[DOC] Add clear documentation for PMM MySQL user with and without SUPER privileges.

Description

Currently, PMM1 and PMM2 documentation has the following details for SUPER privileges:

PMM2 Doc:  https://www.percona.com/doc/percona-monitoring-and-management/2.x/setting-up/client/mysql.html#setting-up-client-user

It is good practice to use a non-superuser account to connect PMM Client to the monitored database instance. This example creates a database user with name pmm, password pass, and the necessary permissions.

 

Expectation: Add Example without SUPER privileges and also add details what user can not do without SUPER privileges access.

Ref: https://forums.percona.com/t/super-privileges-for-pmm-user/6802/2

PMM1 Doc: https://www.percona.com/doc/percona-monitoring-and-management/1.x/conf-mysql.html#creating-a-mysql-user-account-to-be-used-with-pmm

When adding a MySQL instance to monitoring, you can specify the MySQL server superuser account credentials. However, monitoring with the superuser account is not secure. If you also specify the --create-user option, it will create a user with only the necessary privileges for collecting data.

You can also set up the pmm user manually with necessary privileges and pass its credentials when adding the instance.

The superuser credentials are required only to set up the pmm user with necessary privileges for collecting data.* If you want to create this user yourself, the following privileges are required: <--- This is bit confusing It says "If you want to create this user yourself" and in the example, it has SUPER privileges.

So if you already created a user for PMM in MySQL manually then SUPER privileges not needed.

Expectation: Correct the example

 

How to test

None

How to document

None

AFFECTED CS IDs

CS0017397 CS0018339 CS0026159

Smart Checklist

Activity

Show:

Roma Novikov June 22, 2023 at 12:30 PM

fixed in

Lalit Choudhary May 22, 2023 at 7:26 AM

I do not see Doc issue anymore as it's not using SUPER privilege for pmm user anymore.

Create a database account for PMM

It is good practice to use a non-superuser account to connect PMM Client to the monitored database instance. This example creates a database user with name pmm, password pass, and the necessary permissions.

On MySQL 8.0

CREATE USER 'pmm'@'localhost' IDENTIFIED BY 'pass' WITH MAX_USER_CONNECTIONS 10;GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD, BACKUP_ADMIN ON *.* TO 'pmm'@'localhost';
On MySQL 5.7

CREATE USER 'pmm'@'localhost' IDENTIFIED BY 'pass' WITH MAX_USER_CONNECTIONS 10;GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD ON *.* TO 'pmm'@'localhost';

duygu.aksoy March 3, 2023 at 5:38 AM

can you please collaborate with and improve our doc? Thank you

Done

Details

Assignee

Reporter

Priority

Needs QA

No

Needs Doc

Yes

Story Points

Affects versions

Smart Checklist

Created April 29, 2021 at 9:13 AM
Updated March 6, 2024 at 2:48 AM
Resolved June 22, 2023 at 12:30 PM