Skip to main content
compliance · gcp

Cloud SQL for MySQL instances without the slow_query_log flag turned on

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

Cloud SQL for MySQL instances whose `slow_query_log` database flag is off record nothing about queries that run longer than `long_query_time`, so slow statements go unexplained until they cause an incident. ZopNight flags MySQL instances where that flag is not set to on, including ones that never set it; PostgreSQL and SQL Server instances are never evaluated by this check.

Signal and threshold

How ZopNight evaluates Cloud SQL for MySQL instances without the slow_query_log flag turned on.
Field Value
Rule IDsRC-1242
Categorycompliance
Severitylow
Metricnone — pure configuration read
Thresholdslow_query_log not on (off or unset) on a MySQL engine
SourceZopNight
Permissions usedcloudasset.assets.listResource

Why MySQL needs the slow log to explain latency

MySQL writes a statement to the slow query log when it runs longer than long_query_time. With the slow_query_log flag off, that record never exists. When a page gets slow or CPU climbs, there is no list of the statements responsible, and teams end up guessing, adding indexes blind, or scaling the instance up to cover a single bad query.

Cloud SQL makes the flag slightly less obvious than stock MySQL. The database flags reference says that to make slow query logs available in Logs Explorer you must set both slow_query_log to on and log_output to FILE. The TABLE output is not recommended because the table can grow large enough to slow restarts and cost the instance its SLA coverage. Logs on the instance disk rotate after 24 hours or 100 MB, and Cloud Logging charges apply to what is exported.

Reading the flags on each MySQL instance

Terminal window
gcloud sql instances list \
--filter="databaseVersion:MYSQL*" \
--format="table(name, databaseVersion, settings.databaseFlags)"

Look for slow_query_log with value off, and for log_output. An instance with no slow_query_log entry is running with the default, which is off, so ZopNight flags it too.

What must be true before it fires

  1. The instance engine is MySQL. The slow query log is a MySQL flag, so PostgreSQL and SQL Server instances are outside this rule entirely.
  2. ZopNight’s reading of the instance’s database flags does not show slow_query_log set to on. An explicit off and a missing entry are treated the same way.

That is the whole check. No metric, query count or time window is involved.

When nothing is reported

Any slow_query_log value other than on, including a missing entry, counts as off. Only an instance whose settings were not collected at all is skipped. Instances with the slow log on are silent even if log_output is set to NONE, which Google notes makes the logs inaccessible, so check that flag yourself when you enable logging.

Operational risk rather than a saving

There is no saving attached. Turning the log on adds a small amount of Cloud Logging volume if you export it. The value is diagnostic: when latency spikes you have the statements, their duration and the rows examined instead of a CPU graph and a hunch.

Enabling slow query logging safely

  1. List the flags already set on the instance. The flag configuration steps warn that --database-flags overwrites every flag previously set; anything you leave out returns to its default.

  2. Apply the full set, including the existing flags plus the logging ones:

    Terminal window
    gcloud sql instances patch INSTANCE_NAME \
    --database-flags=EXISTING_FLAG=VALUE,slow_query_log=on,log_output=FILE,long_query_time=2
  3. Pick a long_query_time that suits the workload; Cloud SQL allows values below 1 second.

  4. Confirm entries appear in Logs Explorer, then set up a log-based metric or alert on the volume.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·