Finding which MySQL/MariaDB tables are modified by a GUI

I was working with Keycloak realm private/public key automation and it was not immediately obvious where Keycloak stores the keys. Figuring it out was actually easy, and this method applies to any web application that uses MySQL/MariaDB, not just Keycloak.

Anyhow, on Ubuntu, you’d navigate to /var/lib/mysql/name-of-database. For example:

cd /var/lib/mysql/keycloak

Make sure that no changes have been made recently (within one minute):

$ find -mmin -1

Then go to the web application and change whatever you’re trying to locate from the database. Here I changed the Keycloak RSA key priority. Then run the find command again:

$ find -mmin -1
./COMPONENT_CONFIG.ibd

And there it is, in the COMPONENT_CONFIG table in the keycloak database.

Using find in this way is a very useful technique and I’ve been using it for years. But somehow I had never done it in this particular use-case, which is why I chose to document it now.