crypt's blog: memo

Showing posts with label memo. Show all posts

Tuesday, October 15, 2013

how to disable weak ciphers in google chrome to prevent easy decryption

google-chrome --cipher-suite-blacklist=0xc007,0xc011,0x0066,0xc00c,0xc002,0x0005,0x0004

0xc007 = ECDHE-ECDSA-RC4128-SHA
0xc011 = ECDHE-RSA-RC4128-SHA
0x0066 = DHE_DSS_WITH_RC4_128_SHA
0xc00c = ECDH_RSA_WITH_RC4_128_SHA
0xc002 = RSA-RC4128-SHA
0x0005 = RSA-RC4128-SHA
0x0004 = RSA-RC4128-MD5

Source list of cipher names matching to spec:
[https://code.google.com/p/chromium/issues/detail?id=58833]

source: [http://security.stackexchange.com/questions/38493/remove-rc4-from-ssl-tls-ciphers-in-chromium]

Thursday, October 18, 2012

iostat -x

This is reposting on an article from http://dom.as/2009/03/11/iostat/ which I liked very much.

My favorite Linux tool in DB work is ‘iostat -x’ (and I really really want to see whenever I’m doing any kind of performance analysis), yet I had to learn its limitations and properties. For example, I took 1s snapshot from a slightly overloaded 16-disk database box:

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           8.12    0.00    2.57   21.65    0.00   67.66

Device:  rrqm/s   wrqm/s     r/s     w/s   rsec/s   wsec/s \
sda     7684.00    19.00 2420.00  498.00 81848.00  5287.00 \

        avgrq-sz avgqu-sz   await  svctm  %util
           29.86    32.99   11.17   0.34 100.00

I pasted this somewhere on IRC, and got “doesn’t look too healthy” and that it is disk-bound. Now, to understand if it really is, one has to understand what iostat tells here.
First line of numbers shows that we’ve got plenty of CPU resources (thats because nowadays it is quite difficult to get a box with not enough CPU power, and I/O still seems to be bottleneck) – and we have more threads waiting for I/O than we have CPU execution (that sounds normal).
Now the actual per-disk statistics are where one should look. I used to prefer %util over general %iowait (I couldn’t really explain what %iostat is, and I can say what %util is). I don’t know why, but iostat has most interesting bits at the end, and not so interesting at the start:

