mysql_global_status_mysqlx_ssl_server_not_after not seen on some installs

[lchopfpt]

Our very consistently deployed database servers are behaving differently with regards to the metrics mysql_global_status_mysqlx_ssl_server_not_after and mysql_global_status_mysqlx_ssl_server_not_before

I'd like to first ask what is a situation which those metrics would NOT appear for an SSL capable MySQL Server.

I cannot seem to find why some of our nodes present this metric while others do not, even though the Percona Server, Operating System, and mysqld_exporter versions all match. They all have SSL enabled and capable, and are using the same credentials for connecting to the database.
I see other ssl related metrics for mysql, just not those exact two.

[lchopfpt]

I may have found it. https://github.com/prometheus/mysqld_exporter/blob/main/collector/global_status.go#L123
The code says "Unparseable values are silently skipped".

I think it has to do with certs that have a not_after or not_before during the 1st through 9th of the month.

Example that is failing:

Variable_name: Ssl_server_not_after
        Value: May  3 23:59:59 2025 GMT

Versus Example that is working:

Variable_name: Ssl_server_not_after
        Value: Sep 17 23:59:59 2025 GMT

There's an underscore between the Jan and 2. Should that be there?
https://github.com/prometheus/mysqld_exporter/blob/main/collector/collector.go#L62
if ts, err := time.Parse("Jan _2 15:04:05 2006 MST", string(data)); err == nil { return float64(ts.Unix()), true }

[securitym0nkey]

I run into a similar problem. Parsing works without a problem though. I've tested it outside of the mysqld_exporter. After i built a version with a bit more debugging output i could identified my problem. Those variables were empty in the server response. Turns out that, at least with mariadb, they are only set when the client connects via TLS/SSL.

[lchopfpt]

This is true. One does have to connect using TLS. I do not believe this to be my issue though. I have all my nodes set up identically.

I have proof that the parsing is the issue, as I have a node where ssl_server_not_after has two digits, and the ssl_server_not_before has single digits, and only ssl_server_not_after of them is output by mysqld_exporter.

I do note that I'm on mysqld_exporter-0.15.1-1.el9. Though I looked at the most recent code here in github.

[securitym0nkey]

If you check https://github.com/prometheus/mysqld_exporter/blob/v0.15.1/collector/collector.go#L62 you see the parsing was broken in that version. As that format would expect two digit days. The underscore is actually the fix for your problem not the cause ;)

[lchopfpt]

Ah great. I will get the latest and see what's going on.