When examining MySQL process trees on Linux systems (particularly CentOS/RHEL), you'll typically find two related processes:

mysql     1234  0.0  2.1 123456 7890 ?        S    Jan01   0:00 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
root      1235  0.0  0.1  12345  678 ?        S    Jan01   0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock

mysqld_safe is a shell script that serves several critical functions:

• Restarts mysqld if it crashes
• Logs runtime information to error logs
• Sets up environment variables
• Provides security features like --user switching

Yes, it's completely normal and expected for both processes to run simultaneously. Here's why:

# Typical process hierarchy
systemd (PID 1)
├─ mysqld_safe (as root)
   └─ mysqld (as mysql user)

The root-owned mysqld_safe acts as a parent process that monitors the actual MySQL daemon (mysqld). This two-process architecture is by design and documented in MySQL's official documentation.

While mysqld_safe runs as root initially, it drops privileges when starting mysqld through the --user parameter. You can verify this with:

# Check effective user
ps aux | grep mysql

# Verify privilege dropping in logs
grep -i "running as" /var/log/mysqld.log

If you see multiple mysqld processes without mysqld_safe, or vice versa, that indicates problems:

# Check for orphaned processes
sudo pstree -p | grep -A5 mysql

# Proper shutdown procedure
sudo systemctl stop mysqld
sudo systemctl status mysqld

With newer distributions using systemd, the startup process has evolved but maintains similar characteristics:

# Systemd unit file typically calls mysqld_safe
cat /usr/lib/systemd/system/mysqld.service

# Example snippet from unit file
[Service]
ExecStart=/usr/bin/mysqld_safe --basedir=/usr

When examining MySQL processes on a CentOS server, you'll typically see two main components:

mysql    1234  1.2  2.1 1023456 54321 ?   Ssl  May10  12:34 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql
root     1235  0.1  0.5  123456  9876 ?    S    May10   0:12 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock

mysqld_safe is a shell script that serves as a wrapper for the main MySQL server process (mysqld). Its primary purposes include:

• Monitoring and restarting mysqld if it crashes
• Logging error messages to the error log
• Setting up environment variables
• Handling system signals properly

In a healthy MySQL installation, you should see:

ps -ef | grep mysql
root     12345     1  0 May10 ?        00:00:00 /bin/sh /usr/bin/mysqld_safe
mysql    12346 12345  2 May10 ?        01:23:45 /usr/libexec/mysqld

Potential issues to watch for:

1. Multiple mysqld instances running (indicates improper shutdown)
2. mysqld_safe process without a corresponding mysqld process
3. Both processes running as root (security concern)

For optimal setup in /etc/my.cnf:

[mysqld]
user = mysql
datadir = /var/lib/mysql
socket = /var/lib/mysql/mysql.sock

[mysqld_safe]
log-error = /var/log/mysqld.log
pid-file = /var/run/mysqld/mysqld.pid

Modern CentOS versions use systemd. Check the service status:

systemctl status mysqld
● mysqld.service - MySQL Server
   Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2023-05-10 12:34:56 UTC; 1 day ago

If you suspect problems with the process management:

# Check for zombie processes
ps aux | grep -i mysql | grep -i defunct

# Verify proper shutdown
mysqladmin -u root -p shutdown

# Force cleanup if needed
killall -9 mysqld mysqld_safe
rm -f /var/lib/mysql/mysql.sock
rm -f /var/run/mysqld/mysqld.pid

Key security considerations:

• mysqld should always run as the mysql user, not root
• mysqld_safe starts as root but drops privileges
• File permissions should be set correctly:

  chown -R mysql:mysql /var/lib/mysql
  chmod 700 /var/lib/mysql