%util: how much time did the storage device have outstanding work (was busy). In proper RAID environments it is more like “how much time did at least one disk in RAID array have something to do”. I’m deliberately excluding any kind of cache here – if request can be served from cache, the chance is quite negligible it will show up in %util, unlike in other values. What this also means – the RAID subsystem can be loaded from 6.25% (one disk doing the work) to 100% (all of them busy). Thats quite a lot of insight in single value of ’100%’, isn’t it?
svctm: Though manual says “The average service time (in milliseconds) for I/O requests that were issued to the device.”, it isn’t exactly that when you look at multiple-disk systems. What it says is, “when your I/O subsystem is busy, how fast does it respond requests overall”. Actually, less you load your system, higher svctm is (as there’re less outstanding requests, and average time to serve them goes up). Of course, at some certain moment, when I/O becomes really overloaded, you can see svctm going up. One can tweak /sys/block/sda/queue/nr_requests based on this – to avoid overloading I/O controller, though that is really rarely needed.
await. One of my favorites – how fast do requests go through. It is just an average, how long it takes to serve a request for a device, once it gets into device queue, to final “OK”. Low = good, high = bad. There’re few gotchas here – even though different reads can have different performance properties (middle of disk, outer areas of disk, etc), the biggest difference is between reads and writes. Reads take time, writes can be instant (write caching at underlying layers..). As 80% of requests were reads, we can try to account for that by doing 11.17/0.8 math, to get 14ms figure. Thats quite high – systems that aren’t loaded can show ~5ms times (which isn’t that far away from 4ms rotation time of 15krpm disk).
avgqu-sz: Very very very important value – how many requests are there in a request queue. Low = either your system is not loaded, or has serialized I/O and cannot utilize underlying storage properly. High = your software stack is scalable enough to load properly underlying I/O. Queue size equal to amount of disks means (in best case of request distribution) that all your disks are busy. Queue size higher than amount of disks means that you are already trading I/O response time for better throughput (disks can optimize order of operations if they know them beforehand, thats what NCQ – Native Command Queueing does). If one complains about I/O performance issues when avgqu-sz is lower, then it is application specific stuff, that can be resolved with more aggressive read-ahead, less fsyncs, etc. One interesting part – avqu-sz, await, svctm and %util are iterdependent ( await = avgqu-sz * svctm / (%util/100)
avgrq-sz: Just an average request size. Quite often will look like a block size of some kind – can indicate what kind of workload happens. This is already post-merging, so lots of adjacent block operations will bump this up. Also, if database page is 16k, though filesystem or volume manager block is 32k, this will be seen in avgrq-sz. Large requests indicate there’s some big batch/stream task going on.
wsec/s & rsec/s: Sectors read and written per second. Divide by 2048, and you’ll get megabytes per second. I wanted to write this isn’t important, but remembered all the non-database people who store videos on filesystems :) So, if megabytes per second matter, these values are important (and can be seen in ‘vmstat’ output too). If not, for various database people there are other ones:
r/s & w/s: Read and write requests per second. This is already post-merging, and in proper I/O setups reads will mean blocking random read (serial reads are quite often merged), and writes will mean non-blocking random write (as underlying cache can allow to serve the OS instantly). These numbers are the ones that are the I/O capacity figures, though of course, depending on how much pressure underlying I/O subsystem gets (queue size!), they can vary. And as mentioned above, on rotational media it is possible to trade response time (which is not that important in parallel workloads) for better throughput.
rrqm/s & wrqm/s: How many requests were merged by block layer. In ideal world, there should be no merges at I/O level, because applications would have done it ages ago. Ideals differ though, for others it is good to have kernel doing this job, so they don’t have to do it inside application. Quite often there will be way less merges, because applications which tend to write adjacent blocks, also tend to wait after every write (see my rant on I/O schedulers). Reads however can be merged way easier – especially if application does “read ahead” block by block. Another reason for merges is simple block size mismatch – 16k database pages on top of 8k database pages will cause adjacent block reads, which would be merged by block layer. On some systems read of two adjacent pages would result in 1MB reads, but thats another rant :)
Device: – just to make sure, that you’re looking at the right device. :-)

So, after all this, the iostat output above tells us something like:

System has healthy high load (request queue has two-requests-per-disk)
Average request time is double the value one would expect from idle system, it isn’t too harmful, but one can do better
It is reading 80 40MB/s from disks, at 2420 requests/s. Thats quite high performance from inexpensive 2u database server (shameless plug: X4240 :)
High amount of merges comes from LVM snapshots, can be ignored
System is alive, healthy and kicking, no matter what anyone says :)

Wednesday, June 27, 2012

snmptrap

http://tiebing.blogspot.com/2007/05/snmptrap-command.html

snmptrap -v 1 -c public 192.168.100.40 1.2.3.4 192.168.254.60 3 0 ''

syntax:

-v 1: version 1
-c public: use community string "public"
192.168.100.40: trap manager's IP address (trap destination)
1.2.3.4: enterprise (i.e. type of device/object generating trap, default to system ID in mib II, can be empty)
192.168.254.50: trap source IP address (device's IP address)
3: generic trap ID, they are:

coldStart(0),
warmStart(1),
linkDown(2),
linkUp(3),
authenticationFailure(4),
egpNeighborLoss(5),
enterpriseSpecific(6)

0: specific trap ID, 0 when generic trap ID is not 6
'': system up time (timestamp)

You can also add "mib type value" to the end of the command to send them along with the trap

v2 trap:
snmptrap -v 2c -c public 192.168.100.40 "" 1.2.3.4.0

"": system Uptime (when given as empty "", the system finds itself)
1.2.3.4.0: trap OID

again, add "mib type value" to the end if you want.

v3 trap:

snmptrap -v 3 -a SHA -A 1234567890 -x DES -X 1234567890 -l authPriv -u myuser -e "123abc" 192.168.100.1 "" linkUp.0

Monday, February 27, 2012

The repository for Debian-based LAMP servers

http://www.dotdeb.org/

Friday, February 10, 2012

psycopg2 template

#!/usr/bin/python
'''

description here: This is a template how to run PostgreSQL queries from a python script

