Skip to content

fix: Database_observability: allow setting limit for mysql query_details #5314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristiangreco merged 1 commit into from
Jan 22, 2026
Merged

fix: Database_observability: allow setting limit for mysql query_details #5314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ...ces/reference/components/database_observability/database_observability.mysql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ The `azure` block supplies the identifying information for the database being mo
| Name | Type | Description | Default | Required |
|--------------------|------------|------------------------------------------------------|---------|----------|
| `collect_interval` | `duration` | How frequently to collect information from database. | `"1m"` | no |
| `statements_limit` | `integer` | Max number of recent queries to collect details for. | `250` | no |

### `schema_details`

Expand Down
10 changes: 8 additions & 2 deletions internal/component/database_observability/mysql/collector/query_details.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,14 @@ const selectQueryTablesSamples = `
query_sample_text
FROM performance_schema.events_statements_summary_by_digest
WHERE last_seen > DATE_SUB(NOW(), INTERVAL 1 DAY)
AND schema_name NOT IN ` + EXCLUDED_SCHEMAS
AND schema_name NOT IN %s
ORDER BY last_seen DESC
LIMIT %d`

type QueryDetailsArguments struct {
DB *sql.DB
CollectInterval time.Duration
StatementsLimit int
EntryHandler loki.EntryHandler

Logger log.Logger
Expand All @@ -44,6 +47,7 @@ type QueryDetailsArguments struct {
type QueryDetails struct {
dbConnection *sql.DB
collectInterval time.Duration
statementsLimit int
entryHandler loki.EntryHandler
sqlParser parser.Parser
normalizer *sqllexer.Normalizer
Expand All @@ -58,6 +62,7 @@ func NewQueryDetails(args QueryDetailsArguments) (*QueryDetails, error) {
c := &QueryDetails{
dbConnection: args.DB,
collectInterval: args.CollectInterval,
statementsLimit: args.StatementsLimit,
entryHandler: args.EntryHandler,
sqlParser: parser.NewTiDBSqlParser(),
normalizer: sqllexer.NewNormalizer(sqllexer.WithCollectTables(true)),
Expand Down Expand Up @@ -115,7 +120,8 @@ func (c *QueryDetails) Stop() {
}

func (c *QueryDetails) tablesFromEventsStatements(ctx context.Context) error {
rs, err := c.dbConnection.QueryContext(ctx, selectQueryTablesSamples)
query := fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, c.statementsLimit)
Copy link
Copy Markdown

@semgrep-code-grafana semgrep-code-grafana Bot Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string-formatted-query.

We're currently testing semgrep's diff-aware PR comment feature on a subset of our repos-- if you run into issues or find this spammy, please reach out to @danny.cooper in slack and give feedback.

For backwards compatability with gosec, its best to use polyglot suppression comments of the following format for false positives:
// #nosec <gosec rule ID> nosemgrep: <semgrep rule ID>

You can view more details about this finding in the Semgrep AppSec Platform.

rs, err := c.dbConnection.QueryContext(ctx, query)
if err != nil {
return fmt.Errorf("failed to fetch summary table samples: %w", err)
}
Expand Down
16 changes: 10 additions & 6 deletions internal/component/database_observability/mysql/collector/query_details_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -371,13 +371,14 @@ func TestQueryTables(t *testing.T) {
collector, err := NewQueryDetails(QueryDetailsArguments{
DB: db,
CollectInterval: time.Second,
StatementsLimit: 250,
EntryHandler: lokiClient,
Logger: log.NewLogfmtLogger(os.Stderr),
})
require.NoError(t, err)
require.NotNil(t, collector)

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().RowsWillBeClosed().
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().RowsWillBeClosed().
WillReturnRows(
sqlmock.NewRows([]string{
"digest",
Expand Down Expand Up @@ -431,21 +432,22 @@ func TestQueryTablesSQLDriverErrors(t *testing.T) {
collector, err := NewQueryDetails(QueryDetailsArguments{
DB: db,
CollectInterval: time.Second,
StatementsLimit: 250,
EntryHandler: lokiClient,
Logger: log.NewLogfmtLogger(os.Stderr),
})
require.NoError(t, err)
require.NotNil(t, collector)

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().RowsWillBeClosed().
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().RowsWillBeClosed().
WillReturnRows(
sqlmock.NewRows([]string{
"digest", // not enough columns
}).AddRow(
"abc123",
))

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().RowsWillBeClosed().
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().RowsWillBeClosed().
WillReturnRows(
sqlmock.NewRows([]string{
"digest",
Expand Down Expand Up @@ -496,13 +498,14 @@ func TestQueryTablesSQLDriverErrors(t *testing.T) {
collector, err := NewQueryDetails(QueryDetailsArguments{
DB: db,
CollectInterval: time.Second,
StatementsLimit: 250,
EntryHandler: lokiClient,
Logger: log.NewLogfmtLogger(os.Stderr),
})
require.NoError(t, err)
require.NotNil(t, collector)

