Six MySQL Enterprise-only tools convert a free Community server into a $5,350 per year subscription obligation, and five of them are enabled by a single line in a config file
Enterprise Backup, Audit, Firewall, TDE keyring plugins, Masking, and Thread Pool are commercial-only. Any one of them running on a server puts that entire host into paid scope at $5,350 per year for 1 to 4 sockets, $10,700 for 5 or more. Because the enabling action is a plugin load or a cron entry rather than a purchase order, most estates discover the exposure only when Oracle asks for a plugin inventory.
Prepared by Redress Compliance · August 17, 2026 · Oracle advisory. MySQL subscription and audit engagements 2024 to 2026.
Executive summary
The paid boundary in MySQL is not a license key, it is a list of roughly six commercial-only components, and touching any one of them prices the whole server at $5,350 per year.
Community Edition is free under the GPL at unlimited scale, so Oracle's entire commercial claim rests on proving that a specific Enterprise binary or plugin was installed and running on a specific host.
The TDE trigger is not "encryption" in general, it is three named keyring plugins, and Oracle documents the split plugin by plugin in its own manual. keyring_file and component_keyring_file ship in Community, while keyring_encrypted_file, keyring_okv, component_keyring_encrypted_file.
And component_keyring_oci are Enterprise-only, so the difference between free and $5,350 per server is one variable in my.cnf.
Audit log encryption chains two paid components together, turning one compliance requirement into two licensed features on the same host.
MySQL Enterprise Audit stores its log encryption password in the keyring, so setting audit_log_encryption to AES pulls in the Enterprise keyring stack alongside the audit plugin itself.
MySQL Enterprise Monitor went End of Life on January 1, 2025, yet it still appears in estates and still evidences commercial use.
Oracle ceased all bug fixes, security fixes, and feature work at EOL, so a running Monitor agent is a compliance liability with no remaining product value, which makes it the cheapest thing to remove and the strongest thing to concede in a negotiation.
The commercial boundary, component by component
Oracle draws the paid line inside the MySQL Reference Manual, not inside the contract, which is why the boundary reads as documentation rather than as a commercial commitment.
The manual states plainly that keyring_file is shipped in both Community and Enterprise distributions, while keyring_encrypted_file (deprecated as of 8.0.34) and keyring_okv, the KMIP 1.1 plugin for Oracle Key Vault, are Enterprise only.
The same split was recreated in the newer component architecture: component_keyring_file free in both editions as of 8.0.24, component_keyring_encrypted_file Enterprise only as of 8.0.24, component_keyring_oci Enterprise only as of 8.0.31.
Add mysqlbackup, audit_log, the firewall plugins, Masking and De-identification, PAM and Active Directory authentication, and Thread Pool, and you have Oracle's paid tier in full.
Treat the table below as your discovery checklist, not as background reading, and pair it with our MySQL Community versus Enterprise boundary analysis before you answer any Oracle question about plugins.
| Feature | Binary, plugin, or component | Edition | Evidence trail on the host | Free substitute |
|---|---|---|---|---|
| Enterprise Backup | mysqlbackup | Enterprise only | Binary on disk, cron or systemd timer, backup manifest files | mysqldump, Percona XtraBackup, filesystem snapshot |
| Enterprise Audit | audit_log plugin | Enterprise only | SHOW PLUGINS, plugin-load-add in my.cnf, audit.log | General query log, Percona Audit Log plugin |
| Enterprise Firewall | mysql_firewall, component or plugin set | Enterprise only | SHOW PLUGINS, mysql.firewall tables, INSTALL COMPONENT history | ProxySQL rules, application allow-listing |
| TDE keyring, external | keyring_encrypted_file, keyring_okv, component_keyring_encrypted_file, component_keyring_oci | Enterprise only | plugin-load, manifest JSON, keyring status variables | keyring_file, component_keyring_file (both free) |
| Masking and De-identification | data_masking component or plugin | Enterprise only | INSTALL COMPONENT, masking UDFs present in mysql schema | Application-layer masking, views, ETL redaction |
| Enterprise Authentication | authentication_pam, authentication_ldap_sasl (AD) | Enterprise only | SHOW PLUGINS, user account plugin column | Native caching_sha2_password, external proxy auth |
| Enterprise Scalability | thread_pool | Enterprise only | SHOW PLUGINS, thread_pool_size variables | Default one-thread-per-connection, ProxySQL pooling |
The table maps features, but Oracle prices servers. One audit_log plugin on a four-socket host costs exactly what all seven components cost on that same host: $5,350 per year at 1 to 4 sockets, $10,700 at 5 or more. That asymmetry cuts both ways.
