{"id":14263,"date":"2025-12-30T11:25:15","date_gmt":"2025-12-30T05:55:15","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=14263"},"modified":"2026-09-07T11:13:17","modified_gmt":"2026-09-07T05:43:17","slug":"monitor-secure-mariadb-on-linux","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/monitor-secure-mariadb-on-linux\/","title":{"rendered":"How to Monitor &amp; Secure MariaDB on Linux Server in 2026?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>To monitor and secure MariaDB on a Linux<\/strong> server, track health metrics (uptime, connections, queries, replication), log and slow queries, and set alerts. Then harden configuration: least-privilege users, TLS, firewall, Fail2ban, SELinux\/AppArmor, backups, and auditing. Use tools like mysqld_exporter with Prometheus\/Grafana or PMM for visibility and alerts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monitoring and securing MariaDB on a Linux server keeps your database fast, recoverable, and safe from attacks. In this guide, you\u2019ll learn practical, step-by-step methods to monitor performance and harden security with industry-recommended settings, commands, and checklists\u2014using simple tools available on most Linux distributions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a Senior Technical SEO <a href=\"https:\/\/www.youstable.com\/blog\/how-to-become-a-content-writer\/\">C<strong>ontent Writer<\/strong><\/a> at YouStable, I\u2019ll combine real-world server experience with beginner-friendly explanations so you can confidently deploy, monitor, and secure MariaDB on production Linux servers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"what-youll-monitor-and-secure-scope-and-goals\"><strong>What You\u2019ll Monitor and Secure (Scope &amp; Goals)<\/strong>?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Primary goal: reliably monitor MariaDB health and secure it against unauthorized access and data loss. Secondary goal: ensure traceability (auditing) and compliance-friendly logging. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"533\" src=\"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/image-103.png\" alt=\"Monitor &amp; Secure MariaDB on Linux\" class=\"wp-image-14366\" srcset=\"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/image-103.png 800w, https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/image-103-150x100.png 150w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Here\u2019s the scope:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Monitoring:<\/strong> uptime, connections, threads, slow queries, locks, replication, disk, memory, CPU<\/li>\n\n\n\n<li><strong>Security: <\/strong>least privilege, strong auth, firewall, TLS (in transit), encryption at rest, SELinux\/AppArmor<\/li>\n\n\n\n<li><strong>Protection:<\/strong> brute-force blocking (Fail2ban), patching, configuration hardening<\/li>\n\n\n\n<li><strong>Resilience:<\/strong> backups, restores, disaster recovery testing<\/li>\n\n\n\n<li><strong>Audit:<\/strong> track who did what and when with audit logs<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"prerequisites-linux-plus-mariadb-basics\"><strong>Prerequisites (Linux + MariaDB Basics)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Linux server with sudo access (Ubuntu\/Debian\/Rocky\/Alma\/CentOS)<\/li>\n\n\n\n<li>MariaDB 10.5+ (or latest LTS)<\/li>\n\n\n\n<li>Shell access and basic SQL familiarity<\/li>\n\n\n\n<li>Optional: Prometheus\/Grafana, or Percona Monitoring and Management (PMM)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"monitor-mariadb-health-and-performance\"><strong>Monitor MariaDB Health &amp; Performance<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"quick-health-checks-built-in-commands\"><strong>Quick Health Checks (Built-in Commands)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start with essential status insights. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run these as a privileged MariaDB user:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Server status\nmysql -u root -p -e \"SHOW GLOBAL STATUS LIKE 'Uptime';\"\nmysql -u root -p -e \"SHOW GLOBAL STATUS LIKE 'Threads_connected';\"\nmysql -u root -p -e \"SHOW GLOBAL STATUS LIKE 'Questions';\"\n\n# InnoDB\/row activity and locks\nmysql -u root -p -e \"SHOW ENGINE INNODB STATUSG\"\n\n# Slow queries (enable slow query log first)\nmysql -u root -p -e \"SHOW GLOBAL STATUS LIKE 'Slow_queries';\"\n\n# Replication (if used)\nmysql -u root -p -e \"SHOW SLAVE STATUSG\"  # or SHOW REPLICA STATUSG<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"monitor-logs-error-and-slow-query-logs\"><strong>Monitor Logs (Error &amp; Slow Query Logs)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enable logging in your MariaDB configuration (usually \/etc\/mysql\/mariadb.conf.d\/50-server.cnf or \/etc\/my.cnf):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;mysqld]\nlog_error                  = \/var\/log\/mysql\/error.log\nslow_query_log             = 1\nslow_query_log_file        = \/var\/log\/mysql\/mariadb-slow.log\nlong_query_time            = 1\nlog_queries_not_using_indexes = 0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Check logs regularly:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -f \/var\/log\/mysql\/error.log\nsudo tail -f \/var\/log\/mysql\/mariadb-slow.