What Should I Do If I Can't Connect to My TaurusDB Instance?

Possible Causes

Try the following:

1. Check whether the DB instance is available.

   for example, the DB instance status is abnormal.

2. (Common) Check whether the client connection is correct.
   • If you connect to a DB instance over a private network, ensure that the DB instance and ECS are in the same region and VPC.
   • If you connect to a DB instance over a public network, bind an EIP to the DB instance and then connect to the DB instance through the EIP.
3. Check whether the SSL connection is used.

   Run either of the following example commands to enable or disable SSL:

   • SSL enabled: mysql -h 172.16.0.31 -P 3306 -u root -p --ssl-ca=/tmp/ca.pem
   • SSL disabled: mysql -h 172.16.0.31 -P 3306 -u root -p
4. Check whether the parameters in the connection command are correct.

   For example, check whether the following parameters are configured correctly: connection address, port number, username, password, SSL connection parameters, and JDBC connection parameters.

5. (Common) Check whether the network connectivity is normal.
   • For a private network connection:
     1. Check whether the ECS and DB instance are in the same region and VPC.
     2. Check security group rules.
     3. On the ECS, check whether the DB instance port can be connected.
   • For a public network connection:
     1. Check security group rules.
     2. Check network ACL rules.
     3. Ping the affected EIP from another ECS in the same region.
6. (Common) Check whether there are too many connections to the DB instance.

   If there is an excessive number of database connections, applications may be unable to connect.

7. View common connection error messages.

   Find corresponding solutions based on connection error messages.

Fault Locating

Figure 1 Locating instance connection failures

1. Check whether the DB instance is available.

   Check whether the DB instance is in the Available state.

   Possible cause: The DB instance is abnormal.

   Solution: If the DB instance is abnormal, reboot it.

   Figure 2 Checking DB instance status
   

2. Check whether the client connection is correct.

   Install a MySQL 8.0 client.

   For details about how to connect to a DB instance over a private or public network, see Can an External Server Access a TaurusDB Instance?

   Table 1 Connection model

   Connection method	Scenario	Example
   Private network	A private IP address is provided by default. If your applications are deployed on an ECS that is in the same region and VPC as the DB instance, connect to the ECS and DB instance through a private IP address.	mysql -h private_IP_address -P 3306 -u root -p --ssl-ca=/tmp/ca.pem Go to the Basic Information page of the DB instance and view the private IP address in the Network Information area.
   Public network	If you cannot access a DB instance through a private IP address, bind an EIP to the DB instance and connect the instance to the ECS (or a cloud server in a public network) through the EIP. For EIP pricing details, see EIP billing details.	mysql -h EIP -P 3306 -u root -p --ssl-ca=/tmp/ca.pem Go to the Basic Information page of the DB instance and view the EIP in the Network Information area.

3. Check whether the SSL connection is used.
   • (Recommended) Enable SSL for the DB instance, download and decompress the package, and upload the root certificate ca.pem to the /tmp directory of the ECS.

     Example:

     mysql -h 172.16.0.31 -P 3306 -u root -p --ssl-ca=/tmp/ca.pem

     Figure 3 Enabling SSL
     

   • Disable SSL for the DB instance.

     Example:

     mysql -h 172.16.0.31 -P 3306 -u root -p

4. Check whether the parameters in the connection command are correct.

   Ensure that the connection address, port, username and password, and SSL certificate are correct, and try to connect to the DB instance again.

   • Connecting to a DB instance over a private network
     • Connection command

       mysql -h connection_address -P database_port -u username -p --ssl-ca= SSL_certificate_name

       Example:

       mysql -h 192.168.0.153 -P 3306 -u root -p --ssl-ca=/tmp/ca.pem

     • connection_address

       Go to the Basic Information page of the DB instance and view the private IP address in the Network Information area.

       Figure 4 Private IP address
       

     • database_port

       Go to the Basic Information page of the DB instance and view the database port in the Network Information area.

     • username

       Enter root and its password.

       Check whether the username or password is correct if an error similar to the following occurs during the database connection:

       [Warning] Access denied for user 'username'@'yourIp' (using password: NO)
       [Warning] Access denied for user 'username'@'yourIp' (using password: YES)

     • SSL_certificate_name

       Enter the name of the SSL certificate file. The path and file name must be the same as those in the command.

   • Connecting to a DB instance over a public network
     • Connection command

       mysql -h connection_address -P database_port -u username -p --ssl-ca= SSL_certificate_name

       Example:

       mysql -h 10.83.34.224 -P 3306 -u root -p --ssl-ca=/tmp/ca.pem

     • connection_address

       Go to the Basic Information page of the DB instance and view the EIP in the Network Information area.

       Figure 5 EIP
       

     • database_port

       Go to the Basic Information page of the DB instance and view the database port in the Network Information area.

     • username

       Enter root and its password.

       [Warning] Access denied for user 'username'@'yourIp' (using password: NO)
       [Warning] Access denied for user 'username'@'yourIp' (using password: YES)

     • SSL_certificate_name

       Enter the name of the SSL certificate file. The path and file name must be the same as those in the command.