Params:
$1 - argv...
'''

import sys
import psycopg2
from datetime import *

if len(sys.argv) <> 3:
print "Usage:\n %s param1 param2" % sys.argv[0]
sys.exit(0)

param1=sys.argv[1]
param2=sys.argv[2]

conn_string = "host='localhost' dbname='db' user='user' password='pass'"

query = "select bla bla bla " +str(param1)

def main():
conn = psycopg2.connect(conn_string)
curs = conn.cursor()

curs.execute(query)
for row in curs:
print "%s" % row

# for update/insert
# conn.commit()
curs.close()
conn.close()

sys.stdout.flush()
sys.stderr.flush()

if __name__ == "__main__":
sys.exit(main())

Wednesday, February 8, 2012

Noninteractive (unattended) locale change on Debian

Edit: /etc/locale.gen

Execute: DEBIAN_FRONTEND=noninteractive dpkg-reconfigure locales

Monday, January 9, 2012

Encrypted /home with cryptsetup easy and fast

1: partition;

modprobe dm-crypt aes-x86_64

cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda4

# Also remember that in order for other accounts to still be able to unlock this partition, you need to add all Linux account passwords as keys to unlock the partition.

cryptsetup luksAddKey /dev/sda4

cryptsetup luksOpen /dev/sda4 home

ls /dev/mapper/home

mkfs.ext4 -O dir_index /dev/mapper/home

<volume fstype="crypt" path="/dev/sda4" mountpoint="/home" />

2: file

losetup -f /path/file

cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/loop0

# Also remember that in order for other accounts to still be able to unlock this partition, you need to add all Linux account passwords as keys to unlock the partition.

cryptsetup luksAddKey /dev/loop0

cryptsetup luksOpen /dev/loop0 home

ls /dev/mapper/home

mkfs.ext4 -O dir_index /dev/mapper/home

<volume fstype="crypt" path="/dev/sda4" mountpoint="/home" options="loop"/>

Oracle (Sun) Java 6 in Ubuntu 10.04 LTS

First Part:

Download *rpm.bin package from official site. Try to install it and it fails with unpacked rpm package.
Convert with alien: alien --scripts ./jre-6u30-linux-amd64.rpm
dpkg -i jre_1.6.030-1_amd64.deb
update-alternatives --get-selections |grep java
update-alternatives --install "/usr/bin/java" "java" "/usr/java/default/bin/java" 1
update-alternatives --set java /usr/java/default/bin/java
update-alternatives --list java to check
update-alternatives --install "/usr/bin/javaws" "javaws" "/usr/java/default/bin/java" 1
update-alternatives --set javaws /usr/java/default/bin/javaws

Second part - browser plugin:

Google chrome found plugin without problems. The steps for Firefox are following:

Check what's in /usr/lib/mozilla/plugins/ and remove open jdk icedtea or whatever. Name "libjavaplugin.so" is important.
Simply link it this way:

ln -s /usr/java/default/lib/amd64/libnpjp2.so /usr/lib/mozilla/plugins/libjavaplugin.so

Or use update-alternatives:

update-alternatives --install "/usr/lib/mozilla/plugins/libjavaplugin.so" "mozilla-javaplugin" "/usr/java/default/lib/amd64/libnpjp2.so" 1

update-alternatives --set mozilla-javaplugin "/usr/java/default/lib/amd64/libnpjp2.so"

Third part. Don't forget about Look&Feel:

(Default Ubuntu location)

/etc/java-6-sun/swing.properties

# uncomment to set the default look and feel to GTK

swing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel

(New with authintic Java install):

/usr/java/default/lib/swing.properties

# uncomment to set the default look and feel to GTK

swing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel

set JAVA_HOME=/usr/java/default; in /etc/environment or export in .bashrc

Friday, December 9, 2011

openvpn ip tuples

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18] [ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]

[ 41, 42]   [ 45, 46]   [ 49, 50]   [ 53, 54]   [ 57, 58]   [ 61, 62]   [ 65, 66]   [ 69, 70]   [ 73, 74]   [ 77, 78]

[ 81, 82]   [ 85, 86]   [ 89, 90]   [ 93, 94]   [ 97, 98]   [101,102]   [105,106]   [109,110]   [113,114]   [117,118]

[121,122]   [125,126]   [129,130]   [133,134]   [137,138]   [141,142]   [145,146]   [149,150]   [153,154]   [157,158]

[161,162]   [165,166]   [169,170]   [173,174]   [177,178]   [181,182]   [185,186]   [189,190]   [193,194]   [197,198]

[201,202]   [205,206]   [209,210]   [213,214]   [217,218]   [221,222]   [225,226]   [229,230]   [233,234]   [237,238]

[241,242]   [245,246]   [249,250]   [253,254]

Tuesday, November 22, 2011

ssl redirect

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

</VirtualHost>

Sunday, October 16, 2011

dpkg arch i486->i686

/usr/share/dpkg/cputable

In the second column, change GNU name to be "i686" instead of "i486".

