Who Is Using What? - Building a MySQL Audit Plugin & Governance Pipeline at Booking.com Scale

At Booking.com, we run hundreds of MySQL clusters serving millions of queries a day, shared across many services owned by many teams across the organization. Over the years, ownership blurs. Tables outlive the services that created them, access patterns accumulate from teams that have reorganized, and when it is time to change a schema, deprecate a table, or plan a migration, nobody has a confident answer to a very basic question: Who is using what?

We needed hard database-side evidence, but standard tools—like the Slow Log, Performance Schema, and general query log—fell short due to performance overhead or missing operational context. So we built the foundation ourselves: a low-overhead, custom MySQL audit plugin and ingestion pipeline that captures live query streams directly inside the server at ~200 microseconds of overhead per query with zero sampling, even on our busiest clusters.

With this granular usage dataset finally flowing, we are now building database governance tooling directly on top of it. In this talk, I will walk through:

• The challenges of shared MySQL architectures and why native logging/tracing fell short.
• The architecture of our custom audit plugin and collection pipeline.
• The practical governance tooling we are building on top: recommending schema splits based on real table access, detecting services reading from the primary instead of replicas, and enforcing single-writer boundaries.

You will leave with a reusable architectural pattern for gathering per-query usage data in production, and practical ideas for turning raw query telemetry into automated database governance pipeline.