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Summarize slow queries with Percona Toolkit:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install percona-toolkit -y  # or yum install percona-toolkit\npt-query-digest \/var\/log\/mysql\/mariadb-slow.log | less<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"metrics-and-alerting-with-prometheus-plus-grafana\"><strong>Metrics &amp; Alerting with Prometheus + Grafana<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Export MariaDB metrics with mysqld_exporter and visualize in Grafana. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Example install (Ubuntu):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Create monitoring user\nmysql -u root -p -e \"CREATE USER 'mysqld_exporter'@'localhost' IDENTIFIED BY 'StrongPass!';\"\nmysql -u root -p -e \"GRANT PROCESS, REPLICATION CLIENT, SELECT ON *.* TO 'mysqld_exporter'@'localhost'; FLUSH PRIVILEGES;\"\n\n# Download exporter (adjust version)\ncd \/tmp\ncurl -LO https:\/\/github.com\/prometheus\/mysqld_exporter\/releases\/download\/v0.15.1\/mysqld_exporter-0.15.1.linux-amd64.tar.gz\ntar xzf mysqld_exporter-*.tar.gz\nsudo mv mysqld_exporter-*\/mysqld_exporter \/usr\/local\/bin\/\n\n# Systemd service\nsudo bash -c 'cat &gt;\/etc\/systemd\/system\/mysqld_exporter.service &lt;&lt;EOF\n&#91;Unit]\nDescription=Prometheus MySQL Exporter\nAfter=network.target\n\n&#91;Service]\nUser=nobody\nEnvironment=\"DATA_SOURCE_NAME=mysqld_exporter:StrongPass!@(localhost:3306)\/\"\nExecStart=\/usr\/local\/bin\/mysqld_exporter\nRestart=always\n\n&#91;Install]\nWantedBy=multi-user.target\nEOF'\nsudo systemctl daemon-reload\nsudo systemctl enable --now mysqld_exporter\n\n# Scrape in Prometheus (prometheus.yml)\n# - job_name: 'mysql'\n#   static_configs:\n#   - targets: &#91;'server-ip:9104']<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Create Grafana dashboards from the community or PMM dashboards to alert on spikes in Queries, Threads_connected, Handler_read*, and InnoDB rows.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"lightweight-alternatives\"><strong>Lightweight Alternatives<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Percona Monitoring and Management (PMM):<\/strong> turnkey, includes exporters and dashboards<\/li>\n\n\n\n<li><strong>Monit\/Netdata:<\/strong> easy Linux-level and service checks<\/li>\n\n\n\n<li><strong>Cron + mailx:<\/strong> run SHOW STATUS and log anomalies for simple setups<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"secure-mariadb-configuration-hardening\"><strong>Secure MariaDB Configuration (Hardening)<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"run-mysql_secure_installation\"><strong>Run mysql_secure_installation<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo mysql_secure_installation\n# Set\/validate root password, remove anonymous users,\n# disallow remote root login, remove test DB, reload privileges<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"apply-least-privilege-users-and-strong-authentication\"><strong>Apply Least Privilege Users and Strong Authentication<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Example: app user with only needed privileges\nCREATE USER 'appuser'@'10.0.0.%' IDENTIFIED BY 'Ultra$trongP4ss';\nGRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'appuser'@'10.0.0.%';\nFLUSH PRIVILEGES;\n\n# Lock down root to localhost only\nALTER USER 'root'@'localhost' IDENTIFIED BY 'EvenStronger!Passw0rd';\nDROP USER IF EXISTS 'root'@'%';<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Prefer socket or PAM auth on hosts where that fits security policy. Rotate passwords, and disable unused accounts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"restrict-network-exposure-bind-and-firewall\"><strong>Restrict Network Exposure (Bind &amp; Firewall)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Bind locally or to a private interface\n&#91;mysqld]\nbind-address = 127.0.0.1   # or private IP only\nport = 3306<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code># UFW (Ubuntu\/Debian) - allow only trusted sources\nsudo ufw allow from 10.0.0.0\/24 to any port 3306 proto tcp\nsudo ufw deny 3306\/tcp\n\n# firewalld (RHEL\/Rocky\/Alma)\nsudo firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"10.0.0.0\/24\" port protocol=\"tcp\" port=\"3306\" accept'\nsudo firewall-cmd --permanent --add-port=3306\/tcp --remove # block others\nsudo firewall-cmd --reload<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"enforce-tls-for-client-connections\"><strong>Enforce TLS for Client Connections<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.youstable.com\/blog\/fix-cpanel-on-linux\/\">Issue a server certificate and require SSL<\/a> for client users. In my.cnf:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;mysqld]\nssl_cert=\/etc\/mysql\/ssl\/server.crt\nssl_key=\/etc\/mysql\/ssl\/server.key\nssl_ca=\/etc\/mysql\/ssl\/ca.crt<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code># Require SSL for critical users\nALTER USER 'appuser'@'10.0.0.