(instead of: dpkg-architecture -f -ti686-linux-gnu)

Sunday, July 3, 2011

Chiasm

http://www.chiasm.org/newbio.htm

An Accelerated Introduction to Solaris 10: Part 1

http://www.cuddletech.com/blog/pivot/entry.php?id=562

Friday, June 10, 2011

java commercial fun

Wednesday, May 4, 2011

MySQL monitoring with OpenNMS 1.8.11 and JDBC

There are different ways to monitor MySQL using OpenNMS: mysql snmp project, with php script and agregation with OpenNMS http collector and using JDBC facility in OpenNMS. Some people say that using MySQL SNMP is more beneficial in sense of traffic usage and reporting results. JDBC is good if you don't have access on remote host to compile mysql snmp (or don't want to make rpm,deb and port:) and just want to ask DBA to add user for monitoring.
This is a compilation of the wiki articles, which you can found here and here.

Although OpenNMS wiki describes Capsd settings, we will ignore this and use it's replacemen, that is provisiond+detectors.

a) OpenNMS dataflow assumes that first every service have to be detected with simple check. Detector configured in WebUI: Admin->Provisioning Groups->Edit Foreign Source->Add detector->JDBC

Here I put foreign source xml file, so that you can pick up necessary parameters:

<detector class="org.opennms.netmgt.provision.detector.jdbc.JdbcDetector" name="JDBC for MySQL">
            <parameter value="opennms" key="user"/>
            <parameter value="abc" key="password"/>
            <parameter value="com.mysql.jdbc.Driver" key="dbDriver"/>
            <parameter value="jdbc:mysql://xx.xx.xx.xx/information_schema" key="url"/>
            <parameter value="3" key="retries"/>
            <parameter value="3306" key="port"/>
</detector>

Database URL is constructed according to this.

OpenNMS needs addition Java components to make DB requests. For that reason I installed libmysql-java (deb) which provided me with
/usr/share/java/mysql-connector-java-5.1.10.jar
This file should be included in /etc/opennms/opennms.conf like this:
ADDITIONAL_CLASSPATH="/usr/share/java/mysql-connector-java-5.1.10.jar:/usr/share/java/postgresql-jdbc3-8.4.jar"
or just copied into $OPENNMS_HOME/lib/

Otherwise OpenNMS complains about it:

INFO [scanExecutor-9] NullDetectorMonitor: JDBC for MySQL: An undeclared throwable exception was caught contating address xx.xx.xx.xx port 3306
java.lang.ClassNotFoundException: com.mysql.jdbc.Driver

b) After detection data may be collected via collectd. That is why we add following to the collectd-configuration.xml (xx.xx.xx.xx - may be a host name or an ip)

<package name="mysql">
    <filter>IPADDR != '0.0.0.0'</filter>
    <specific xmlns="">xx.xx.xx.xx</specific>
        <service name="MySQL" interval="300000" user-defined="false" status="on">
       <parameter key="retry" value="2"/>
       <parameter key="timeout" value="3000"/>
       <parameter key="collection" value="mysql"/>
       <parameter key="url" value="jdbc:mysql://xx.xx.xx.xx/information_schema"/>
       <parameter key="user" value="opennms"/>
       <parameter key="password" value="abc"/>
       <parameter key="driver" value="com.mysql.jdbc.Driver"/>
    </service>
</package>

Collection service from first part should be linked with actual Java collector. Put this also in collectd-configuration.xml

<collector service="MySQL" class-name="org.opennms.netmgt.collectd.JdbcCollector"/>

c) Collection "mysql" from the above should be linked with corresponding datacollection description (snmp, http, jdbc etc). Thus place this into jdbc-datacollection-config.xml (If my formating sux just copy from original wiki)

