Server Plugin Information">
    Section 7.6.2, “Obtaining Server Plugin Information”
   </a>
   ). For example:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa35867110"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> PLUGIN_NAME<span class="token punctuation">,</span> PLUGIN_STATUS
       <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span><span class="token keyword">PLUGINS</span>
       <span class="token keyword">WHERE</span> PLUGIN_NAME <span class="token operator">LIKE</span> <span class="token string">'connection%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> PLUGIN_NAME                              <span class="token punctuation">|</span> PLUGIN_STATUS <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> CONNECTION_CONTROL                       <span class="token punctuation">|</span> ACTIVE        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS <span class="token punctuation">|</span> ACTIVE        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
  </div>
  <p>
   If a plugin fails to initialize, check the server error log for
        diagnostic messages.
  </p>
  <p>
   If the plugins have been previously registered with
   <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
    <code class="literal">
     INSTALL PLUGIN
    </code>
   </a>
   or are loaded with
   <a class="link" href="server-options.html#option_mysqld_plugin-load-add">
    <code class="option">
     --plugin-load-add
    </code>
   </a>
   , you can use
        the
   <code class="option">
    --connection-control
   </code>
   and
   <code class="option">
    --connection-control-failed-login-attempts
   </code>
   options at server startup to control plugin activation. For
        example, to load the plugins at startup and prevent them from
        being removed at runtime, use these options:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa13300292"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>connection_control.so</span>
<span class="token constant">connection-control</span><span class="token attr-value"><span class="token punctuation">=</span>FORCE_PLUS_PERMANENT</span>
<span class="token constant">connection-control-failed-login-attempts</span><span class="token attr-value"><span class="token punctuation">=</span>FORCE_PLUS_PERMANENT</span></code></pre>
  </div>
  <p>
   If it is desired to prevent the server from running without a
        given connection-control plugin, use an option value of
   <code class="literal">
    FORCE
   </code>
   or
   <code class="literal">
    FORCE_PLUS_PERMANENT
   </code>
   to force server startup
        to fail if the plugin does not initialize successfully.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    It is possible to install one plugin without the other, but
          both must be installed for full connection-control capability.
          In particular, installing only the
    <code class="literal">
     CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
    </code>
    plugin is of little use because, without the
    <code class="literal">
     CONNECTION_CONTROL
    </code>
    plugin to provide the
          data that populates the
    <a class="link" href="information-schema-connection-control-failed-login-attempts-table.html" title="28.6.2 The INFORMATION_SCHEMA CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS Table">
     <code class="literal">
      CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
     </code>
    </a>
    table, the table is always empty.
   </p>
  </div>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="connection-control-installation.html#connection-control-plugin-delay-configuration" title="Connection Delay Configuration">
       Connection Delay Configuration
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="connection-control-installation.html#connection-control-plugin-failure-assessment" title="Connection Failure Assessment">
       Connection Failure Assessment
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="connection-control-installation.html#connection-control-plugin-failure-monitoring" title="Connection Failure Monitoring">
       Connection Failure Monitoring
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="connection-control-plugin-delay-configuration">
       </a>
       Connection Delay Configuration
      </h5>
     </div>
    </div>
   </div>
   <p>
    To enable configuring its operation, the
    <code class="literal">
     CONNECTION_CONTROL
    </code>
    plugin exposes these
          system variables:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
        <code class="literal">
         connection_control_failed_connections_threshold
        </code>
       </a>
       :
              The number of consecutive failed connection attempts
              permitted to accounts before the server adds a delay for
              subsequent connection attempts. To disable
              failed-connection counting, set
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
        <code class="literal">
         connection_control_failed_connections_threshold
        </code>
       </a>
       to zero.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       :
              The minimum delay in milliseconds for connection failures
              above the threshold.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       :
              The maximum delay in milliseconds for connection failures
              above the threshold.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
     <code class="literal">
      connection_control_failed_connections_threshold
     </code>
    </a>
    is nonzero, failed-connection counting is enabled and has
          these properties:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The delay is zero up through
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
        <code class="literal">
         connection_control_failed_connections_threshold
        </code>
       </a>
       consecutive failed connection attempts.
      </p>
     </li>
     <li class="listitem">
      <p>
       Thereafter, the server adds an increasing delay for
              subsequent consecutive attempts, until a successful
              connection occurs. The initial unadjusted delays begin at
              1000 milliseconds (1 second) and increase by 1000
              milliseconds per attempt. That is, once delay has been
              activated for an account, the unadjusted delays for
              subsequent failed attempts are 1000 milliseconds, 2000
              milliseconds, 3000 milliseconds, and so forth.
      </p>
     </li>
     <li class="listitem">
      <p>
       The actual delay experienced by a client is the unadjusted
              delay, adjusted to lie within the values of the
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       and
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       system variables, inclusive.
