Stay organized with collections Save and categorize content based on your preferences.
Check if your question or problem has already been addressed on one of the following pages:
Topics in this page include:
Run the gcloud sql operations list
command to list all operations for the given Cloud SQL instance.
Look in the logs and filter by text to find the user. You may need to use audit logs for private information. Relevant log files include:
cloudsql.googleapis.com/sqlagent.out
cloudsql.googleapis.com/sqlserver.err
cloudaudit.googleapis.com/activity
may also be available.If you delete an instance without taking a final backup of the data, then no data recovery is possible. However, if you restore the instance, then Cloud SQL also restores the backups. For more information on recovering a deleted instance, see Recovery backups.
If you have done an export operation, create a new instance and then do an import operation to recreate the database. Exports are written to Cloud Storage and imports are read from there.
Note: Cloud SQL recommends that you take a final backup of your data before you delete the instance. This way, you can recreate any instances that you delete accidentally without contacting Cloud Customer Care. An automated backup is stuck for many hours and can't be canceled. Backups can take a long time depending on the database size.If you really need to cancel the operation, you can ask customer support to force restart
the instance.
Create the database users before restoring the SQL dump.
You want to increase the number of days that you can keep automatic backups from seven to 30 days, or longer. You can configure the number of automated backups to retain, but you can't retain fewer than the default (seven). Automated backups get pruned regularly based on the retention value configured. Unfortunately, this means that the currently visible backups are the only automated backups you can restore from.To keep backups indefinitely, you can create an on-demand backup, as they are not deleted in the same way as automated backups. On-demand backups remain indefinitely. That is, they remain until they're deleted or the instance they belong to is deleted. Because that type of backup is not deleted automatically, it can affect billing.
An automated backup failed and you didn't receive an email notification. To have Cloud SQL notify you of the backup's status, configure a log-based alert. You're unable to restore your instance using the Transact-SQL RESTORE command or the SQL Server Management Studio (SSMS). Cloud SQL does not support restoring instances through SSMS. To restore your instance, run thegcloud sql import
command. Clone Issue Troubleshooting Cloning fails with constraints/sql.restrictAuthorizedNetworks
error. The cloning operation is blocked by the Authorized Networks
configuration. Authorized Networks
are configured for public IP addresses in the Connectivity section of the Google Cloud console, and cloning is not permitted due to security considerations.
Remove all Authorized Networks
entries from the Cloud SQL instance if you can. Otherwise, create a replica without any Authorized Networks
entries.
Failed to create subnetwork. Couldn't find free blocks in allocated IP ranges. Please allocate new ranges for this service provider. Help Token: [help-token-id].
You're trying to use the Google Cloud console to clone an instance with a private IP address, but you didn't specify the allocated IP range that you want to use and the source instance isn't created with the specified range. As a result, the cloned instance is created in a random range.
Use gcloud
to clone the instance and provide a value for the --allocated-ip-range-name
parameter. For more information, see Cloning an instance with a private IP.
Aborted connection
. The issue might be:
Applications must tolerate network failures and follow best practices such as connection pooling and retrying. Most connection poolers catch these errors where possible. Otherwise the application must either retry or fail gracefully.
For connection retry, we recommend the following methods:
Combining these methods helps reduce throttling.
Create instances Issue Troubleshooting Error message:Failed to create subnetwork. Router status is temporarily unavailable. Please try again later. Help Token: [token-ID]
. Try to create the Cloud SQL instance again. Error message: HTTPError 400: Invalid request: Incorrect Service Networking config for instance: PROJECT_ID:INSTANCE_NAME:SERVICE_NETWORKING_NOT_ENABLED.
Enable the Service Networking API using the following command and try to create the Cloud SQL instance again.
gcloud services enable servicenetworking.googleapis.com \ --project=PROJECT_IDError message:
Failed to create subnetwork. Required 'compute.projects.get' permission for PROJECT_ID
. When you create an instance using with a Private IP address, a service account is created just-in-time using the Service Networking API. If you have only recently enabled the Service Networking API, then the service account might not get created and the instance creation fails. In this case, you must wait for the service account to propagate throughout the system or manually add it with the required permissions. Error message: More than 3 subject alternative names are not allowed.
