Diagnosing Abnormal MySQL Connection Traffic with strace and mysqlslap

Question

I discovered abnormal traffic on a MySQL connection and need to determine which part of the application logic is responsible.

Experiment

First, start a MySQL instance.

We use mysqlslap as the test application.

Assume the connection shows abnormal traffic in MySQL.

Using ss we find the file‑descriptor number of that connection inside mysqlslap .

We then run strace with the options -e desc (trace all syscalls related to file descriptors) and -k (print stack traces) to capture the stack that uses the connection.

The output shows a call on descriptor 3 where mysqlslap performs a drop database operation.

Another stack trace for descriptor 3 shows a create database operation.

We also locate the activity for descriptor 4, which corresponds to the run task phase that applies load to the database; this is the source of the observed abnormal traffic.

Descriptor 3 is used for create/drop database tasks, i.e., test setup and cleanup.

Descriptor 4 is used for the actual workload, and its logic generates the abnormal traffic.

This experiment shows that by finding the connection’s port number, mapping it to a file descriptor, and tracing the stack, you can pinpoint the application logic that causes abnormal traffic.

The method works for C/C++ applications; other languages will require different diagnostic techniques.

Related articles:

How to Quickly Assess IO Latency Impact on MySQL Performance

Why Adjusting System Time Is Discouraged During MySQL Runtime

What Is the Table Definition Cache Used For?

Do you have more MySQL topics you’d like to learn about? Leave a comment for the editor!