It means a single forgotten plugin carries the full subscription weight, and it also means that once a host is legitimately licensed, there is zero incremental cost to using every commercial component on it, so any Oracle attempt to price features separately should be rejected outright.
Two chains deserve separate attention because they light up two paid components from one compliance requirement.
Audit log encryption uses the keyring to store the log file encryption password, so a request to encrypt audit output pulls both Enterprise Audit and an Enterprise keyring into scope in the same change.
Separately, keyring_okv is deprecated in favour of component_keyring_kmip in MySQL 9.x, which means teams re-platforming key management do not exit paid scope, they re-enter it under a new component name.
Why five of the six triggers are set by configuration, not procurement
This is the control failure that matters. Enterprise Backup is the only trigger in the set that requires an engineer to obtain a distinct artefact, the mysqlbackup binary, and even that arrives through a support download portal using credentials the DBA team already holds for patching.
The other five, Audit, Firewall, TDE keyring, Masking, and Thread Pool, are enabled by a line in my.cnf or a single INSTALL COMPONENT statement against a server that already has the code on disk in the Enterprise tarball. No purchase order is raised. No vendor is contacted.
No approval workflow fires. In 25 years of Oracle negotiations, we have never seen a change advisory board reject a plugin load on licensing grounds, because the CAB reviews availability and rollback risk, not entitlement.
The result is a structural gap: change management owns the action, license management owns the consequence, and nothing connects them. A ticket reading "enable audit logging for PCI scope" passes review in four minutes and creates a $5,350 per year obligation per host that nobody records.
Compounding this, the Enterprise binaries and the Community binaries are separate downloads, so an estate that standardised on the Enterprise tarball for convenience has the paid components sitting dormant on every server, one config line away from activation.
Our MySQL Enterprise licensing buyer guide sets out the discovery approach, but the immediate control is narrow and cheap: add a plugin and component check to the pre-production gate, and make SHOW PLUGINS output part of the standard build record.
Oracle Database Options & Management Packs: the accidental-use audit trap
The separately-licensed options and packs that ship enabled by default, get switched on with a single click, and become the single largest line item in most Oracle audit findings.
Get the white paper →The three demand drivers that pull these plugins in
Nobody buys MySQL Enterprise Edition on a whim. In the estates we review, paid scope almost always originates from one of three internal requests, and none of them arrives labeled as a licensing decision.
The first is a regulator or an external auditor asking for database access logging: PCI DSS evidence of privileged activity, SOX change traceability, HIPAA access records. The DBA reaches for MySQL Enterprise Audit because it is in the manual and it produces the format the auditor recognizes.
The second is a security architecture review demanding encryption at rest with keys held outside the host, which forces the move from keyring_file (present in Community) to keyring_okv, component_keyring_oci, or component_keyring_kmip, all Enterprise-only per Oracle's own reference manual.
If that same review also asks for audit log encryption, you have lit up two paid components with one requirement, because Enterprise Audit stores its log encryption password in the keyring.
The third driver is the dangerous one. A DBA facing a connection storm, typically an application server pool that opens thousands of concurrent sessions, enables Thread Pool because it is the documented fix and it works in an afternoon.
Thread Pool sits inside MySQL Enterprise Scalability, so it carries the same $5,350 per server per year for 1 to 4 sockets and $10,700 for 5 or more. Unlike audit or TDE, it has no compliance sponsor, no security architect, no project code, and no budget conversation attached.