You're trying to use a custom SAN to add more than three DNS names to the server certificate of a Cloud SQL instance. You can't add more than three DNS names to the instance. Error message: Subject alternative names %s is too long. The maximum length is 253 characters.
Make sure that any DNS names that you want to add to the server certificate of a Cloud SQL instance don't have more than 253 characters. Error message: Subject alternative name %s is invalid.
Verify that the DNS names that you want to add to the server certificate of a Cloud SQL instance meet the following criteria:
HTTP Error 409: Operation failed because another operation was already in progress.
There is already a pending operation for your instance. Only one operation is allowed at a time. Try your request after the current operation is complete. HTTP Error 403: The service account does not have the required permissions for the bucket.
Ensure that the bucket exists and the service account for the Cloud SQL instance (which is performing the export) has the Storage Object Creator
role (roles/storage.objectCreator
) to allow export to the bucket. See IAM roles for Cloud Storage. You want exports to be automated. Cloud SQL does not provide a way to automate exports.
You could build your own automated export system using Google Cloud products such as Cloud Scheduler, Pub/Sub, and Cloud Run functions, similar to this article on automating backups.
Flags Issue Troubleshooting You want to modify the time zone for a Cloud SQL instance.To see how to update an instance's time zone, see Instance settings.
In Cloud SQL for SQL Server, you can use the AT TIME ZONE
function for time conversions and more. For more information about this function, see AT TIME ZONE (Transact-SQL).
Edit the instance to upgrade to a larger machine size to get more CPUs and memory.
Import Issue TroubleshootingHTTP Error 409: Operation failed because another operation was already in progress
. There is already a pending operation for your instance. Only one operation is allowed at a time. Try your request after the current operation is complete. The import operation is taking too long. Too many active connections can interfere with import operations.
Close unused operations. Check the CPU and memory usage of your Cloud SQL instance to make sure there are plenty of resources available. The best way to ensure maximum resources for the import is to restart the instance before beginning the operation.
A restart:
Create the database users before importing.
LSN mismatch The order of the import of transaction log backups is incorrect or the transaction log chain is broken.StopAt
timestamp. For example, if the first log in the transaction log file is at 2023-09-01T12:00:00 and the StopAt
field has value of 2023-09-01T11:00:00, then Cloud SQL returns this error.
StopAt
timestamp and the correct transaction log file. Linked servers Error message Troubleshooting Msg 7411, Level 16, State 1, Line 25
Server 'LINKED_SERVER_NAME' is not configured for DATA ACCESS.
The DataAccess
option is disabled. Run the following command to enable data access:
EXEC sp_serveroption @server='LINKED_SERVER_NAME', @optname='data access', @optvalue='TRUE'
Replace LINKED_SERVER_NAME with the name of the linked server.
Access to the remote server is denied because no login-mapping exists. (Microsoft SQL Server, Error: 7416)
If you have this issue while establishing an encrypted connection, you need to try another way to provide the user ID when you access the linked server. To do this, run the following command:
EXEC master.dbo.sp_addlinkedserver @server = N'LINKED_SERVER_NAME', @srvproduct= N'', @provider= N'SQLNCLI', @datasrc= N'TARGET_SERVER_ID', @provstr= N'Encrypt=yes;TrustServerCertificate=yes;User ID=USER_ID'
Replace the following:
For example, a user was deleted but you can't find out who did it. The logs show the operation started but don't provide any more information. You must enable audit logging for detailed and personal identifying information (PII) like this to be logged.
Some logs are filtered from theerror.log
log of a Cloud SQL for SQL Server instance. Filtered logs include AD logs without timestamps, and include: Login failed for user 'x'. Reason: Token-based server access validation failed with an infrastructure error. Login lacks connect endpoint permission. [CLIENT: 127.0.0.1]
. These logs are filtered because they potentially can cause confusion. Log files are hard to read. You'd rather view the logs as json or text.You can use the gcloud logging read
command along with linux post-processing commands to download the logs.
