ApsaraDB RDS:Troubleshoot instance connection issues

Error message

Cause

Solution

• ERROR 2003 (HY000): Can't connect to MySQL server on 'XXX'(10038 or 10060 or 110)

• Cannot connect to database: XXX

Network connectivity issue.

• The ECS instance and the RDS instance must be in the same region.

• They must use the same network type.

• If they are in a VPC, they must be in the same one.

• Add the private IP address of the ECS instance to the IP address whitelist of the RDS instance.

For more information, see Solutions.

• ERROR 1045 (HY000): #28000ip not in whitelist

• ERROR 2801 (HY000): #RDS00ip not in whitelist, client ip is XXX

• ERROR 2013 (HY000): Lost connection to MySQL server at ‘reading authorization packet’, system error:110

IP address whitelist configuration issue.

Check the instance IP address whitelist

• ERROR 1045 (28000): Access denied for user ‘XXX’@’XXX’ (using password: YES or NO)

• ERROR 1045 (28000): Authentication Failed For RDS maybe username or password is incorrect

The username or password is incorrect.

Check the username and password in your connection details:

• ApsaraDB RDS does not provide a root account. You must create your own account. For more information, see Create an account.

• If the password contains special characters, enclose it in single quotation marks. For example, use -p 'XXX' in the command.

• If you forget the password, reset it on the Accounts page in the console.

  Note

  After you reset a password, it may take several minutes for the new password to take effect.

• ERROR 2005 (HY000): Unknown MySQL server host ‘XXX’ (110 or 11004)

• SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Name or service not known

• Name or service not known

• unknown server host

The DNS server cannot resolve the endpoint.

1. Verify that the RDS endpoint is correct. Common causes for this error include:

   • An incorrect endpoint. The correct format is rm-XXX.XXX.rds.aliyuncs.com.

   • Using a public endpoint that has been released.

   • The application truncated the endpoint.

2. If the RDS endpoint is correct but the error persists, change the DNS server address to an Alibaba Cloud DNS server address.

   • If you connect over an internal network (classic network), use 10.143.22.116 and 10.143.22.118.

   • If you connect over an internal network (VPC), use 100.100.2.136 and 100.100.2.138.

   • If you connect over the internet, use 223.5.5.5 and 223.6.6.6.

ERROR 2059 (HY000): Authentication plugin 'caching_sha2_password' cannot be loaded: /usr/xx/xx/caching_sha2_password.so: cannot open shared object file: No such file or directory

MySQL cannot load the caching_sha2_password authentication plug-in.

• Client for MySQL 8.0: MySQL 8.0 uses the caching_sha2_password plug-in by default. Some systems or installation methods may cause this plug-in to be missing. You can resolve this issue in one of the following ways:

  • Method 1: Log on to MySQL with a high-privilege account, run the following commands to change the plug-in, and then reconnect.

    ALTER USER 'your_username'@'%' IDENTIFIED WITH mysql_native_password BY 'your_password';
    FLUSH PRIVILEGES;

  • Method 2: Reinstall MySQL to fix the plug-in.

    sudo yum reinstall mysql-server

• Client for MySQL 5.x: This client version is outdated and does not support caching_sha2_password. Upgrade to the latest version of MySQL 8.0.

  sudo yum install mysql-server

• [Note] [MY-010914] [Server] Aborted connection 671541 to db: 'XXX' user: 'XXX' host: 'XXX' (The client was disconnected by the server because of inactivity.).

• General error: 2006 MySQL server has gone away

The connection timed out due to inactivity.

This occurs when an idle client connection exceeds the server's timeout period (controlled by parameters like interactive_timeout or wait_timeout for MySQL). To prevent this, adjust these timeout settings in your database configuration.

Access denied for user 'root'@'XXX' (using password: YES) to database 'XX'

The connection from the ECS instance was rejected because it used the root account.

By default, the MySQL root account only allows logins from the local host and prohibits direct connections from remote IP addresses. Create a dedicated account to connect to the database.

