5.2 Creating MySQL User Accounts for the Monitor Agent

The MySQL Enterprise Monitor Agent requires a user configured within each MySQL instance that is being monitored with suitable privileges to collect information about the server, including variable names, replication, and storage engine status information.

The Agent requires the Admin user, and can optionally use General or Limited users, or both, depending on the system's security requirements. During the installation process, you are prompted to create General and Limited users. You can allow the agent to connect to the database using the Admin user for all tasks but it is recommended to create the General or Limited users for tasks which do not require root access to the database. It is not necessary to create both users. It is possible to create one or the other. The Agent uses the user with the lowest, required privileges for the query and changes to a user with higher privileges only if the query requires it.

Creating the Admin User

If you do not want to supply the root user information to the installer, create a user manually within your MySQL server and provide these credentials as the agent user/password combination during installation. The privileges required for this user account vary depending on the information you gather using the MySQL Enterprise Monitor Agent. The following privileges allow the Monitor Agent to perform its assigned duties without limitation:

  • SHOW DATABASES: The MySQL Enterprise Monitor Agent can gather inventory about the monitored MySQL server.

  • REPLICATION CLIENT: The MySQL Enterprise Monitor Agent can gather Replication master/slave status data. This privilege is only needed if you use the MySQL Replication Advisor Rules.

  • SELECT: The MySQL Enterprise Monitor Agent can collect statistics for table objects.

  • SUPER: The MySQL Enterprise Monitor Agent can execute SHOW ENGINE INNODB STATUS to collect data about InnoDB tables. This privilege is also required to obtain replication information using SHOW MASTER STATUS, and to temporarily switch off replication when populating the mysql.inventory table used to identify the MySQL instance.

  • PROCESS: When monitoring a MySQL server running MySQL 5.1.24 or above with InnoDB, the PROCESS privilege is required to execute SHOW ENGINE INNODB STATUS.

  • INSERT: Required to create the UUID required by the agent.

  • CREATE: The MySQL Enterprise Monitor Agent can create tables. During discovery, the agent creates the table inventory within the mysql database that stores the UUID for the server. Without this table, the agent cannot determine the UUID of the server, which it sends along with other information to MySQL Enterprise Service Manager.

For example, the following GRANT statement gives the agent the required SELECT, REPLICATION CLIENT, SHOW DATABASES and SUPER rights:

  ON *.*
  TO  'mysqluser'@'localhost'
  IDENTIFIED BY 'agent_password';

When using Auto-Create Less Privileged Users, also add WITH GRANT OPTION to the above query.

For security reasons, you might limit the CREATE and INSERT privileges to the agent so that it can only create tables within the mysql database:

  ON mysql.*
  TO  'mysqluser'@'localhost'
  IDENTIFIED BY 'agent_password';

To let replication discovery work, grant the SELECT privilege on the mysql.inventory table for each user with replication privileges on the corresponding replication master. This is required to let the MySQL Enterprise Monitor Agent read the replication master UUID. For example:

  ON mysql.inventory
  TO  'replicationuser'@'%'
  IDENTIFIED BY 'replication_password';

Perform this step after after running the agent on the corresponding MySQL server to ensure that the mysql.inventory table is created correctly. Run the agent, shut the agent down, run the above GRANT statement, and then restart the agent.

If the agent cannot access the information from the table, a warning containing this information is written to the agent log.


You might disable logging for the grant statement to prevent the grant information being replicated to the slaves. In this case, execute the statement SET SQL_LOG_BIN=0 before executing the above GRANT statement.

Creating the Limited and General Users

If the Admin user has the necessary privileges to create other users, you can check the Auto-Create Less Privileged Users checkbox, enter credentials for those users, and they will be created for you.

If the Auto-Create Less Privileged Users box is unchecked and the credentials for the General and Limited users blank, the Agent won't know about the less privileged users and can't use them, and will only use the Admin user for monitoring.

If the Auto-Create Less Privileged Users box is unchecked, you can enter credentials for the General and Limited users, in which case you must create these less privileged users yourself. The installer attempts to validate these users and emits a warning message if they are invalid. The installation process will still continue in this case and the Agent will work properly, provided that you create those users later.

In a typical configuration, the Agent runs on the same host as the MySQL server it is monitoring, so the host name is often localhost. If the Agent is running on a machine other than the monitored MySQL server(s), then change localhost to the appropriate value. For more information about remote monitoring, see Section 5.9, “Configuring an Agent to Monitor a Remote MySQL Server”.