It is a performance patch made under pressure by someone with root and no visibility into the price list, and it is invisible until Oracle asks for a plugin inventory.
Our Community versus Enterprise threshold analysis covers the substitution path (ProxySQL connection multiplexing) that costs nothing and solves the same problem.
Analysis: Oracle built MySQL's paid tier out of things you are required to do
Compare the composition of MySQL's commercial tier with Oracle Database's. In Oracle Database, the priced options are largely performance and convenience: Partitioning, In-Memory, Advanced Compression, RAC, Diagnostics and Tuning Pack. They make a workload faster or an administrator's life easier.
A buyer can decline them, accept a slower report, and remain fully functional and fully compliant. The MySQL commercial set is built on a different principle.
Enterprise Audit, Transparent Data Encryption, external key management, Masking and De-identification, and Enterprise Authentication against PAM or Active Directory are not luxuries.
They are the controls that PCI DSS, SOX, HIPAA, GDPR, and internal security standards force onto any database holding regulated data. Oracle did not put the fast features behind the paywall. It put the mandatory ones there.
That distinction changes the negotiation completely. For a regulated estate, the subscription is functionally non-optional while remaining nominally optional in the contract.
Oracle never has to argue that you need Enterprise Edition, because your auditor, your PCI assessor, or your own CISO makes that argument first, internally, for free. This is precisely why Oracle can withdraw list pricing from public view and still expect the sale.
Current guidance from Oracle's own channels tells prospects that Enterprise Edition pricing depends on server count, support tier, and contract length, and directs them to contact sales.
A vendor with unpublished pricing and a captive requirement is in an unusually comfortable position, and most buyers walk into the first quote conversation having already conceded the only point that mattered.
So do not fight the features. Fight the count. The subscription is priced per server by socket band, not per instance, not per core, and not per named user, which means the entire commercial exposure is a function of how many hosts have a paid plugin loaded.
That is a variable you control through architecture, not procurement.
Consolidating audit logging onto a defined subset of hosts, keeping Thread Pool out of read replicas, and confining external key management to the servers that actually store regulated data are all engineering decisions that move the invoice by tens of thousands of dollars.
Our breakdown of the per-server socket metric and its virtualization trap shows where the count inflates fastest, particularly on guests reporting eight or more vCPUs that land in the $10,700 band.
The second lever is substitution, and it is stronger in MySQL than in almost any other Oracle product line, because credible free equivalents exist for four of the six triggers. Percona Audit Log Plugin produces access logging that satisfies most assessors.
Percona XtraBackup performs hot, non-blocking InnoDB backups, the exact capability Oracle markets as Enterprise Backup's differentiator. ProxySQL absorbs connection storms without Thread Pool.
HashiCorp Vault paired with community keyring_file gets external key custody into the conversation, though it does not replicate the KMIP integration cleanly.
Masking and Enterprise Authentication are the two where substitution is genuinely harder, and those are exactly the two most buyers forget to inventory.
What substitution does is cap what the subscription is worth.
If the alternative stack costs you 200 engineering hours to stand up and maintain, then Enterprise Edition's defensible value on a 40 server estate is bounded by that number plus the value of Oracle indemnified support, not by $214,000 of list price.
Do that arithmetic before the renewal call, per host, with named substitutes and named effort.
In our negotiation experience, buyers who arrive with a documented substitution plan and a reduced host count settle materially below list, while buyers who arrive with a plugin inventory and no alternative settle at whatever the discount schedule offers.
There is a final asymmetry worth naming. Unpublished pricing is usually read as a vendor advantage, and against an unprepared buyer it is. But it also means Oracle has no public floor to defend and no published number it must hold to protect other accounts.
The buyer who has done the substitution math and can state a walk-away figure per server is negotiating against a price that is, by Oracle's own choice, entirely a matter of argument. Use that.
Where the server metric multiplies the trigger
The plugin decision is binary, but the price of that decision is set by a metric you do not control after the fact.
