'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' error in BBR backup logs

Products

• VMware Tanzu Platform Core

Issue/Introduction

The error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' might be seen in BBR logs when backing up some MySQL databases (e.g. usage-servicedb, cfnetworkingdb, cloudcontrollerdb etc.).  Detailed logs would be like

backup_restore/ba4c3ba4-####-eb8d75d05b3d:/var/vcap/sys/log/bbr-usage-servicedb# head backup.stderr.log 
2026/04/14 01:54:20 MYSQL server version 8.4.7-7
-- Connecting to mysql.service.cf.internal...
-- Starting transaction...
mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces
-- Setting savepoint...
-- Retrieving table structure for table app_events...
-- Sending SELECT query...
-- Retrieving rows...
......

 

 

Cause

The error is due the break change introduced since MySQL 8.0.21 (as shown below).

Incompatible Change: Access to the INFORMATION_SCHEMA.FILES table now requires the PROCESS privilege.

The backup scripts will run mysqldump tool to backup the target MySQL databases with user which is created in advance and granted full privileges on target database. For example,

CREATE USER IF NOT EXISTS 'app_usage'@'%'
  IDENTIFIED WITH mysql_native_password BY '####'
  /!80001 ATTRIBUTE '{ "pxc-release-seeded-user": true }'/;
ALTER USER 'app_usage'@'%'
  IDENTIFIED WITH mysql_native_password BY '####'
  /!80001 ATTRIBUTE '{ "pxc-release-seeded-user": true }'/;
REVOKE ALL PRIVILEGES ON . FROM 'app_usage'@'%';
GRANT ALL PRIVILEGES ON app\_usage\_service.* TO 'app_usage'@'%';

 

However, accessing PROCESSLIST table needs global privilege instead of database level privileges. Users who do not need to dump tablespace information can work around this requirement by invoking mysqldump with the --no-tablespaces option. The mysqldump tool invoked by BBR is not provided the --no-tablespaces option.

 

Resolution

It's confirmed by Tanzu product team that data in PROCESSLIST table is actually not required. Although the PROCESSLIST table is not saved due to the aforementioned error, in fact all necessary data are completely backed up by BBR. Therefore, the following error can be ignored at the moment. 

mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces

 

The product team may consider to add the --no-tablespaces option to mysqldump in future, but that's just for suppressing the error with no impact on backup artifact.