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().RowsWillBeClosed().
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().RowsWillBeClosed().
WillReturnRows(
sqlmock.NewRows([]string{
"digest",
Expand Down Expand Up @@ -558,15 +561,16 @@ func TestQueryTablesSQLDriverErrors(t *testing.T) {
collector, err := NewQueryDetails(QueryDetailsArguments{
DB: db,
CollectInterval: time.Second,
StatementsLimit: 250,
EntryHandler: lokiClient,
Logger: log.NewLogfmtLogger(os.Stderr),
})
require.NoError(t, err)
require.NotNil(t, collector)

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().WillReturnError(fmt.Errorf("connection error"))
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().WillReturnError(fmt.Errorf("connection error"))

mock.ExpectQuery(selectQueryTablesSamples).WithoutArgs().RowsWillBeClosed().
mock.ExpectQuery(fmt.Sprintf(selectQueryTablesSamples, EXCLUDED_SCHEMAS, 250)).WithoutArgs().RowsWillBeClosed().
WillReturnRows(
sqlmock.NewRows([]string{
"digest",
Expand Down
23 changes: 13 additions & 10 deletions internal/component/database_observability/mysql/component.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,8 @@ type Arguments struct {
CloudProvider *CloudProvider `alloy:"cloud_provider,block,optional"`
SetupConsumersArguments SetupConsumersArguments `alloy:"setup_consumers,block,optional"`
SetupActorsArguments SetupActorsArguments `alloy:"setup_actors,block,optional"`
QueryTablesArguments QueryTablesArguments `alloy:"query_details,block,optional"`
SchemaTablesArguments SchemaDetailsArguments `alloy:"schema_details,block,optional"`
QueryDetailsArguments QueryDetailsArguments `alloy:"query_details,block,optional"`
SchemaDetailsArguments SchemaDetailsArguments `alloy:"schema_details,block,optional"`
ExplainPlansArguments ExplainPlansArguments `alloy:"explain_plans,block,optional"`
LocksArguments LocksArguments `alloy:"locks,block,optional"`
QuerySamplesArguments QuerySamplesArguments `alloy:"query_samples,block,optional"`
Expand All @@ -88,8 +88,9 @@ type AzureCloudProviderInfo struct {
ServerName string `alloy:"server_name,attr,optional"`
}

type QueryTablesArguments struct {
type QueryDetailsArguments struct {
CollectInterval time.Duration `alloy:"collect_interval,attr,optional"`
StatementsLimit int `alloy:"statements_limit,attr,optional"`
}

type SchemaDetailsArguments struct {
Expand Down Expand Up @@ -134,11 +135,12 @@ type HealthCheckArguments struct {
var DefaultArguments = Arguments{
AllowUpdatePerfSchemaSettings: false,

QueryTablesArguments: QueryTablesArguments{
QueryDetailsArguments: QueryDetailsArguments{
CollectInterval: 1 * time.Minute,
StatementsLimit: 250,
},

SchemaTablesArguments: SchemaDetailsArguments{
SchemaDetailsArguments: SchemaDetailsArguments{
CollectInterval: 1 * time.Minute,
CacheEnabled: true,
CacheSize: 256,
Expand Down Expand Up @@ -445,7 +447,8 @@ func (c *Component) startCollectors(serverID string, engineVersion string, parse
if collectors[collector.QueryDetailsCollector] {
qtCollector, err := collector.NewQueryDetails(collector.QueryDetailsArguments{
DB: c.dbConnection,
CollectInterval: c.args.QueryTablesArguments.CollectInterval,
CollectInterval: c.args.QueryDetailsArguments.CollectInterval,
StatementsLimit: c.args.QueryDetailsArguments.StatementsLimit,
EntryHandler: entryHandler,
Logger: c.opts.Logger,
})
Expand All @@ -462,10 +465,10 @@ func (c *Component) startCollectors(serverID string, engineVersion string, parse
if collectors[collector.SchemaDetailsCollector] {
stCollector, err := collector.NewSchemaDetails(collector.SchemaDetailsArguments{
DB: c.dbConnection,
CollectInterval: c.args.SchemaTablesArguments.CollectInterval,
CacheEnabled: c.args.SchemaTablesArguments.CacheEnabled,
CacheSize: c.args.SchemaTablesArguments.CacheSize,
CacheTTL: c.args.SchemaTablesArguments.CacheTTL,
CollectInterval: c.args.SchemaDetailsArguments.CollectInterval,
CacheEnabled: c.args.SchemaDetailsArguments.CacheEnabled,
CacheSize: c.args.SchemaDetailsArguments.CacheSize,
CacheTTL: c.args.SchemaDetailsArguments.CacheTTL,
EntryHandler: entryHandler,
Logger: c.opts.Logger,
})
Expand Down
Loading