To download the logs as JSON:
gcloud logging read \ "resource.type=cloudsql_database \ AND logName=projects/PROJECT_ID \ /logs/cloudsql.googleapis.com%2FLOG_NAME" \ --format json \ --project=PROJECT_ID \ --freshness="1d" \ > downloaded-log.json
To download the logs as TEXT:
gcloud logging read \ "resource.type=cloudsql_database \ AND logName=projects/PROJECT_ID \ /logs/cloudsql.googleapis.com%2FLOG_NAME" \ --format json \ --project=PROJECT_ID \ --freshness="1d"| jq -rnc --stream 'fromstream(1|truncate_stream(inputs)) \ | .textPayload' \ --order=asc > downloaded-log.txtManage instances Issue Troubleshooting Temporary storage increased automatic storage. Automatic storage is enabled.
Restart deletes the temporary files but not reduce the storage. Only customer support can reset the instance size.
Data is being automatically deleted. Most likely a script is running somewhere in your environment.Look in the logs around the time of the deletion and see if there's a rogue script running from a dashboard or another automated process.
The instance cannot be deleted. You might see the error messageERROR: (gcloud.sql.instances.delete) HTTP Error 409: The instance or operation is not in an appropriate state to handle the request
, or the instance may have a INSTANCE_RISKY_FLAG_CONFIG
flag status.
Some possible explanations include:
INSTANCE_RISKY_FLAG_CONFIG
warning is triggered whenever at least one beta
flag is being used. Remove the risky flag settings and restart the instanceUnfortunately, you can't shrink the ibtmp1
file by any method other than restarting the service.
One mitigation option is to create the temporary table with ROW_FORMAT=COMPRESSED
, so it is stored in file-per-table tablespaces in the temporary file directory. However, the downside is performance costs associated with creating and removing a file-per-table tablespace for each temporary table.
If your instance runs out of storage, and the automatic storage increase capability isn't enabled, your instance goes offline. To avoid this issue, you can edit the instance to enable automatic storage increase.
Your on-premises primary instance is stuck. Google Cloud can't help with instances that are not in Cloud SQL. Slow shutdown on restart. When an instance shuts down, any outstanding connections that don't end within 60 seconds make the shutdown unclean.By having connections that last less than 60 seconds, most unclean shutdowns can be avoided, including connections from the database command prompt. If you keep these connections open for hours or days, shutdowns can be unclean.
A user cannot be deleted. The user probably has objects in the database that depend on it. You need to drop those objects or reassign them to another user.Find out which objects are dependent on the user, then drop or reassign those objects to a different user.
This thread on Stack Exchange discusses how to find the objects owned by the user. Particular queries are running slow. Queries can be slow for many reasons, mostly due to specific database aspects. One reason that can involve Cloud SQL is network latency, when the source (writer or reader) resource and the destination (Cloud SQL) resource are in different regions.Refer to general performance tips in particular.
For slow database inserts, updates, or deletes, consider the following actions:
To reduce the latency the recommendation is to locate both the source and destination resources in the same region.
Out of memory is indicated but monitoring charts don't show that. An instance can fail and reportOut of memory
but the Google Cloud console or Cloud Monitoring charts seem to show there's still memory remaining.
There are other factors beside your workload that can impact memory usage, such as the number of active connections and internal overhead processes. These aren't always reflected in the monitoring charts.
Ensure that the instance has enough overhead to account for your workload plus some additional overhead.
Recovering a deleted instance. All data on an instance, including backups, is permanently lost when that instance is deleted.To preserve your data, export it to Cloud Storage before you delete an instance.
The Cloud SQL Admin role includes the permission to delete the instance. To prevent accidental deletion, grant this role only as needed.
You want to rename an existing Cloud SQL instance. Renaming an existing instance is not supported.There are other ways to accomplish the goal by creating a new instance.
In both cases, you can delete your old instance after the operation is done. We recommend going with the cloning route since it has no impact on performance and doesn't require you to redo any instance configuration settings such as flags, machine type, storage size and memory.
