• --socket : For Unix socket file or Windows named pipe connections, the socket file or named pipe to connect to on the running server. 

For descriptions of all available options, see Section 4.6.8, “mysql_migrate_keyring — Keyring Key Migration Utility” . 

Start mysql_migrate_keyring  with options indicating the source and destination keystores and whether the migration is offline or online, possibly with other options. Keep the following considerations in mind: 

•The user who invokes mysql_migrate_keyring  must not be the root  operating system user. 

•The user who invokes mysql_migrate_keyring  must have permission to read and write any local keyring files, such as the data file for a file-based plugin. 

If you invoke mysql_migrate_keyring  from a system account different from that normally used to run MySQL, it might create keyring directories or files that are inaccessible to the server during normal operation. Suppose that mysqld  normally runs as the mysql  operating system user, but you invoke mysql_migrate_keyring  while logged in as isabel . Any new directories or files created by mysql_migrate_keyring  are owned by isabel . Subsequent startup fails when a server run as the mysql  operating system user attempts to access file system objects owned by isabel . 

To avoid this issue, invoke mysql_migrate_keyring  as the mysql  operating system user. Alternatively, after the migration, examine the keyring-related file system objects and change their ownership and permissions if necessary using chown , chmod , or similar commands, so that the objects are accessible to the running server. 

Suppose that you want to migrate keys from component_keyring_file  to component_keyring_encrypted_file , and that the local server stores its keyring component library files in /usr/local/mysql/lib/plugin . 

If no running server is using the keyring, an offline migration is permitted. Invoke mysql_migrate_keyring  like this (enter the command on a single line): 

mysql_migrate_keyring --component-dir=/usr/local/mysql/lib/plugin --source-keyring=component_keyring_file --destination-keyring=component_keyring_encrypted_file 

If a running server is using the keyring, you must perform an online migration instead. In this case, the -- online-migration  option must be given, along with any connection options required to specify which server to connect to and the MySQL account to use. 

The following command performs an online migration. It connects to the local server using a TCP/IP connection and the admin  account. The command prompts for a password, which you should enter when prompted: 

mysql_migrate_keyring --component-dir=/usr/local/mysql/lib/plugin --source-keyring=component_keyring_file --destination-keyring=component_keyring_encrypted_file --online-migration --host=127.0.0.1 --user=admin --password 

mysql_migrate_keyring  performs a migration operation as follows: 

1. (Online migration only) Connect to the running server using the connection options. 

2. (Online migration only) Disable keyring_operations  on the running server. 

3. Load the keyring component libraries for the source and destination keystores. 