-- Create a dedicated account that allows connections only from the ECS IP address.
CREATE USER '<user_name>'@'<172.16.XX.XX>' IDENTIFIED BY '<password>';
-- Grant the required permissions on the database based on the principle of least privilege.
GRANT SELECT, INSERT, UPDATE, DELETE ON <database_name>.* TO '<user_name>'@'<172.16.XX.XX>';
FLUSH PRIVILEGES;

From XXX (172.17.XX.XX) icmp_seq=1 Destination Host Unreachable

The ECS instance cannot ping the private endpoint of the RDS instance because the private CIDR block of the RDS instance conflicts with that of another service on the ECS instance.

"Destination Host Unreachable" is returned when you ping the private endpoint of an RDS instance to which you cannot connect

Error message

Cause

Solution

Cannot connect to XXX. A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.) (Microsoft SQL Server, Error: 10060 or 258)

Network connectivity issue.

• The ECS instance and the RDS instance must be in the same region.

• They must use the same network type.

• If they are in a VPC, they must be in the same one.

• Add the private IP address of the ECS instance to the IP address whitelist of the RDS instance.

• Verify that the private endpoint and port of the RDS instance are configured correctly on the ECS instance.

For more information, see Solutions.

Cannot connect to XXX.

A connection was successfully established with the server, but then an error occurred during the login process. (provider: TCP Provider, error: 0 - The specified network name is no longer available.) (Microsoft SQL Server, Error: 64)

IP address whitelist configuration issue.

Check the instance IP address whitelist

Logon failed for login 'user' due to trigger execution

The connection limit is reached.

Check the number of connections to the instance and whether there are blocked connections

cannot open user default database.Login failed

The connecting user's default database lacks an associated user on the ApsaraDB RDS for SQL Server instance.

Create an associated user for the logon user in the database

From XXX (172.17.XX.XX) icmp_seq=1 Destination Host Unreachable

The ECS instance cannot ping the private endpoint of the RDS instance because the private CIDR block of the RDS instance conflicts with that of another service on the ECS instance.

"Destination Host Unreachable" is returned when you ping the private endpoint of an RDS instance to which you cannot connect

Error message

Cause

Solution

Unable to connect to server:

could not connect to server: Connection timed out (0x0000274C/10060)Is the server running on host XXX.rds.aliyuncs.com and acceptingTCP/IP connections on port XXX?

Network connectivity issue.

• Confirm your connection method and select the correct endpoint. Endpoints are available on the Database Connection page in the console.

  • Internal network connection: The connecting ECS instance must be in the same region and use the same network type as the RDS instance. If using a VPC, the VPC ID must also match.

  • Internet connection: Use this method to connect from a local device or an ECS instance that cannot connect via the internal network.

    Note

    You must manually apply for a public endpoint. For more information, see Apply for a public endpoint.

• Verify that the IP address of the client (ECS instance or local device) is in the IP address whitelist and that the whitelist is configured correctly. For more information, see Configure an IP address whitelist.

  Note

  You can run the curl ipinfo.io/ip command to query the public IP address of your local client.

• If high-security whitelist mode is enabled, check whether the client's IP address is added to a whitelist in the correct group.

For more information, see Solutions.

• server closed the connection unexpectedly This probably means the server terminated abnormally before or while processing the request.

• Error connecting to the server: FATAL: no pg_hba.conf entry

IP address whitelist configuration issue.

Configure an IP address whitelist

FATAL: remaining connection slots are reserved for non-replication superuser connections

The connection limit is reached.

Close sessions that consume connections

FATAL: password authentication failed for user "xxx".

Incorrect password.

Reset the password and try again.

For more information about how to reset the password, see Reset a password.

From XXX (172.17.XX.XX) icmp_seq=1 Destination Host Unreachable

The ECS instance cannot ping the private endpoint of the RDS instance because the private CIDR block of the RDS instance conflicts with that of another service on the ECS instance.

"Destination Host Unreachable" is returned when you ping the private endpoint of an RDS instance to which you cannot connect