<jdbc-collection name="mysql">
        <rrd step="300">
                  <rra>RRA:AVERAGE:0.5:1:2016</rra>
                  <rra>RRA:AVERAGE:0.5:12:1488</rra>
                  <rra>RRA:AVERAGE:0.5:288:366</rra>
                  <rra>RRA:MAX:0.5:288:366</rra>
                  <rra>RRA:MIN:0.5:288:366</rra>
        </rrd>
      <queries>
        <query name="Uptime" ifType="all" >
          <statement>
            <queryString>show global status like 'Uptime'</queryString>
          </statement>
          <columns>
           <column name="MyUptime" data-source-name="Value" alias="MyUptime" type="GAUGE"/>
          </columns>
        </query>
        <query name="Bytes_received" ifType="all" >
          <statement>
            <queryString>show global status like 'Bytes_received'</queryString>
          </statement>
          <columns>
           <column name="MyBytesReceived" data-source-name="Value" alias="MyBytesReceived" type="COUNTER"/>
          </columns>
        </query>
        <query name="Bytes_sent" ifType="all" >
          <statement>
            <queryString>show global status like 'Bytes_sent'</queryString>
          </statement>
          <columns>
           <column name="MyBytesSent" data-source-name="Value" alias="MyBytesSent" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_delete" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_delete'</queryString>
          </statement>
          <columns>
           <column name="MyComDelete" data-source-name="Value" alias="MyComDelete" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_delete_multi" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_delete_multi'</queryString>
          </statement>
          <columns>
           <column name="MyComDeleteMulti" data-source-name="Value" alias="MyComDeleteMulti" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_insert" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_insert'</queryString>
          </statement>
          <columns>
           <column name="MyComInsert" data-source-name="Value" alias="MyComInsert" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_insert_select" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_insert_select'</queryString>
          </statement>
          <columns>
           <column name="MyComInsertSelect" data-source-name="Value" alias="MyComInsertSelect" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_select" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_select'</queryString>
          </statement>
          <columns>
           <column name="MyComSelect" data-source-name="Value" alias="MyComSelect" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_stmt_execute" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_stmt_execute'</queryString>
          </statement>
          <columns>
           <column name="MyComStmtExecute" data-source-name="Value" alias="MyComStmtExecute" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_update" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_update'</queryString>
          </statement>
          <columns>
           <column name="MyComUpdate" data-source-name="Value" alias="MyComUpdate" type="COUNTER"/>
          </columns>
        </query>
        <query name="Com_update_multi" ifType="all" >
          <statement>
            <queryString>show global status like 'Com_update_multi'</queryString>
          </statement>
          <columns>
           <column name="MyComUpdateMulti" data-source-name="Value" alias="MyComUpdateMulti" type="COUNTER"/>
          </columns>
        </query>
        <query name="Created_tmp_disk_tables" ifType="all" >
          <statement>
            <queryString>show global status like 'Created_tmp_disk_tables'</queryString>
          </statement>
          <columns>
           <column name="MyCreatTmpDiskTbl" data-source-name="Value" alias="MyCreatTmpDiskTbl" type="COUNTER"/>
          </columns>
        </query>
        <query name="Created_tmp_tables" ifType="all" >
          <statement>
            <queryString>show global status like 'Created_tmp_tables'</queryString>
          </statement>
          <columns>
           <column name="MyCreatTmpTables" data-source-name="Value" alias="MyCreatTmpTables" type="COUNTER"/>
          </columns>
        </query>
        <query name="key_buffer_size" ifType="all" >
          <statement>
            <queryString>show global variables like 'key_buffer_size'</queryString>
          </statement>
          <columns>
           <column name="MyKeyBufferSize" data-source-name="Value" alias="MyKeyBufferSize" type="GAUGE"/>
          </columns>
        </query>
        <query name="key_cache_block_size" ifType="all" >
          <statement>
            <queryString>show global variables like 'key_cache_block_size'</queryString>
          </statement>
          <columns>
           <column name="MyKeyCacheBlkSize" data-source-name="Value" alias="MyKeyCacheBlkSize" type="GAUGE"/>
          </columns>
        </query>
        <query name="Key_blocks_unused" ifType="all" >
          <statement>
            <queryString>show global status like 'Key_blocks_unused'</queryString>
          </statement>
          <columns>
