> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MySQL

> MySQL server performance and health metrics, including buffer pool, connections, commands, query throughput, and index usage.

The MySQL integration requires CXDOT Collector 1.4.0 or greater.

[MySQL](https://www.mysql.com/) is a relational database for transactional
applications. Use the MySQL integration with the Chronosphere XDOT Collector to collect
connection, query, and storage metrics from MySQL servers running in your environment.

The MySQL integration supports MySQL 8.4 or greater.

## Supported telemetry types

The MySQL integration supports these telemetry types:

| Type    | Supported |
| ------- | --------- |
| Logs    | Yes       |
| Metrics | Yes       |
| Traces  | No        |
| Events  | No        |

## Prerequisites

The MySQL integration has the following prerequisites:

* Enable the MySQL Performance Schema. To confirm the setting, run:

  ```sql theme={null}
  SHOW VARIABLES LIKE 'performance_schema';
  ```

  Confirm that the value is `ON`.

* Create a MySQL account for the collector. For the complete metric set, grant the
  account the following privileges:

  ```sql theme={null}
  GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'cxdot'@'%';
  GRANT SELECT ON performance_schema.* TO 'cxdot'@'%';
  GRANT SELECT ON mysql.innodb_index_stats TO 'cxdot'@'%';
  ```

  Replace `cxdot` and `%` with the account name and allowed host for your environment.

* Make port `3306`, or your custom MySQL port, reachable from the collector.

## Configure

To configure the MySQL integration, follow these steps:

1. For discovered MySQL targets, provide the endpoint and credentials through
   autodiscovery annotations.

   For more information, see
   [autodiscovery](https://docs.chronosphere.io/ingest/cxdot-collector/autodiscovery).

2. Optional: Configure static targets as an alternative to autodiscovery, and provide
   the password through your deployment's secret management. For example, the
   following Helm values reference the `MYSQL_PASSWORD` environment variable:

   ```yaml theme={null}
   config:
     integrations:
       mysql:
         instances:
           - endpoint: mysql.default.svc:3306
         username: cxdot
         password: "${env:MYSQL_PASSWORD}"
   ```

### Validate

To validate the MySQL integration, follow these steps:

1. In the Live Telemetry Analyzer, filter for `cxdot.integration.name=mysql`. Confirm
   that the MySQL metric names appear.

2. In Metrics Explorer, run the following query while the MySQL servers handle query
   traffic:

   ```text theme={null}
   sum by ("server.address", "server.port") (rate({"mysql.query.count"}[$__rate_interval]))
   ```

   Confirm that the query returns the expected time series for each target.

For more information about diagnosing a failing integration, see
[Troubleshooting](https://docs.chronosphere.io/ingest/cxdot-collector/troubleshooting).

## Configuration reference

Configure one MySQL integration instance with the following settings. In Helm values, place
these settings under `config.integrations.mysql`. In a Collector configuration file, place them
under `cxdot.integrations.mysql`.

### Optional settings

* **`enabled`**
  Type: `boolean`. Optional. Default: `true`.
  Whether to run the MySQL integration. If true, the Collector collects MySQL metrics. If false,
  the Collector doesn't run this integration.

* **`username`**
  Type: `string`. Optional. Default: `root`.
  MySQL username for connections to statically configured targets.

* **`password`**
  Type: `string`. Optional.
  MySQL password for connections to statically configured targets. The Collector masks this
  value in diagnostic output, logs, and errors.

* **`database`**
  Type: `string`. Optional.
  Database to use for connections to statically configured targets.

* **`allow_native_passwords`**
  Type: `boolean`. Optional. Default: `true`.
  If true, permits MySQL native password authentication. If false, rejects connections that
  require the native password authentication method.

* **`collection_interval`**
  Type: `duration`. Optional. Default: `10s`.
  Time between metric collections from each MySQL target.

* **`timeout`**
  Type: `duration`. Optional. Default: `10s`.
  Maximum time to wait for each MySQL metric collection.