5. Check whether the network connectivity is normal.
   For a private network connection:

   1. Check whether the ECS and DB instance are in the same region and VPC.
      • If the ECS and DB instance are in different regions, they cannot communicate with each other. Select a region near to your service area to reduce network latency and experience faster access. To connect to the DB instance across regions, use Cloud Connect (CC) or Virtual Private Network (VPN). For details, see Can I Access a TaurusDB Instance over an Intranet Connection Across Regions?
      • If the ECS and DB instance are in different VPCs of the same region, they cannot communicate with each other through a private network. After a DB instance is created, you cannot change its VPC. In this case, create a VPC peering connection. For details, see What Should I Do If the Network Connectivity Test Fails?
      Figure 6 Checking the VPC of an ECS
      
      Figure 7 Checking the VPC of a DB instance
      

   2. Check security group rules.
      • If Destination is not 0.0.0.0/0 and Protocol & Port is not All on the Outbound Rules page of the ECS, add the private IP address and port of the DB instance to the outbound rules.
      • Add the private IP address and port of the ECS to the inbound rules of the DB instance.
   3. On the ECS, check whether the private IP address of the DB instance can be connected.

      telnet private_IP_address port

      Example:

      telnet 192.168.0.153 3306

      • If the connection is normal, the network is normal.
      • If the connection is abnormal, submit a service ticket.

   For a public network connection:

   1. Check security group rules.
      • If Destination is not 0.0.0.0/0 and Protocol & Port is not All on the Outbound Rules page of the ECS, add the EIP and port of the DB instance to the outbound rules.
      • Add the EIP and port of the ECS to the inbound rules of the DB instance.
   2. Check network ACL rules.
      1. Go to the Network ACLs page.
      2. Check whether the NIC to which the DB instance and EIP are bound belongs to the subnet associated with the network ACL.
      3. Check whether the network ACL is enabled.

         If it is, add an ICMP rule to allow traffic.

      The default network ACL rule denies all inbound and outbound packets. This default rule is still applied even if the network ACL is disabled.

   3. Ping the affected EIP from another ECS in the same region.

      If you cannot ping the DB instance's EIP from an ECS, ping it from another ECS in the same region. If the EIP can be pinged, the network is normal. In this case, submit a service ticket.

6. Check whether there are too many connections to the DB instance.

   Check method:

   1. Log in to the management console.
   2. Click in the upper left corner and select a region and project.
   3. Click in the upper left corner of the page and choose Databases > TaurusDB.
   4. On the Instances page, locate the DB instance and click Log In in the Operation column.
   5. Enter the password and click Test Connection. After the connection is successful, click Log In to access DAS.
   6. Choose SQL Operations > SQL Query.
   7. Enter the command and click Execute SQL to check the number of instance connections.

      show variables like '%max%connections%';

      

      • max_connections: the maximum number of clients that can be connected at the same time. If this parameter is set to default, the maximum number of clients depends on the amount of memory configured. For details, see What Is the Maximum Number of Connections to a TaurusDB Instance?.
      • max_user_connections: the maximum number of concurrent connections allowed for a specific TaurusDB account.
   8. Check whether the total connections and current active connections have reached the upper limits by referring to Viewing DB Instance Metrics. Determine whether to release the connections.

   Possible cause: If there are too many database connections, applications may be unable to connect, and full and incremental backups may fail, affecting services.

   Solution:

   1. Check whether applications are connected, optimize the connections, and release unnecessary connections.
   2. If this parameter is set to default, you can scale up the DB instance to set max_connections to a larger value. For details, see Changing the vCPUs or Memory of a DB Instance or Node.
   3. Check whether any metrics are abnormal and whether any alarms are generated on the Cloud Eye console. Cloud Eye monitors database metrics, such as the CPU usage, memory usage, storage space usage, and database connections, and allows you to set alarm policies to identify risks if any alarms are generated. For details about the supported metrics, see TaurusDB Metrics.
7. View common connection error messages.

   When you run commands to connect to a DB instance, understanding the error messages can help:

   • ERROR 2013: Lost connection to MySQL server during query

     If the values of wait_timeout and interactive_timeout are too small, the TaurusDB client will automatically disconnect the timeout empty connection. For details, see Client Automatically Disconnected from a DB Instance.

   • ERROR 1045 : Access denied for user 'root'@'192.168.0.30' (using password: YES)

     Check whether the password is correct and whether the ECS has the permission to connect to the DB instance. For details, see "Access denied" Displayed During Database Connection.

   • Error message "SSL routines: tls_early_post_process_client_hello:unsupported protocol"

     Check the TLS version of TaurusDB and upgrade the TLS version of the client. For details, see SSL Connection Failed Due to Inconsistent TLS Versions.

   • Error reported when JDBC is used to connect to the database: "unable to find certification path to requested target"

     The JAR package of MariaDB is used to connect to the database, which is slightly different from the official driver package of MySQL. For details, see Failed to Connect to a Database Using mariadb-connector in SSL Mode.

8. If the problem persists, submit a service ticket.