{"record":{"id":"f1a72b35246003e3","repo":"apache/seatunnel","slug":"snapshot-is-using-user-but-it-likely-doesn-t","errorCode":null,"errorMessage":"Snapshot is using user '{}' but it likely doesn't have proper privileges. If tables are missing or are empty, ensure connector is configured with the correct MySQL user and/or ensure that the MySQL user has the required privileges.","messagePattern":"Snapshot is using user '(.+?)' but it likely doesn't have proper privileges\\. If tables are missing or are empty, ensure connector is configured with the correct MySQL user and/or ensure that the MySQL user has the required privileges\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/legacy/SnapshotReader.java","lineNumber":1149,"sourceCode":"                        }\n                    });\n        } catch (SQLException e) {\n            logger.info(\"Cannot determine MySql server version\", e);\n        }\n    }\n\n    private void logRolesForCurrentUser(JdbcConnection mysql) {\n        try {\n            List<String> grants = new ArrayList<>();\n            mysql.query(\n                    \"SHOW GRANTS FOR CURRENT_USER\",\n                    rs -> {\n                        while (rs.next()) {\n                            grants.add(rs.getString(1));\n                        }\n                    });\n            if (grants.isEmpty()) {\n                logger.warn(\n                        \"Snapshot is using user '{}' but it likely doesn't have proper privileges. \"\n                                + \"If tables are missing or are empty, ensure connector is configured with the correct MySQL user \"\n                                + \"and/or ensure that the MySQL user has the required privileges.\",\n                        mysql.username());\n            } else {\n                logger.info(\n                        \"Snapshot is using user '{}' with these MySQL grants:\", mysql.username());\n                grants.forEach(grant -> logger.info(\"\\t{}\", grant));\n            }\n        } catch (SQLException e) {\n            logger.info(\"Cannot determine the privileges for '{}' \", mysql.username(), e);\n        }\n    }\n\n    /**\n     * Utility method to replace the offset and the source in the given record with the latest. This\n     * is used on the last record produced during the snapshot.\n     *","sourceCodeStart":1131,"sourceCodeEnd":1167,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/legacy/SnapshotReader.java#L1131-L1167","documentation":"This warning is logged by Debezium's SnapshotReader when the SHOW GRANTS query run against the MySQL user configured for the connector returned an empty result set. It means the connector cannot verify that the snapshot user holds the SELECT/RELOAD/LOCK TABLES privileges needed to read the captured tables, so tables may come back missing or empty during snapshotting.","triggerScenarios":"SnapshotReader.execute() runs 'SHOW GRANTS FOR <user>@<host>' (or SHOW GRANTS) via a prepared query with a row handler that accumulates grants into a list; if that list is empty (grants.isEmpty()) the warning fires, logging mysql.username().","commonSituations":"Typo in the username in the seatunnel CDC config; user created without any privileges; SHOW GRANTS returns no rows because the connecting host doesn't match any grant's host pattern; user lacks rights to see its own grants; connecting to the wrong MySQL instance.","solutions":["Verify the username in the CDC source config matches the actual MySQL user: SELECT user, host FROM mysql.user;","Grant the required privileges: GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'user'@'%'; then FLUSH PRIVILEGES;","Check the grant host pattern matches the address the connector connects from (e.g. 'user'@'%' vs 'user'@'10.0.%').","Confirm you are connecting to the intended MySQL server (host/port in config) with mysql -u user -p -h host and run SHOW GRANTS;"],"exampleFix":"// before\nurl = \"jdbc:mysql://localhost:3306/mydb\"\nusername = \"seatunnel\"\n// after\n-- on MySQL server\nCREATE USER 'seatunnel'@'%' IDENTIFIED BY '***';\nGRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'seatunnel'@'%';\nFLUSH PRIVILEGES;","handlingStrategy":"validation","validationCode":"// Before running the CDC job, verify the user's grants:\n// mysql -h host -u user -p -e \"SHOW GRANTS FOR CURRENT_USER();\"\n// Ensure output includes SELECT, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run SHOW GRANTS FOR 'user'@'host' before starting snapshot jobs","Grant SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT on *.* to the CDC user","Match the grant host pattern to the connector's source IP or use '%'","Smoke-test credentials with a plain mysql client against the same host the job uses"],"tags":["mysql","cdc","permissions","snapshot"],"backgroundTag":"permission-denied","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}