@Rocky I'm currently trying to connect metabase cloud to a self hosted starrocks 4.0 instance. I have gone through the current connecting to metabase docs, and am connecting to the cluster via ssh through a bastion box. However, while I am able to connect with the SSH server, as well as connect with the starrocks cluster using other tools like datagrip, I get the following error in metabase

Could not connect to address=(host=localhost)(port=35529)(type=master) : Could not connect to localhost:35529 : unexpected end of stream, read 0 bytes from 4 (socket was closed by server)

Looks like Starrocks is closing the initial tcp handshake. Where would I go to figure out what's the issue with this and why is this metabase specific.

This error message—specifically the *"unexpected end of stream, read 0 bytes from 4"*—typically indicates that the network connection was established (the TCP handshake completed), but the StarRocks FE closed the connection immediately before sending the MySQL handshake packet or as soon as the client tried to send its first request. Since you mentioned DataGrip works via the same bastion, the network path is likely fine, and the issue is likely a protocol or configuration mismatch specific to the driver Metabase uses (which is the MariaDB JDBC driver). Here is how to troubleshoot and resolve this: 1. Check the StarRocks FE Logs This is the most direct way to see why the connection was rejected. * Log into your StarRocks FE node. * Check

fe/log/fe.log

and

fe/log/fe.warn.log

. * Look for error messages around the time of the failed connection, such as: *

Connect processor exception

*

Handshake failed

*

Execution of MySQL protocol failed

*

IP is not allowed to connect

(though less likely since DataGrip works). 2. Explicitly Disable SSL in Metabase Metabase's MySQL driver often defaults to attempting an SSL connection. If SSL is not explicitly configured on your StarRocks cluster, the FE might drop the connection immediately when it receives an SSL request packet it doesn't understand. In the Additional JDBC connection string options field in Metabase, append the following:

text
tinyInt1isBit=false&useSSL=false&allowPublicKeyRetrieval=true

* `tinyInt1isBit=false`: Mandatory for StarRocks-Metabase integration. * `useSSL=false`: Forces the driver not to use SSL. * `allowPublicKeyRetrieval=true`: Helps if you are using newer authentication methods. 3. Verify the "Database Host" in Metabase Tunnel Settings If you are using Metabase Cloud's native SSH Tunnel feature: * Database Host: This should be the internal IP address or hostname of your StarRocks FE as seen by the bastion box, not

localhost

. * Database Port: Usually

9030

(StarRocks MySQL query port). * SSH Tunnel Host: The public IP of your bastion. If you put

localhost

in the "Database Host" field, Metabase will tell the bastion to connect to its own

localhost:9030

. This only works if StarRocks is running on the same machine as the bastion. 4. Check Authentication Plugin Compatibility StarRocks defaults to

mysql_native_password

. If your Metabase driver is attempting to use a different mechanism (like

caching_sha2_password

which is the default in MySQL 8.0), it might cause friction. Ensure your StarRocks user is created with a standard password:

sql
ALTER USER 'your_user'@'%' IDENTIFIED WITH mysql_native_password BY 'your_password';

5. Check StarRocks FE

query_port

Confirm that the port you are tunneling to is indeed the

query_port

(default

9030

) and not the

rpc_port

(default

9020

) or

http_port

(default

8030

). DataGrip works, so double-check that the port number in Metabase matches the one working in DataGrip. Summary of Recommended Settings in Metabase: * Database Type: MySQL * Host: [Internal IP of StarRocks FE] * Port: 9030 * Additional JDBC connection string options:

tinyInt1isBit=false&useSSL=false

References • integrations/BI_integrations/Metabase.md • faq/operation_maintenance_faq.md • administration/Meta_recovery.md