      </p>
     </li>
     <li class="listitem">
      <p>
       Once delay has been activated for an account, the first
              successful connection thereafter by the account also
              experiences a delay, but failure counting is reset for
              subsequent connections.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For example, with the default
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
     <code class="literal">
      connection_control_failed_connections_threshold
     </code>
    </a>
    value of 3, there is no delay for the first three consecutive
          failed connection attempts by an account. The actual adjusted
          delays experienced by the account for the fourth and
          subsequent failed connections depend on the
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
     <code class="literal">
      connection_control_min_connection_delay
     </code>
    </a>
    and
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
     <code class="literal">
      connection_control_max_connection_delay
     </code>
    </a>
    values:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       and
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       are 1000 and 20000, the adjusted delays are the same as
              the unadjusted delays, up to a maximum of 20000
              milliseconds. The fourth and subsequent failed connections
              are delayed by 1000 milliseconds, 2000 milliseconds, 3000
              milliseconds, and so forth.
      </p>
     </li>
     <li class="listitem">
      <p>
       If
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       and
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       are 1500 and 20000, the adjusted delays for the fourth and
              subsequent failed connections are 1500 milliseconds, 2000
              milliseconds, 3000 milliseconds, and so forth, up to a
              maximum of 20000 milliseconds.
      </p>
     </li>
     <li class="listitem">
      <p>
       If
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       and
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       are 2000 and 3000, the adjusted delays for the fourth and
              subsequent failed connections are 2000 milliseconds, 2000
              milliseconds, and 3000 milliseconds, with all subsequent
              failed connections also delayed by 3000 milliseconds.
      </p>
     </li>
    </ul>
   </div>
   <p>
    You can set the
    <code class="literal">
     CONNECTION_CONTROL
    </code>
    system
          variables at server startup or runtime. Suppose that you want
          to permit four consecutive failed connection attempts before
          the server starts delaying its responses, with a minimum delay
          of 2000 milliseconds. To set the relevant variables at server
          startup, put these lines in the server
    <code class="filename">
     my.cnf
    </code>
    file:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa77131483"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">plugin-load-add</span><span class="token attr-value"><span class="token punctuation">=</span>connection_control.so</span>
<span class="token constant">connection_control_failed_connections_threshold</span><span class="token attr-value"><span class="token punctuation">=</span>4</span>
<span class="token constant">connection_control_min_connection_delay</span><span class="token attr-value"><span class="token punctuation">=</span>2000</span></code></pre>
   </div>
   <p>
    To set and persist the variables at runtime, use these
          statements:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa19331394"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> connection_control_failed_connections_threshold <span class="token operator">=</span> <span class="token number">4</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token keyword">PERSIST</span> connection_control_min_connection_delay <span class="token operator">=</span> <span class="token number">2000</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     <code class="literal">
      SET
          PERSIST
     </code>
    </a>
    sets a value for the running MySQL instance.
          It also saves the value, causing it to carry over to
          subsequent server restarts. To change a value for the running
          MySQL instance without having it carry over to subsequent
          restarts, use the
    <code class="literal">
     GLOBAL
    </code>
    keyword rather
          than
    <code class="literal">
     PERSIST
    </code>
    . See
    <a class="xref" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     Section 15.7.6.1, “SET Syntax for Variable Assignment”
    </a>
    .
   </p>
   <p>
    The
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
     <code class="literal">
      connection_control_min_connection_delay
     </code>
    </a>
    and
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
     <code class="literal">
      connection_control_max_connection_delay
     </code>
    </a>
    system variables both have minimum and maximum values of 1000
          and 2147483647. In addition, the permitted range of values of
          each variable also depends on the current value of the other:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       cannot be set greater than the current value of
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
        <code class="literal">
         connection_control_max_connection_delay
        </code>
       </a>
       cannot be set less than the current value of
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
        <code class="literal">
         connection_control_min_connection_delay
        </code>
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    Thus, to make the changes required for some configurations,
          you might need to set the variables in a specific order.
          Suppose that the current minimum and maximum delays are 1000
          and 2000, and that you want to set them to 3000 and 5000. You
          cannot first set
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
     <code class="literal">
      connection_control_min_connection_delay
     </code>
    </a>
    to 3000 because that is greater than the current
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
     <code class="literal">
      connection_control_max_connection_delay
     </code>
    </a>
    value of 2000. Instead, set
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_max_connection_delay">
     <code class="literal">
      connection_control_max_connection_delay
     </code>
    </a>
    to 5000, then set
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_min_connection_delay">
     <code class="literal">
      connection_control_min_connection_delay
     </code>
    </a>
    to 3000.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="connection-control-plugin-failure-assessment">
       </a>
       Connection Failure Assessment
      </h5>
     </div>
    </div>
   </div>
   <p>
    When the
    <code class="literal">
     CONNECTION_CONTROL
    </code>
    plugin is
          installed, it checks connection attempts and tracks whether
          they fail or succeed. For this purpose, a failed connection
          attempt is one for which the client user and host match a
          known MySQL account but the provided credentials are
          incorrect, or do not match any known account.
