<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="replication-privilege-checks-recover">
      </a>
      19.3.3.3 Recovering From Failed Replication Privilege Checks
     </h4>
    </div>
   </div>
  </div>
  <p>
   If a privilege check against the
   <code class="literal">
    PRIVILEGE_CHECKS_USER
   </code>
   account fails, the
        transaction is not executed and replication stops for the
        channel. Details of the error and the last applied transaction
        are recorded in the Performance Schema
   <a class="link" href="performance-schema-replication-applier-status-by-worker-table.html" title="29.12.11.7 The replication_applier_status_by_worker Table">
    <code class="literal">
     replication_applier_status_by_worker
    </code>
   </a>
   table. Follow this procedure to recover from the error:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      Identify the replicated event that caused the error and
            verify whether or not the event is expected and from a
            trusted source. You can use
      <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
       <span class="command">
        <strong>
         mysqlbinlog
        </strong>
       </span>
      </a>
      to retrieve and display the events that were logged around
            the time of the error. For instructions to do this, see
      <a class="xref" href="point-in-time-recovery.html" title="9.5 Point-in-Time (Incremental) Recovery">
       Section 9.5, “Point-in-Time (Incremental) Recovery”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      If the replicated event is not expected or is not from a
            known and trusted source, investigate the cause. If you can
            identify why the event took place and there are no security
            considerations, proceed to fix the error as described below.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      account
            should have been permitted to execute the transaction, but
            has been misconfigured, grant the missing privileges to the
            account, use a
      <a class="link" href="flush.html#flush-privileges">
       <code class="literal">
        FLUSH
            PRIVILEGES
       </code>
      </a>
      statement or execute a
      <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
       <span class="command">
        <strong>
         mysqladmin flush-privileges
        </strong>
       </span>
      </a>
      or
      <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
       <span class="command">
        <strong>
         mysqladmin reload
        </strong>
       </span>
      </a>
      command to reload the
            grant tables, then restart replication for the channel.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the transaction needs to be executed and you have
            verified that it is trusted, but the
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      account should not
            have this privilege normally, you can grant the required
            privilege to the
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      account temporarily. After the replicated event has been
            applied, remove the privilege from the account, and take any
            necessary steps to ensure the event does not recur if it is
            avoidable.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the transaction is an administrative action that should
            only have taken place on the source and not on the replica,
            or should only have taken place on a single replication
            group member, skip the transaction on the server or servers
            where it stopped replication, then issue
      <a class="link" href="start-replica.html" title="15.4.2.4 START REPLICA Statement">
       <code class="literal">
        START REPLICA
       </code>
      </a>
      to restart
            replication on the channel. To avoid the situation in
            future, you could issue such administrative statements with
      <code class="literal">
       SET sql_log_bin = 0
      </code>
      before them and
      <code class="literal">
       SET sql_log_bin = 1
      </code>
      after them, so that
            they are not logged on the source.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the transaction is a DDL or DML statement that should not
            have taken place on either the source or the replica, skip
            the transaction on the server or servers where it stopped
            replication, undo the transaction manually on the server
            where it originally took place, then issue
      <a class="link" href="start-replica.html" title="15.4.2.4 START REPLICA Statement">
       <code class="literal">
        START REPLICA
       </code>
      </a>
      to restart
            replication.
     </p>
    </li>
   </ol>
  </div>
  <p>
   To skip a transaction, if GTIDs are in use, commit an empty
        transaction that has the GTID of the failing transaction, for
        example:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa35036198"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> GTID_NEXT<span class="token operator">=</span><span class="token string">'aaa-bbb-ccc-ddd:N'</span><span class="token punctuation">;</span>
<span class="token keyword">BEGIN</span><span class="token punctuation">;</span>
<span class="token keyword">COMMIT</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> GTID_NEXT<span class="token operator">=</span><span class="token string">'AUTOMATIC'</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   If GTIDs are not in use, issue a
   <code class="literal">
    SET GLOBAL
        sql_replica_skip_counter
   </code>
   statement to skip the event.
        For instructions to use this alternative method and more details
        about skipping transactions, see
   <a class="xref" href="replication-administration-skip.html" title="19.1.7.3 Skipping Transactions">
    Section 19.1.7.3, “Skipping Transactions”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
