
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
@opentelemetry/instrumentation-mysql
Advanced tools
OpenTelemetry instrumentation for `mysql` database client for MySQL
This module provides automatic instrumentation for the mysql module, which may be loaded using the @opentelemetry/sdk-trace-node package and is included in the @opentelemetry/auto-instrumentations-node bundle.
If total installation size is not constrained, it is recommended to use the @opentelemetry/auto-instrumentations-node bundle with @opentelemetry/sdk-node for the most seamless instrumentation experience.
Compatible with OpenTelemetry JS API and SDK 1.0+.
npm install --save @opentelemetry/instrumentation-mysql
mysql versions >=2.0.0 <3OpenTelemetry MySQL Instrumentation allows the user to automatically collect trace data and export them to the backend of choice, to give observability to distributed systems when working with mysql.
To load a specific plugin (MySQL in this case), specify it in the registerInstrumentations's configuration
const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node');
const { MySQLInstrumentation } = require('@opentelemetry/instrumentation-mysql');
const { registerInstrumentations } = require('@opentelemetry/instrumentation');
const provider = new NodeTracerProvider();
provider.register();
registerInstrumentations({
instrumentations: [
new MySQLInstrumentation(),
],
})
See examples/mysql for a short example.
| Options | Type | Default | Description |
|---|---|---|---|
enhancedDatabaseReporting | boolean | false | If true, a db.mysql.values attribute containing the query's parameters will be add to database spans. Note that this is not an attribute defined in Semantic Conventions. |
This instrumentation implements Semantic Conventions (semconv) v1.7.0. Since then, networking (in semconv v1.23.1) and database (in semconv v1.33.0) semantic conventions were stabilized. As of @opentelemetry/instrumentation-mysql@0.55.0 support has been added for migrating to the stable semantic conventions using the OTEL_SEMCONV_STABILITY_OPT_IN environment variable as follows:
OTEL_SEMCONV_STABILITY_OPT_IN=http/dup,database/dup to emit both old and stable semantic conventions. (The http token is used to control the net.* attributes, the database token to control to db.* attributes.)OTEL_SEMCONV_STABILITY_OPT_IN=http,database to emit only the stable semantic conventions.By default, if OTEL_SEMCONV_STABILITY_OPT_IN includes neither of the above tokens, the old v1.7.0 semconv is used.
The intent is to provide an approximate 6 month time window for users of this instrumentation to migrate to the new database and networking semconv, after which a new minor version will use the new semconv by default and drop support for the old semconv.
See the HTTP migration guide and the database migration guide for details.
Attributes collected:
| Old semconv | Stable semconv | Description |
|---|---|---|
db.system | db.system.name | 'mssql' (old), 'microsoft.sql_server' (stable) |
db.connection_string | Removed | The connection string used to connect to the database. |
db.statement | db.query.text | The database query being executed. |
db.user | Removed | Username for accessing the database. |
db.name | Removed | Integrated into new db.namespace. |
| (not included) | db.namespace | The database associated with the connection, as provided at connection time. (This does not track changes made via SELECT DATABASE().) |
net.peer.name | server.address | Remote hostname or similar. |
net.peer.port | server.port | Remote port number. |
Metrics collected:
db.client.connections.usage - The number of connections currently in a given state.
Note: While db.client.connections.usage has been deprecated in favor of db.client.connection.count in the semconv database migration, the new metric is still unstable, so cannot be enabled via OTEL_SEMCONV_STABILITY_OPT_IN=database. There is ongoing work to provide an opt-in setting to select the latest experimental semconv.
Apache 2.0 - See LICENSE for more information.
@opentelemetry/instrumentation-pg provides similar functionality for PostgreSQL databases. It allows for automatic instrumentation of PostgreSQL operations, enabling the collection of telemetry data for monitoring and performance analysis. The main difference is that it is specifically designed for PostgreSQL rather than MySQL.
mysql2 is a MySQL client for Node.js that supports Promises and async/await. While it does not provide automatic instrumentation, it can be used in conjunction with OpenTelemetry to manually instrument MySQL operations. This package is more focused on providing a robust and performant MySQL client rather than telemetry.
sequelize is a promise-based Node.js ORM for various SQL databases, including MySQL. It does not provide automatic instrumentation out of the box, but it can be integrated with OpenTelemetry for manual instrumentation. Sequelize is more focused on providing an ORM layer for database operations rather than telemetry.
FAQs
OpenTelemetry instrumentation for `mysql` database client for MySQL
The npm package @opentelemetry/instrumentation-mysql receives a total of 12,683,764 weekly downloads. As such, @opentelemetry/instrumentation-mysql popularity was classified as popular.
We found that @opentelemetry/instrumentation-mysql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.