{"id":19239492,"url":"https://github.com/monkburger/bpf-mysql-querylog","last_synced_at":"2026-05-08T06:34:22.914Z","repository":{"id":261875437,"uuid":"885512154","full_name":"monkburger/bpf-mysql-querylog","owner":"monkburger","description":"BPF based MySQL query logging tool","archived":false,"fork":false,"pushed_at":"2024-11-12T18:43:30.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-23T14:22:41.936Z","etag":null,"topics":["bcc","bpf","ebpf","ebpf-mysql","mysql"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/monkburger.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-08T18:20:42.000Z","updated_at":"2024-11-12T18:43:35.000Z","dependencies_parsed_at":"2025-01-05T06:01:20.483Z","dependency_job_id":null,"html_url":"https://github.com/monkburger/bpf-mysql-querylog","commit_stats":{"total_commits":9,"total_committers":1,"mean_commits":9.0,"dds":0.0,"last_synced_commit":"d878670c763bc5fddf5afa44bf6cffdd2ba72244"},"previous_names":["monkburger/bpf-mysql-querylog"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/monkburger/bpf-mysql-querylog","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monkburger%2Fbpf-mysql-querylog","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monkburger%2Fbpf-mysql-querylog/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monkburger%2Fbpf-mysql-querylog/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monkburger%2Fbpf-mysql-querylog/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/monkburger","download_url":"https://codeload.github.com/monkburger/bpf-mysql-querylog/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monkburger%2Fbpf-mysql-querylog/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279006916,"owners_count":26084217,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bcc","bpf","ebpf","ebpf-mysql","mysql"],"created_at":"2024-11-09T17:00:21.602Z","updated_at":"2025-10-11T11:02:47.520Z","avatar_url":"https://github.com/monkburger.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"This tool leverages BPF to dynamically attach to MySQL's mysql_execute_command function. By monitoring this function in real-time, it can capture:\n\n- The query text\n- The execution time of the query (in msec)\n- Whether the query was truncated\n- Date/time\n\nThe program is version-aware, meaning it uses offsets specific to each supported MySQL version (5.7, 8.0, 8.4) to access internal MySQL structures. \n\nRequirements\n\n    Python Version: Python 3.6 or higher\n    BPF Library: (bcc) via yum/dnf/apt. \n\nPython Libraries\n\n    argparse\n    subprocess\n    textwrap\n    datetime\n    typing (for type hints)\n    bcc (for BPF support)\n\nGetting Started\n\nClone the Repository:\n\n    git clone https://github.com/your-username/mysql-bpf-query-monitor.git\n    cd mysql-bpf-query-monitor\n\nRun the script:\n\n    python3 mysql_query_monitor.py --path /path/to/mysqld --duration-threshold 10 --log /path/to/output.log\n\nOutput \n\n    Detected MySQL version 8.0 (Using offsets (510, 518))\n    Monitoring MySQL queries... Press Ctrl+C to stop.\n    2024-11-08 14:43:39.299 | Execution Time: 1.22 ms | Length: 92 | Truncated: No | Query: select * from users where id=1;\n    2024-11-08 14:43:41.915 | Execution Time: 4.76 ms | Length: 156 | Truncated: Yes | Query: select * from ...\n\nKnown Limitations\n\n- Offset Compatibility: This tool supports specific MySQL versions (5.7, 8.0, 8.4) and may require updating offsets for other versions. \n- Debugging Symbols: If offsets change across MySQL updates, new offsets will need to be calculated. (See below) \n- Kernel Compatibility: Ensure the kernel version supports BPF and that BPF is configured correctly. All of my testing was performed on AlmaLinux 8+ with MySQL 8.0+\n  \nUpdating Offsets\n\nA quick guide on updating the offsets:\n\n\nRequirements: \n- MySQL debugging symbols\n- GDB\n\nSteps \n- Generate a coredump of a running MySQL process, eg:\n  \n      gcore -o /tmp/mysql_core %d\n\n- Load up the coredump into gdb, eg:\n\n      gdb /usr/sbin/mysqld /tmp/mysql_core\n\n- Get the offsets\n\n      (gdb) python print(\"Detected offsets:\")\n      Detected offsets:\n      (gdb) python print(\"m_query_string.str offset (decimal):\", int(gdb.parse_and_eval(\"\u0026((THD*)0)-\u003em_query_string.str\")))\n      m_query_string.str offset (decimal): 1296\n      (gdb) python print(\"m_query_string.length offset (decimal):\", int(gdb.parse_and_eval(\"\u0026((THD*)0)-\u003em_query_string.length\")))\n      m_query_string.length offset (decimal): 1304\n\n- The numeric values (decimal) can now be added to the code.\n\n\nCredits: \n\nThis code is based off of https://github.com/shuhaowu/mysqld-bpf/blob/master/mysql/trace/mysql_query_tracer.py with signifigant modifications.\n\n    \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonkburger%2Fbpf-mysql-querylog","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmonkburger%2Fbpf-mysql-querylog","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonkburger%2Fbpf-mysql-querylog/lists"}