%' REQUIRE SSL;<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"secure-defaults-sql-modes-file-access-error-visibility\"><strong>Secure Defaults (SQL Modes, File Access, Error Visibility)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;mysqld]\n# Safer SQL behavior\nsql_mode = STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION\n\n# Restrict file operations\nsecure_file_priv = \/var\/lib\/mysql-files\n\n# Reduce noisy info leaks\nlog_warnings = 2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"enable-selinux-apparmor-and-correct-file-permissions\"><strong>Enable SELinux\/AppArmor and Correct File Permissions<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SELinux:<\/strong> keep enforcing; use semanage fcontext and restorecon for custom paths<\/li>\n\n\n\n<li><strong>AppArmor:<\/strong> ensure mysqld profile restricts filesystem access<\/li>\n\n\n\n<li><strong>Permissions: <\/strong>data dir owned by mysql:mysql; 600 on creds and keys<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"block-brute-force-and-abuse\"><strong>Block Brute Force &amp; Abuse<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"fail2ban-for-mariadb\"><strong>Fail2ban for MariaDB<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Parse error logs and ban IPs with repeated authentication failures.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \/etc\/fail2ban\/filter.d\/mariadb-auth.conf\n&#91;Definition]\nfailregex = ^.*Access denied for user '.*'@&lt;HOST&gt;.*$\nignoreregex =<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code># \/etc\/fail2ban\/jail.local\n&#91;mariadb-auth]\nenabled  = true\nport     = 3306\nfilter   = mariadb-auth\nlogpath  = \/var\/log\/mysql\/error.log\nmaxretry = 5\nbantime  = 1h<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart fail2ban\nsudo fail2ban-client status mariadb-auth<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"connection-hygiene\"><strong>Connection Hygiene<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;mysqld]\nmax_connections = 200\nmax_connect_errors = 1000\nwait_timeout = 300\ninteractive_timeout = 300\nconnection_control = FORCE_PLUS_PERMANENT  # MariaDB plugin (if available)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use host-based access (GRANT to specific subnets only) and avoid wildcard (%) hosts in production.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"backups-restores-and-disaster-recovery\"><strong>Backups, Restores, and Disaster Recovery<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"logical-backups-mariadb-dump\"><strong>Logical Backups (mariadb-dump)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Full logical backup with compression and encryption\nmariadb-dump --all-databases --routines --triggers --events --single-transaction \n  | gzip | openssl enc -aes-256-cbc -salt -pass pass:\"$BACKUP_PASS\" \n  &gt; \/backups\/mariadb-$(date +%F).sql.gz.enc<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"physical-backups-mariabackup\"><strong>Physical Backups (mariabackup)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Backup\nmariabackup --backup --target-dir=\/backups\/full-$(date +%F) --user=root --password=...\n\n# Prepare\nmariabackup --prepare --target-dir=\/backups\/full-2025-01-01\n\n# Restore (service stopped)\nsystemctl stop mariadb\nrsync -avrP \/backups\/full-2025-01-01\/ \/var\/lib\/mysql\/\nchown -R mysql:mysql \/var\/lib\/mysql\nsystemctl start mariadb<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"rotation-offsite-and-test-restores\"><strong>Rotation, Offsite, and Test Restores<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>3-2-1 rule:<\/strong> 3 copies, 2 media types, 1 offsite<\/li>\n\n\n\n<li>Automate daily incremental + weekly full backups<\/li>\n\n\n\n<li>Regularly test restores in a staging server<\/li>\n\n\n\n<li>Encrypt at rest and in transit to object storage (S3, Backblaze)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"auditing-and-compliance\"><strong>Auditing and Compliance<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"mariadb-audit-plugin\"><strong>MariaDB Audit Plugin<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Track logins and queries for accountability. Enable the plugin and define a sane policy:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>INSTALL SONAME 'server_audit';\nSET GLOBAL server_audit_logging = ON;\nSET GLOBAL server_audit_events = 'CONNECT,QUERY_DDL,QUERY_DML';\nSET GLOBAL server_audit_file_path = '\/var\/log\/mysql\/mariadb-audit.log';\nSET GLOBAL server_audit_file_rotate_size = 104857600;  # 100MB\nSET GLOBAL server_audit_file_rotations = 10;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Protect logs with strict permissions and rotate with logrotate to avoid disk pressure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ongoing-maintenance-checklist\"><strong>Ongoing Maintenance Checklist<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apply security updates to OS and MariaDB regularly<\/li>\n\n\n\n<li>Review slow query reports weekly; index or optimize offenders<\/li>\n\n\n\n<li>Audit user accounts and privileges monthly<\/li>\n\n\n\n<li>Verify backups and run test restores quarterly<\/li>\n\n\n\n<li>Watch disk I\/O and space; alert at 75% capacity<\/li>\n\n\n\n<li>Rotate and archive logs; verify audit trails<\/li>\n\n\n\n<li>Reassess firewall rules