Error when deleting an instance. If deletion protection is enabled for an instance, confirm your plans to delete the instance. Then disable deletion protection before deleting the instance. Private Service Connect Issue Troubleshooting The service attachment of the instance doesn't accept the Private Service Connect endpoint.To check the status, use the gcloud compute forwarding-rules describe
command.
gcloud compute forwarding-rules describe ENDPOINT_NAME \ --project=PROJECT_ID \ --region=REGION_NAME \ | grep pscConnectionStatus
Make the following replacements:
Before using any of the request data, make the following replacements:
HTTP method and URL:
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME/forwardingRules/ENDPOINT_NAME
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell) Note: The following command assumes that you have logged in to thegcloud
CLI with your user account by running gcloud init
or gcloud auth login
, or by using Cloud Shell, which automatically logs you into the gcloud
CLI . You can check the currently active account by running gcloud auth list
.
Execute the following command:
curl -X GET \PowerShell (Windows) Note: The following command assumes that you have logged in to the
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME/forwardingRules/ENDPOINT_NAME"
gcloud
CLI with your user account by running gcloud init
or gcloud auth login
. You can check the currently active account by running gcloud auth list
.
Execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME/forwardingRules/ENDPOINT_NAME" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
{ "kind": "compute#forwardingRule", "id": "ENDPOINT_ID", "creationTimestamp": "2024-05-09T12:03:21.383-07:00", "name": "ENDPOINT_NAME", "region": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME", "IPAddress": "IP_ADDRESS", "target": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME/serviceAttachments/SERVICE_ATTACHMENT_NAME", "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION_NAME/forwardingRules/ENDPOINT_NAME", "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/default", "serviceDirectoryRegistrations": [ { "namespace": "goog-psc-default" } ], "networkTier": "PREMIUM", "labelFingerprint": "LABEL_FINGERPRINT_ID", "fingerprint": "FINGERPRINT_ID", "pscConnectionId": "CONNECTION_ID", "pscConnectionStatus": "ACCEPTED", "allowPscGlobalAccess": true }
ACCEPTED
. If the status is PENDING
, then the instance isn't allowing the Google Cloud project that contains the endpoint. Make sure that the network project in which the endpoint is created is allowed. For more information, see Edit an instance with Private Service Connect enabled.ERROR: (gcloud.compute.forwarding-rules.create) Could not fetch resource: The resource 'projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME' was not found
This error message can occur when reserving a static internal IP address for the Private Service Connect endpoint. Make sure the subnet specified exists in the project specified by the URI. If you want to create an endpoint in a service project but use a subnet from a Shared VPC network, you need to specify the subnet by its URI and use the host project's project ID in the URI. For more information, see Create the endpoint manually. ERROR: (gcloud.compute.forwarding-rules.create) Could not fetch resource: - The resource 'projects/PROJECT_ID/global/networks/NETWORK_NAME' was not found
This error message can occur when you create a Private Service Connect endpoint manually. Make sure the network specified exists in the project specified by the URI. If you want to create an endpoint in a service project but use a Shared VPC network, you need to specify the network by its URI and use the host project's project ID in the URI. For more information, see Create the endpoint manually. Replication Issue Troubleshooting Read replica didn't start replicating on creation. There's probably a more specific error in the log files. Inspect the logs in Cloud Logging to find the actual error. Unable to create read replica - invalidFlagValue error. One of the flags in the request is invalid. It could be a flag you provided explicitly or one that was set to a default value.
First, check that the value of the max_connections
flag is greater than or equal to the value on the primary.
If the max_connections
flag is set appropriately, inspect the logs in Cloud Logging to find the actual error.
If the error is: set Service Networking service account as servicenetworking.serviceAgent role on consumer project
, then disable and re-enable the Service Networking API
. This action creates the service account necessary to continue with the process.
Restart the replica instance to reclaim the temporary memory space.
Replication stopped. The maximum storage limit was reached and automatic storage increase isn't enabled. Edit the instance to enable automatic storage increase
.
DELETE ... WHERE field < 50000000
cause replication lag with row-based replication since a huge number of updates are piled up on the replica.Some possible solutions include:
Recreate the replica after stopping all running queries.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-09 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-09 UTC."],[],[]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4