When access_denied_errors status variable is incremented

access_denied_errors status variable is incremented when someone tries to access something they do not have rights to.

This happens in the following cases:

• When accessing a database, table or columns that the user does not have rights to access. This error is sent to the client.
• When a login fails because of wrong user/password etc. The error is printed to the general log.
• If require_secure_transport option is enabled in the server and the user is not used a secure transport. The error is sent to the user.
• The user is trying to change to a database/schema he does not have access to. A warning is written to the error log if log_warnings > 1.
• The user is trying to use a SHOW command to access an object he do not have rights to see. The error is sent to the client.
• The user is accessing something that requires global access, like "CREATE SERVER". The error is sent to the client.

Login failures one can find in the general log. The errors that are sent to the user can be found by using the sql-error-log-plugin. The plugin captures all errors sent to the client. Starting from 10.11.5 forwards, it can also optionally capture all warnings sent to the client.