MySQL 8.4 LTS on Rhel 9

Accept the Marketplace terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:mysql-8-4-lts-rhel-9:default:latest
az vm create -g <resource-group> -n mysql-8-4-lts-vm -l eastus \
  --image sac1647283583153:mysql-8-4-lts-rhel-9:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

For heavier workloads, choose a memory-optimised size such as Standard_E4s_v5 (4 vCPU, 32 GB RAM). Tune innodb_buffer_pool_size after first boot, as described in Step 10.

Connect to the VM as azureuser:

ssh azureuser@<public-ip>

Confirm the operating system:

cat /etc/oracle-release

mysqld.service starts automatically at boot. Check that it is active:

sudo systemctl is-active mysqld.service

Show the full status:

sudo systemctl status mysqld.service --no-pager | head -12

mysql-firstboot.service rotates the root password on first boot and writes the new credentials to /home/azureuser/CREDENTIALS.txt. Read the file with sudo:

sudo cat /home/azureuser/CREDENTIALS.txt

The file is owned by root:root with mode 0600. It contains the per-VM password, the default database name and the path to your config file.

Copy the password to a secure location, then remove the file.

Check that MySQL listens on port 3306:

sudo ss -tlnp | grep ':3306'

Connect as root and enter the password from Step 4:

mysql -uroot -p

Run a quick smoke test:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SELECT VERSION(), NOW()"

The default SecureAnyCloud database is fine for testing. For production workloads, create a dedicated database and a least-privilege user instead of connecting as root. Set the password to a strong value of your own choice:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') <<'SQL' CREATE DATABASE IF NOT EXISTS appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci; CREATE USER IF NOT EXISTS 'appuser'@'%' IDENTIFIED BY 'CHANGE_ME_StrongPasswordExample123!'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%'; FLUSH PRIVILEGES; SHOW GRANTS FOR 'appuser'@'%'; SQL

If your application runs on the same VM, a localhost-only user is more secure. Replace 'appuser'@'%' with 'appuser'@'localhost'.

The OS firewalld already permits port 3306, but the Azure network security group (NSG) attached to the VM blocks it by default. Open the port from your application VNet only. For production, never open it from 0.0.0.0/0:

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-mysql-3306 \
  --priority 200 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 3306

Replace 10.0.0.0/16 with your application subnet's CIDR. Then test the connection from a client machine on that VNet:

mysql -h <vm-private-ip> -P 3306 -u appuser -p

Create a logical dump of a single database:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --single-transaction --routines --triggers --events \
  appdb > /home/azureuser/appdb-$(date +%Y%m%d).sql

Or back up everything. Use --all-databases for a full server snapshot:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --all-databases --single-transaction --routines --triggers --events \
  --master-data=2 > /home/azureuser/full-$(date +%Y%m%d).sql

Restore a dump into a target database:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') appdb < /home/azureuser/appdb-20260509.sql

For routine production backups, schedule the dump with cron and copy it to Azure Blob Storage or an Azure Files share.

SecureAnyCloud defaults innodb_buffer_pool_size to 512 MB so that MySQL fits comfortably on the Standard_B2s build target (4 GB RAM total). On a larger VM, allocate roughly 50 to 70 percent of system RAM to the buffer pool. For example, on a Standard_E4s_v5 (32 GB RAM), use 16G.

Add an override file at /etc/my.cnf.d/local.cnf. It loads after sac.cnf and takes precedence. Replace <buffer-pool-size> with a value that suits your VM's RAM (for example 16G on Standard_E4s_v5):

sudo tee /etc/my.cnf.d/local.cnf >/dev/null <<CNF [mysqld] innodb_buffer_pool_size = <buffer-pool-size> innodb_buffer_pool_instances = 8 innodb_log_file_size = 1G max_connections = 500 CNF
sudo systemctl restart mysqld.service

Confirm the new value is applied:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size'"

The local override survives package upgrades. sac.cnf does not regenerate on package upgrade, but to change a shipped default, always do it in local.cnf rather than editing sac.cnf in place.

SecureAnyCloud enables the slow query log out of the box at /var/log/mysql/slow.log with a 2-second threshold. Generate some load, then inspect the log:

sudo tail -30 /var/log/mysql/slow.log 2>/dev/null || echo "no slow queries logged yet"

Use the bundled mysqldumpslow to summarise the slowest queries by total time:

sudo mysqldumpslow -s t /var/log/mysql/slow.log | head -30

To lower the threshold temporarily for debugging, run the following. No restart is needed:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SET GLOBAL long_query_time = 0.5"

When you are done, set it back with SET GLOBAL long_query_time = 2.

MySQL 8.4 LTS generates self-signed SSL certificates automatically on first initialisation. Verify that they are in place and that the server supports TLS:

sudo ls -la /var/lib/mysql/*.pem
sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'have_ssl'"

To force a single user to connect over TLS only, run:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "ALTER USER 'appuser'@'%' REQUIRE SSL"

For production, replace the auto-generated certificates with ones from Azure Key Vault or Let's Encrypt. Then point ssl-cert, ssl-key and ssl-ca in /etc/my.cnf.d/local.cnf at the new files.