* **`instances`**
  Type: `array of object`. Optional.
  Static MySQL targets. Each entry's `endpoint` is `host:port`, for example,
  `mysql.default.svc:3306`. When this list isn't empty, the integration collects from exactly
  these targets instead of targets found through discovery annotations. If no static or
  discovered targets exist, the integration doesn't collect metrics.

* **`instances[].endpoint`**
  Type: `string`. Required.
  MySQL target in `host:port` format.

* **`tls`**
  Type: `object`. Optional.
  TLS settings for connections to statically configured MySQL targets. When set, the connection
  uses TLS and verifies the server certificate. Set `insecure_skip_verify` to true to skip
  certificate verification, or set `insecure` to true to use an unencrypted connection.

* **`tls.ca_file`**
  Type: `string`. Optional.
  Path to the CA cert. For a client this verifies the server certificate. For a server this
  verifies client certificates. If empty uses system root CA. (optional)

* **`tls.ca_pem`**
  Type: `string`. Optional.
  In memory PEM encoded cert. (optional)

* **`tls.cert_file`**
  Type: `string`. Optional.
  Path to the TLS cert to use for TLS required connections. (optional)

* **`tls.cert_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS cert to use for TLS required connections. (optional)

* **`tls.cipher_suites`**
  Type: `array of string`. Optional.
  CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a
  safe default list is used. See
  [https://go.dev/src/crypto/tls/cipher\_suites.go](https://go.dev/src/crypto/tls/cipher_suites.go)
  for a list of supported cipher suites.

* **`tls.curve_preferences`**
  Type: `array of string`. Optional.
  contains the elliptic curves that will be used in an ECDHE handshake, in preference order
  Defaults to empty list and "crypto/tls" defaults are used, internally.

* **`tls.include_system_ca_certs_pool`**
  Type: `boolean`. Optional.
  If true, load system CA certificates pool in addition to the certificates configured in this
  struct.

* **`tls.insecure`**
  Type: `boolean`. Optional.
  In gRPC and HTTP when set to true, this is used to disable the client transport security. See
  [https://godoc.org/google.golang.org/grpc#WithInsecure](https://godoc.org/google.golang.org/grpc#WithInsecure)
  for gRPC. Please refer to
  [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for more
  information. (optional, default false)

* **`tls.insecure_skip_verify`**
  Type: `boolean`. Optional.
  InsecureSkipVerify will enable TLS but not verify the certificate.

* **`tls.key_file`**
  Type: `string`. Optional.
  Path to the TLS key to use for TLS required connections. (optional)

* **`tls.key_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS key to use for TLS required connections. (optional)

* **`tls.max_version`**
  Type: `string`. Optional.
  MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls
  for defaults. (optional)

* **`tls.min_version`**
  Type: `string`. Optional.
  MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used.
  (optional)

* **`tls.reload_interval`**
  Type: `duration`. Optional.
  ReloadInterval specifies the duration after which the certificate will be reloaded If not set,
  it will never be reloaded (optional)

* **`tls.server_name_override`**
  Type: `string`. Optional.
  ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig.
  Please refer to [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for
  more information. (optional)

* **`tls.tpm`**
  Type: `object`. Optional.
  Trusted platform module configuration

* **`tls.tpm.auth`**
  Type: `string`. Optional.
  Authorization value for the trusted platform module key.

* **`tls.tpm.enabled`**
  Type: `boolean`. Optional.
  Whether to use a trusted platform module for the TLS private key. If true, the Collector loads
  the key from the configured device or socket. If false, the Collector uses the configured key
  file or in-memory key.

* **`tls.tpm.owner_auth`**
  Type: `string`. Optional.
  Owner authorization value for the trusted platform module.

* **`tls.tpm.path`**
  Type: `string`. Optional.
  The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.


## Related topics

- [SQL DB Input source plugin](/ingest/pipeline/plugins/source-plugins/sqldb.md)
- [Notification policies](/investigate/alerts/notifications/policies.md)
- [Create a Slack notifier](/investigate/alerts/notifications/notifiers/slack.md)
- [Logging query syntax](/investigate/querying/query-logs/query-syntax.md)
- [Querying DogStatsD formatted metrics](/ingest/metrics-traces/collector/mappings/datadog/dogstatsd.md)