and TLS certificates before expiry<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"common-pitfalls-to-avoid\"><strong>Common Pitfalls to Avoid<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exposing port 3306 to the public internet<\/li>\n\n\n\n<li>Using wildcard (%) hosts for admin accounts<\/li>\n\n\n\n<li>Skipping SSL\/TLS because \u201cit\u2019s on a private network\u201d<\/li>\n\n\n\n<li>Relying on untested backups<\/li>\n\n\n\n<li>Ignoring slow queries until latency impacts users<\/li>\n\n\n\n<li>Storing credentials in world-readable scripts<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"how-youstable-can-help\"><strong>How YouStable Can Help<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019d rather not juggle exporters, firewalls, TLS, and backups, YouStable\u2019s managed server team can implement a full MariaDB monitoring and security baseline for you. We deploy best-practice configs, 24\/7 proactive monitoring, alerts, backup automation, and periodic audits\u2014so your databases stay fast, compliant, and recoverable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs\"><strong>FAQ&#8217;s<\/strong><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1765950204331\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"1-u003cstrongu003ehow-do-i-check-if-mariadb-is-healthy-on-linuxu003c-strongu003e\">1. u003cstrongu003eHow do I check if MariaDB is healthy on Linux?u003c\/strongu003e<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Verify the service, connections, and errors. Use systemctl status mariadb, SHOW GLOBAL STATUS for Threads_connected and Uptime, and tail -f \/var\/log\/mysql\/error.log. For deeper visibility, enable the slow query log and deploy mysqld_exporter + Prometheus\/Grafana for trends and alerting.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765950213716\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"2-u003cstrongu003ewhat-is-the-best-way-to-secure-mariadb-from-remote-attacksu003c-strongu003e\">2. u003cstrongu003eWhat is the best way to secure MariaDB from remote attacks?u003c\/strongu003e<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Bind to localhost or a private interface, restrict port 3306 with a firewall, use least-privilege users, require TLS for client connections, enable Fail2ban to block brute-force attempts, and regularly patch the OS and MariaDB. Avoid remote root and wildcard (%) host entries.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765950225238\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"3-u003cstrongu003eshould-i-use-ssl-tls-for-internal-mariadb-trafficu003c-strongu003e\">3. u003cstrongu003eShould I use SSL\/TLS for internal MariaDB traffic?u003c\/strongu003e<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. Lateral movement and sniffing can happen inside networks. Enforce TLS with server and client certificates and REQUIRE SSL for privileged users. Combine with private subnets, firewall rules, and host-based authentication for defense in depth.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765950231538\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"4-u003cstrongu003ewhat-tools-can-i-use-to-monitor-mariadb-for-freeu003c-strongu003e\">4. u003cstrongu003eWhat tools can I use to monitor MariaDB for free?u003c\/strongu003e<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>mysqld_exporter with Prometheus and Grafana is a powerful free stack. Netdata offers quick insights. Percona Monitoring and Management (PMM) is another free, turnkey option that includes metrics, query analytics, and dashboards tailored for MariaDB\/MySQL.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765950245899\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"5-u003cstrongu003ehow-often-should-i-run-backups-and-test-restoresu003c-strongu003e\">5. u003cstrongu003eHow often should I run backups and test restores?u003c\/strongu003e<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Back up daily at minimum, with weekly full and daily incremental or logical dumps depending on RPO\/RTO. Test restores quarterly (or after major changes) on a staging host. Encrypt backups and store an offsite copy to meet the 3-2-1 rule.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>To monitor and secure MariaDB on a Linux server, track health metrics (uptime, connections, queries, replication), log and slow queries, [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":16716,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"iawp_total_views":85,"footnotes":""},"categories":[350,2261],"tags":[],"class_list":["post-14263","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase","category-kb-databases"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=14263"}],"version-history":[{"count":1,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14263\/revisions"}],"predecessor-version":[{"id":23328,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14263\/revisions\/23328"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/16716"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=14263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=14263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=14263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}