🚨 Telegraf Error Guide: '[inputs.mysql] Error 1045: Access denied' — Fix MySQL Auth and Grants

Overview

The mysql input opens a connection using a Go DSN and runs status/variable queries. When MySQL rejects the login, the driver returns error 1045 and the plugin logs it verbatim:

2026-07-12T12:00:00Z E! [inputs.mysql] Error in plugin: Error 1045: Access denied for user 'telegraf'@'10.0.0.7' (using password: YES)

A related variant appears when the credentials are accepted but the account lacks the rights to run the plugin’s queries:

E! [inputs.mysql] Error in plugin: Error 1227: Access denied; you need (at least one of) the PROCESS privilege(s) for this operation

Either way, no mysql metrics (connections, queries, InnoDB, replication) are collected from the affected server.

Symptoms

• All mysql metrics are missing for a server while other inputs report normally.
• journalctl -u telegraf repeats Error 1045: Access denied on each collection interval.
• using password: YES confirms a password was sent — so it is wrong, or the account/host is wrong.
• mysql -h 10.0.0.7 -u telegraf -p from the Telegraf host also fails to log in.
• Metrics partially work but replication/process fields are empty (a grant, not a login, problem).

Common Root Causes

• Wrong password in the DSN — using password: YES means a password was sent but did not match the account.
• Host-based user mismatch — the account exists as 'telegraf'@'localhost' but Telegraf connects from 10.0.0.7, matching no 'telegraf'@'10.0.0.%' grant.
• Missing privileges — the login succeeds but the account lacks PROCESS, REPLICATION CLIENT, or SELECT, so status queries fail with 1227.
• Malformed DSN — the Go mysql DSN is not in user:pass@tcp(host:port)/ form, so parsing sends empty or wrong credentials.
• Env var not expanded — ${MYSQL_DSN} is empty because the variable is not present in the Telegraf service environment.
• caching_sha2_password over plaintext — MySQL 8 default auth plugin refuses to send the password without TLS, surfacing as an access-denied/handshake failure.

Diagnostic Workflow

First reproduce the login outside Telegraf from the exact host it connects from. If the mysql client also fails, the problem is the account, not Telegraf:

mysql -h 10.0.0.7 -P 3306 -u telegraf -p -e "SELECT 1"

Check which host patterns the account actually has grants for (run as an admin user):

SELECT user, host FROM mysql.user WHERE user = 'telegraf';
SHOW GRANTS FOR 'telegraf'@'10.0.0.%';

Confirm the DSN env var reaches the service, not just your shell:

sudo systemctl show telegraf -p Environment

Run only the mysql input under debug once the account is fixed:

telegraf --config /etc/telegraf/telegraf.conf --test --input-filter mysql --debug

The input takes a Go-format DSN, kept out of the file via an env var:

[[inputs.mysql]]
  servers = ["${MYSQL_DSN}"]
  gather_process_list = true
  gather_innodb_metrics = true
  gather_slave_status = true

Set the DSN in a systemd EnvironmentFile in the exact Go driver format:

[Service]
Environment=MYSQL_DSN=telegraf:s3cr3t@tcp(10.0.0.7:3306)/?tls=false

Create the account with a host pattern that matches the Telegraf host and grant the minimal privileges the plugin needs:

CREATE USER 'telegraf'@'10.0.0.%' IDENTIFIED BY 's3cr3t';
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'telegraf'@'10.0.0.%';
GRANT SELECT ON performance_schema.* TO 'telegraf'@'10.0.0.%';
FLUSH PRIVILEGES;

Example Root Cause Analysis

A DBA created a monitoring account with CREATE USER 'telegraf'@'localhost' on the primary, tested it locally with mysql -u telegraf -p, and it worked. But Telegraf ran on a separate monitoring host and connected over the network as 'telegraf'@'10.0.0.7', which matched no grant — so MySQL returned Error 1045: Access denied for user 'telegraf'@'10.0.0.7' (using password: YES).

Because using password: YES proved the password was being sent, the team knew the credential was fine and looked at the host component. SELECT user, host FROM mysql.user WHERE user='telegraf' listed only localhost. Recreating the account as 'telegraf'@'10.0.0.%' with PROCESS and REPLICATION CLIENT grants fixed collection instantly. The lesson: in MySQL a user is the pair user@host, and a localhost-only account will always reject a remote monitoring agent even with the right password.

Prevention Best Practices

• Create the monitoring account with a host pattern ('telegraf'@'10.0.0.%') that matches where Telegraf actually runs, not localhost.
• Grant only what the plugin needs — PROCESS, REPLICATION CLIENT, and SELECT on performance_schema — following least privilege.
• Keep the DSN in a systemd EnvironmentFile as ${MYSQL_DSN}; never commit credentials to version control.
• Use the exact Go driver DSN format user:pass@tcp(host:port)/?params; a malformed DSN sends empty credentials.
• For MySQL 8, add tls=true (or a preferred TLS param) so caching_sha2_password can send credentials safely.
• Test with mysql -h <host> -u telegraf -p from the Telegraf host during onboarding to catch host/grant mismatches early.

Quick Command Reference

# Reproduce the login from the Telegraf host
mysql -h 10.0.0.7 -P 3306 -u telegraf -p -e "SELECT 1"

# Confirm the DSN env var reaches the service
sudo systemctl show telegraf -p Environment

# Run only the mysql input with debug
telegraf --config /etc/telegraf/telegraf.conf --test --input-filter mysql --debug

# Inspect the account's host patterns and grants (as admin)
mysql -e "SELECT user, host FROM mysql.user WHERE user='telegraf'"
mysql -e "SHOW GRANTS FOR 'telegraf'@'10.0.0.%'"

Related Guides

• Telegraf SQL Server login failed
• Telegraf InfluxDB 401 unauthorized
• Telegraf HTTP connection refused

More fixes in the Telegraf guides.

Conclusion

[inputs.mysql] Error 1045: Access denied means MySQL rejected the login — and using password: YES tells you a password was sent, so the mismatch is the password, the account’s host pattern, or the DSN format. Reproduce with the mysql client from the Telegraf host, confirm the account exists as 'telegraf'@'10.0.0.%', and grant PROCESS, REPLICATION CLIENT, and SELECT. Keep the DSN in an EnvironmentFile, add TLS for MySQL 8, and metrics will collect cleanly.