Oracle licenses MySQL per server, counting occupied sockets on which the program is installed and/or running, and cores are explicitly ignored: a socket is a slot housing a chip or multi-chip module containing one or more cores, and each chip counts as one socket regardless of core count.
On modern physical hardware that definition works in your favour. A dual-socket box with 64 cores per chip is a 1-to-4 socket server at $5,350 per year, whatever the workload.
The inversion happens on virtual estates, where a guest reporting eight vCPUs gets argued into the 5-or-more band at $10,700, doubling the cost of the same single plugin load.
That argument is winnable, but only if you can produce host-level socket evidence at the time of the discussion rather than three months later.
The larger multiplier is the configuration template. One my.cnf carrying audit_log, a firewall plugin, or a keyring entry does not stay on one host.
It propagates to the read replicas, the DR standby, the UAT tier, and the developer boxes that were cloned from production, and Oracle's position is that installed and/or running counts on each of them.
In our review work this is the single mechanism that turns a three-server production footprint into a fifteen-server claim. On a fifteen-host estate at the low band, that is $80,250 per year against $16,050 for the three hosts anyone intended to license.
See our breakdown of the per-server subscription metric for how the socket count is evidenced.
The identical audit_log load costs twice as much if a virtual guest is accepted into the 5-plus socket band.
One shared my.cnf carried Enterprise plugin directives to replicas, standbys, and non-production, typical of what we see in review work.
Remediating one host is a change ticket. Remediating a configuration template is a release cycle, a replication rebuild, and a conversation with whoever owns the golden image.
The cost gap between those two projects is why the socket band argument, which is worth $5,350 per host, is usually the second priority. The first is establishing how many hosts inherited the directive, because that number sets the multiplier on every other figure in the negotiation.
my.cnf and included fragment across the estate, not just production, and record host socket counts from the hypervisor layer with dates. Evidence collected pre-inquiry is negotiation material; evidence collected during an inquiry is confirmation.Evidence base: what Oracle actually asks for and what turns up
Oracle's MySQL commercial-use reviews are narrow and technical, which makes them easy to prepare for and easy to fail unprepared.
The requests we see repeatedly are SHOW PLUGINS output per instance, INSTALL COMPONENT history from mysql.component, filesystem presence of the mysqlbackup binary and its cron or scheduler entries, My Oracle Support download and patch-access logs tied to your CSI, and the value of audit, firewall.
Keyring, and thread pool variables in every configuration file and include.
The download log matters more than most teams expect: pulling the Enterprise tarball from MOS is a documented act of commercial-use, independent of whether the plugin was ever loaded.
Four patterns account for most of what actually surfaces. First, template propagation: a directive intended for one compliance-scoped instance appears in the base config for the whole estate.
Second, Enterprise Monitor agents still running after the January 1, 2025 end of life, collecting for a console that is no longer supported and no longer sold, which is expensive because it is pure sunk exposure with zero remaining product value.
Third, Masking and De-identification and PAM or Active Directory authentication, the two most-forgotten triggers, usually installed years earlier by a security team that treated them as MySQL features rather than as purchases.
The parallel with Oracle Database is exact, and our note on the privacy control that quietly buys an Oracle option covers the same failure pattern.
Fourth, keyring_okv deployments, which are Enterprise-only today and are being replaced by component_keyring_kmip, meaning a key management re-platform re-enters paid scope under a new name unless the target is component_keyring_file.
Read the chain effects too. Audit log encryption requires the keyring, so one PCI or GDPR requirement lights up two commercial components on the same host.
Your defensible position is a dated, self-collected plugin and component inventory across all tiers, produced before any inquiry, with a documented remediation date for anything you intend to drop. Absent that, Oracle sets both the population and the socket band.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Inventory plugins and components on every host, not just production. Run a query against the plugin and component tables on all instances, including replicas, DR standbys, dev, test, and forgotten VM templates, because a replica running audit_log or a keyring_okv plugin is a separately licensable server at $5,350 per year for 1 to 4 sockets, and in our experience non-prod is where two thirds of unbudgeted triggers sit.