           <column name="MyKeyBlkUnused" data-source-name="Value" alias="MyKeyBlkUnused" type="GAUGE"/>
          </columns>
        </query>
        <query name="Key_read_requests" ifType="all" >
          <statement>
            <queryString>show global status like 'Key_read_requests'</queryString>
          </statement>
          <columns>
           <column name="MyKeyReadReqs" data-source-name="Value" alias="MyKeyReadReqs" type="COUNTER"/>
          </columns>
        </query>
        <query name="Key_reads" ifType="all" >
          <statement>
            <queryString>show global status like 'Key_reads'</queryString>
          </statement>
          <columns>
           <column name="MyKeyReads" data-source-name="Value" alias="MyKeyReads" type="COUNTER"/>
          </columns>
        </query>
        <query name="Key_write_requests" ifType="all" >
          <statement>
            <queryString>show global status like 'Key_write_requests'</queryString>
          </statement>
          <columns>
           <column name="Value" data-source-name="Value" alias="MyKeyWriteReqs" type="COUNTER"/>
          </columns>
        </query>
        <query name="Key_writes" ifType="all" >
          <statement>
            <queryString>show global status like 'Key_writes'</queryString>
          </statement>
          <columns>
           <column name="MyKeyWrites" data-source-name="Value" alias="MyKeyWrites" type="COUNTER"/>
          </columns>
        </query>
        <query name="Open_files" ifType="all" >
          <statement>
            <queryString>show global status like 'Open_files'</queryString>
          </statement>
          <columns>
           <column name="MyOpenFiles" data-source-name="Value" alias="MyOpenFiles" type="GAUGE"/>
          </columns>
        </query>
        <query name="Open_tables" ifType="all" >
          <statement>
            <queryString>show global status like 'Open_tables'</queryString>
          </statement>
          <columns>
           <column name="MyOpenTables" data-source-name="Value" alias="MyOpenTables" type="GAUGE"/>
          </columns>
        </query>
        <query name="table_cache" ifType="all" >
          <statement>
            <queryString>show global variables like 'table_cache'</queryString>
          </statement>
          <columns>
           <column name="MyTableCache" data-source-name="Value" alias="MyTableCache" type="GAUGE"/>
          </columns>
        </query>
        <query name="Questions" ifType="all" >
          <statement>
            <queryString>show global status like 'Questions'</queryString>
          </statement>
          <columns>
           <column name="MyQuestions" data-source-name="Value" alias="MyQuestions" type="COUNTER"/>
          </columns>
        </query>
        <query name="Slow_queries" ifType="all" >
          <statement>
            <queryString>show global status like 'Slow_queries'</queryString>
          </statement>
          <columns>
           <column name="MySlowQueries" data-source-name="Value" alias="MySlowQueries" type="COUNTER"/>
          </columns>
        </query>
        <query name="Connections" ifType="all" >
          <statement>
            <queryString>show global status like 'Connections'</queryString>
          </statement>
          <columns>
           <column name="MyConnections" data-source-name="Value" alias="MyConnections" type="COUNTER"/>
          </columns>
        </query>
        <query name="Threads_created" ifType="all" >
          <statement>
            <queryString>show global status like 'Threads_created'</queryString>
          </statement>
          <columns>
           <column name="MyThreadsCreatd" data-source-name="Value" alias="MyThreadsCreatd" type="COUNTER"/>
          </columns>
        </query>
        <query name="Threads_cached" ifType="all" >
          <statement>
            <queryString>show global status like 'Threads_cached'</queryString>
          </statement>
          <columns>
           <column name="MyThreadsCachd" data-source-name="Value" alias="MyThreadsCachd" type="GAUGE"/>
          </columns>
        </query>
        <query name="Threads_connected" ifType="all" >
          <statement>
            <queryString>show global status like 'Threads_connected'</queryString>
          </statement>
          <columns>
           <column name="MyThreadsCnnctd" data-source-name="Value" alias="MyThreadsCnnctd" type="GAUGE"/>
          </columns>
        </query>
        <query name="Threads_running" ifType="all" >
          <statement>
            <queryString>show global status like 'Threads_running'</queryString>
          </statement>
          <columns>
           <column name="MyThreadsRunng" data-source-name="Value" alias="MyThreadsRunng" type="GAUGE"/>
          </columns>
        </query>
      </queries>

    </jdbc-collection>

d) In snmp-graph.properties (don't know why snmp) the graph description should be added. Exactly like in the official howto:

http://www.opennms.org/wiki/JDBC_Collection_configuration_for_MySQL

e) MySQL user created just to allow OpenNMS to connect and perform request on information schema.

In case you locked the user, allow access to MySQL again on the database host by:

mysqladmin flush-hosts