How to Monitor MySQL with Prometheus mysqld_exporter on RHEL 7

How to Monitor MySQL with Prometheus mysqld_exporter on RHEL 7

Prometheus is an open-source monitoring system that scrapes metrics from instrumented targets at regular intervals and stores them in a time-series database. For MySQL monitoring, the official mysqld_exporter binary exposes hundreds of MySQL performance schema metrics, InnoDB statistics, replication lag, and query throughput in the Prometheus format. Combined with Grafana and a pre-built dashboard, you get professional-grade MySQL observability in under an hour. This guide covers creating a dedicated MySQL monitoring user, deploying the exporter binary on RHEL 7, configuring it as a systemd service, wiring it into Prometheus, and loading the popular Grafana dashboard ID 7362.

Prerequisites

• RHEL 7 server with MySQL 5.6, 5.7, or MariaDB 10.x running
• Root or sudo access to both the OS and MySQL
• Prometheus server already installed and reachable (can be on the same host or a separate server)
• Grafana installed and connected to the Prometheus data source (optional but recommended)
• Internet access or a mirror to download the exporter binary

Step 1: Create the MySQL Exporter User

The mysqld_exporter connects to MySQL using a dedicated low-privilege account. Log into MySQL as root:

mysql -u root -p

Create the monitoring user. Replace StrongPassword123! with a secure password of your choice:

CREATE USER 'exporter'@'127.0.0.1' IDENTIFIED BY 'StrongPassword123!' WITH MAX_USER_CONNECTIONS 3;

GRANT PROCESS, REPLICATION CLIENT, SELECT ON *.* TO 'exporter'@'127.0.0.1';

FLUSH PRIVILEGES;
QUIT;

The grants required are:

• PROCESS — Allows the exporter to read the process list and certain global status variables.
• REPLICATION CLIENT — Required to run SHOW MASTER STATUS and SHOW SLAVE STATUS for replication metrics.
• SELECT on *.* — Needed to query Performance Schema tables and information schema views.

MAX_USER_CONNECTIONS 3 limits the account to three concurrent connections, preventing it from consuming connection slots needed by the application.

Step 2: Create the MySQL Credentials File

Rather than passing the password on the command line (which would expose it in the process list), create a .my.cnf credentials file. First, create a dedicated system user to own the exporter process:

sudo useradd --no-create-home --shell /bin/false prometheus_exporter

Create the credentials file at /etc/mysqld_exporter/.my.cnf:

sudo mkdir -p /etc/mysqld_exporter
sudo vi /etc/mysqld_exporter/.my.cnf

Add the following content:

[client]
user=exporter
password=StrongPassword123!
host=127.0.0.1
port=3306

Restrict the file permissions so only root and the exporter user can read it:

sudo chown root:prometheus_exporter /etc/mysqld_exporter/.my.cnf
sudo chmod 640 /etc/mysqld_exporter/.my.cnf

Step 3: Download and Install the mysqld_exporter Binary

Download the latest stable mysqld_exporter release from the official Prometheus GitHub releases page. At the time of writing, version 0.15.1 is current:

cd /tmp
curl -LO https://github.com/prometheus/mysqld_exporter/releases/download/v0.15.1/mysqld_exporter-0.15.1.linux-amd64.tar.gz

Verify the download integrity using the provided SHA256 checksum file:

curl -LO https://github.com/prometheus/mysqld_exporter/releases/download/v0.15.1/sha256sums.txt
sha256sum --check --ignore-missing sha256sums.txt

Extract and install the binary to /usr/local/bin:

tar xzf mysqld_exporter-0.15.1.linux-amd64.tar.gz
sudo cp mysqld_exporter-0.15.1.linux-amd64/mysqld_exporter /usr/local/bin/
sudo chown prometheus_exporter:prometheus_exporter /usr/local/bin/mysqld_exporter
sudo chmod 755 /usr/local/bin/mysqld_exporter

Confirm the binary runs:

/usr/local/bin/mysqld_exporter --version

Step 4: Create the systemd Service Unit

Create a systemd unit file so the exporter starts automatically at boot and is managed like any other service:

sudo vi /etc/systemd/system/mysqld_exporter.service

Add the following content:

[Unit]
Description=Prometheus MySQL Exporter
Documentation=https://github.com/prometheus/mysqld_exporter
After=network.target mysql.service

[Service]
Type=simple
User=prometheus_exporter
Group=prometheus_exporter
ExecStart=/usr/local/bin/mysqld_exporter 
  --config.my-cnf=/etc/mysqld_exporter/.my.cnf 
  --collect.info_schema.innodb_metrics 
  --collect.info_schema.processlist 
  --collect.info_schema.query_response_time 
  --collect.slave_status 
  --collect.binlog_size 
  --web.listen-address=:9104

Restart=on-failure
RestartSec=5s
NoNewPrivileges=yes
PrivateTmp=yes

[Install]
WantedBy=multi-user.target

The --collect.* flags enable optional metric collectors beyond the default set. Reload systemd and start the service:

sudo systemctl daemon-reload
sudo systemctl enable mysqld_exporter
sudo systemctl start mysqld_exporter
sudo systemctl status mysqld_exporter

Verify the exporter is listening on port 9104:

curl -s http://localhost:9104/metrics | head -30

You should see lines beginning with mysql_, such as mysql_global_status_uptime and mysql_global_variables_max_connections.

Step 5: Configure Prometheus to Scrape the Exporter

Edit the Prometheus configuration file, typically located at /etc/prometheus/prometheus.yml. Add a new scrape job under the scrape_configs section:

scrape_configs:

  - job_name: 'mysql'
    static_configs:
      - targets: ['localhost:9104']
        labels:
          instance: 'db01'
          environment: 'production'

If Prometheus is running on a separate server, replace localhost with the IP address of the MySQL host. Reload Prometheus to apply the new configuration:

sudo systemctl reload prometheus

Wait 30–60 seconds, then open the Prometheus UI (typically http://your-prometheus-server:9090) and navigate to Status → Targets. The mysql job should appear with a green UP state.

Test a basic query in the Prometheus expression browser:

mysql_global_status_queries

Step 6: Open the Firewall for Internal Access (Optional)

If Prometheus scrapes the exporter across the network rather than on localhost, open port 9104 to the Prometheus server only:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.10/32" port protocol="tcp" port="9104" accept'
sudo firewall-cmd --reload

Replace 192.168.1.10 with the actual IP address of your Prometheus server. Do not open this port publicly.

Step 7: Import the Grafana MySQL Dashboard

Grafana makes it easy to import pre-built dashboards. Dashboard ID 7362 (MySQL Overview by percona) is one of the most comprehensive and widely used MySQL dashboards available. To import it:

1. Log into your Grafana instance.
2. Click the + icon in the left sidebar and select Import.
3. Enter 7362 in the Import via grafana.com field and click Load.
4. Select your Prometheus data source from the dropdown.
5. Click Import.

The dashboard provides panels for:

• Queries per second (QPS) and slow queries
• InnoDB buffer pool hit ratio and dirty pages
• Table locks and lock waits
• Replication lag (if slaves are configured)
• Open connections vs. max connections
• Network traffic in/out

Step 8: Alerting on Critical MySQL Metrics

Add basic alerting rules to your Prometheus rules file (e.g., /etc/prometheus/rules/mysql.yml) to be notified of critical conditions:

groups:
  - name: mysql
    rules:
      - alert: MySQLDown
        expr: mysql_up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "MySQL is down on {{ $labels.instance }}"

      - alert: MySQLHighConnections
        expr: mysql_global_status_threads_connected / mysql_global_variables_max_connections > 0.8
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "MySQL connection usage above 80% on {{ $labels.instance }}"

Include this file in prometheus.yml under the rule_files section and reload Prometheus.

Conclusion

You now have a complete MySQL monitoring pipeline on RHEL 7: a least-privilege exporter account in MySQL, a securely stored credentials file, the mysqld_exporter running as a systemd service, Prometheus scraping metrics every 15 seconds, and a rich Grafana dashboard providing instant visibility into database health. This setup gives you the foundation for proactive database management — catching connection exhaustion, slow query regressions, and replication failures before they become outages. From here, you can extend coverage by enabling additional collectors, adding more Prometheus alert rules, and configuring Alertmanager to route notifications to Slack, PagerDuty, or email.