   </p>
   <p>
    Failed-connection counting is based on the user/host
          combination for each connection attempt. Determination of the
          applicable user name and host name takes proxying into account
          and occurs as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If the client user proxies another user, the account for
              failed-connection counting is the proxying user, not the
              proxied user. For example, if
       <code class="literal">
        external_user@example.com
       </code>
       proxies
       <code class="literal">
        proxy_user@example.com
       </code>
       , connection
              counting uses the proxying user,
       <code class="literal">
        external_user@example.com
       </code>
       , rather than
              the proxied user,
       <code class="literal">
        proxy_user@example.com
       </code>
       . Both
       <code class="literal">
        external_user@example.com
       </code>
       and
       <code class="literal">
        proxy_user@example.com
       </code>
       must have valid
              entries in the
       <code class="literal">
        mysql.user
       </code>
       system table
              and a proxy relationship between them must be defined in
              the
       <code class="literal">
        mysql.proxies_priv
       </code>
       system table
              (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       If the client user does not proxy another user, but does
              match a
       <code class="literal">
        mysql.user
       </code>
       entry, counting uses
              the
       <a class="link" href="information-functions.html#function_current-user">
        <code class="literal">
         CURRENT_USER()
        </code>
       </a>
       value
              corresponding to that entry. For example, if a user
       <code class="literal">
        user1
       </code>
       connecting from a host
       <code class="literal">
        host1.example.com
       </code>
       matches a
       <code class="literal">
        user1@host1.example.com
       </code>
       entry, counting
              uses
       <code class="literal">
        user1@host1.example.com
       </code>
       . If the
              user matches a
       <code class="literal">
        user1@%.example.com
       </code>
       ,
       <code class="literal">
        user1@%.com
       </code>
       , or
       <code class="literal">
        user1@%
       </code>
       entry instead, counting uses
       <code class="literal">
        user1@%.example.com
       </code>
       ,
       <code class="literal">
        user1@%.com
       </code>
       , or
       <code class="literal">
        user1@%
       </code>
       , respectively.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For the cases just described, the connection attempt matches
          some
    <code class="literal">
     mysql.user
    </code>
    entry, and whether the
          request succeeds or fails depends on whether the client
          provides the correct authentication credentials. For example,
          if the client presents an incorrect password, the connection
          attempt fails.
   </p>
   <p>
    If the connection attempt matches no
    <code class="literal">
     mysql.user
    </code>
    entry, the attempt fails. In
          this case, no
    <a class="link" href="information-functions.html#function_current-user">
     <code class="literal">
      CURRENT_USER()
     </code>
    </a>
    value is available and connection-failure counting uses the
          user name provided by the client and the client host as
          determined by the server. For example, if a client attempts to
          connect as user
    <code class="literal">
     user2
    </code>
    from host
    <code class="literal">
     host2.example.com
    </code>
    , the user name part is
          available in the client request and the server determines the
          host information. The user/host combination used for counting
          is
    <code class="literal">
     user2@host2.example.com
    </code>
    .
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The server maintains information about which client hosts
            can possibly connect to the server (essentially the union of
            host values for
     <code class="literal">
      mysql.user
     </code>
     entries). If a
            client attempts to connect from any other host, the server
            rejects the attempt at an early stage of connection setup:
    </p>
    <div class="copytoclipboard-wrapper">
     <pre class="programlisting language-none"><div class="docs-select-all right" id="sa14216421"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">ERROR 1130 (HY000): Host '<em class="replaceable">host_name</em>' is not
allowed to connect to this MySQL server</code></pre>
    </div>
    <p>
     Because this type of rejection occurs so early,
     <code class="literal">
      CONNECTION_CONTROL
     </code>
     does not see it, and
            does not count it.
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="connection-control-plugin-failure-monitoring">
       </a>
       Connection Failure Monitoring
      </h5>
     </div>
    </div>
   </div>
   <p>
    To monitor failed connections, use these information sources:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <a class="link" href="connection-control-variables.html#statvar_Connection_control_delay_generated">
        <code class="literal">
         Connection_control_delay_generated
        </code>
       </a>
       status variable indicates the number of times the server
              added a delay to its response to a failed connection
              attempt. This does not count attempts that occur before
              reaching the threshold defined by the
       <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
        <code class="literal">
         connection_control_failed_connections_threshold
        </code>
       </a>
       system variable.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        INFORMATION_SCHEMA
       </code>
       <a class="link" href="information-schema-connection-control-failed-login-attempts-table.html" title="28.6.2 The INFORMATION_SCHEMA CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS Table">
        <code class="literal">
         CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
        </code>
       </a>
       table provides information about the current number of
              consecutive failed connection attempts per account
              (user/host combination). This counts all failed attempts,
              regardless of whether they were delayed.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Assigning a value to
    <a class="link" href="connection-control-variables.html#sysvar_connection_control_failed_connections_threshold">
     <code class="literal">
      connection_control_failed_connections_threshold
     </code>
    </a>
    at runtime has these effects:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       All accumulated failed-connection counters are reset to
              zero.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="connection-control-variables.html#statvar_Connection_control_delay_generated">
        <code class="literal">
         Connection_control_delay_generated
        </code>
       </a>
       status variable is reset to zero.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="information-schema-connection-control-failed-login-attempts-table.html" title="28.6.2 The INFORMATION_SCHEMA CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS Table">
        <code class="literal">
         CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS
        </code>
       </a>
       table becomes empty.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