- Remove Enterprise Monitor agents before Oracle asks about them. Agents left behind after trials or after MEM was retired keep reporting installed commercial code on hosts you never intended to license; document the removal date and the ticket number, then treat any residual agent as a defect to be fixed in the same maintenance window rather than a licensing conversation to be had later.
- Price the free substitution stack per trigger before you take an Oracle call. Percona XtraBackup for mysqlbackup, community keyring_file or component_keyring_file for the Enterprise keyring variants, and Percona audit plugins for Enterprise Audit each turn a per-server obligation into an engineering task; walking in with a costed alternative for all six components is what converts a compliance discussion into a commercial one, as set out in MySQL Community versus Enterprise.
- Fix the socket declaration for virtual guests in writing. Oracle counts occupied sockets, not vCPUs, so get the hypervisor host socket count confirmed by email before any quote; an eight vCPU guest miscounted into the 5 or more band doubles the line to $10,700 per server per year, and the per-server metric guide explains how that band is constructed.
- Negotiate on a defensible server count, never a feature list. Hand Oracle a signed count of hosts that genuinely require paid components after remediation, since every feature you concede in discussion invites a per-host multiplier you have not verified.
Frequently asked questions
Which MySQL features require a paid Oracle subscription?
Six families are commercial-only: MySQL Enterprise Backup (the mysqlbackup binary), Enterprise Audit, Enterprise Firewall, Transparent Data Encryption via the Enterprise keyring plugins, Masking and De-identification.
And Enterprise Authentication plus Thread Pool under the Enterprise Scalability banner.
Running any one of them on a host puts that entire server into paid scope. The price is the same whether you use one feature or all six.
Does using TDE in MySQL always require Enterprise Edition?
No, and this is the most misunderstood point in the estate. keyring_file and component_keyring_file ship in Community Edition and support InnoDB tablespace encryption.
It is keyring_encrypted_file, keyring_okv (the KMIP plugin for Oracle Key Vault), component_keyring_encrypted_file, and component_keyring_oci that are Enterprise-only. The trigger is the key storage back end, not encryption itself.
How much does MySQL Enterprise Edition cost per server?
Current list is $5,350 per year for a server with 1 to 4 sockets and $10,700 for 5 or more sockets, including Oracle Premier Support. Standard Edition sits below at roughly $2,140 to $6,420 for the 1 to 4 socket band.
Ignore the $5,000 and $10,000 figures still circulating on review sites, those are 2016 price list numbers.
Is MySQL Enterprise Monitor still licensable?
Oracle declared MySQL Enterprise Monitor End of Life as of January 1, 2025, meaning no further bug fixes, security fixes, or feature work. A running Monitor agent still evidences commercial feature use in an audit while delivering no supported product.
Remove it first, it is the highest ratio of compliance risk to remaining value in the estate.
Can Oracle detect which MySQL features we are using?
Yes, through several routes. SHOW PLUGINS and component tables expose loaded Enterprise plugins, my.cnf shows audit_log and firewall variables, the mysqlbackup binary is visible on disk, and My Oracle Support download logs record who pulled Enterprise packages and when.
Assume any of these is discoverable and build your position on facts rather than on hoping the scan misses something.
What are the free substitutes for MySQL Enterprise features?
Percona Server ships an audit log plugin and its own PAM authentication, Percona XtraBackup performs hot InnoDB backups, ProxySQL and application-layer controls cover much of what Enterprise Firewall does, and community keyring_file with an external secret manager covers many TDE requirements.
Price this stack before any Oracle call, because it caps what the $5,350 per server subscription is actually worth to you.
Do replicas and non-production servers need their own subscription?
Yes, if they run the commercial feature. Oracle licenses per server based on occupied sockets where the program is installed or running, with no free allowance for standby, DR, or test hosts.
This is why a propagated my.cnf template is the most expensive artifact in a MySQL estate: three intended servers routinely becomes fifteen licensable ones.
