MySQL 9 on Oracle Linux 10

Accept the Marketplace terms, then create the virtual machine. Replace <resource-group> with your resource group name.

az vm image terms accept --urn sac1647283583153:mysql-9-oel10:standard:latest
az vm create -g <resource-group> -n mysql-9-vm -l eastus \
  --image sac1647283583153:mysql-9-oel10:standard:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

For higher-load workloads, choose a memory-optimised SKU such as Standard_E4s_v5 (4 vCPU, 32 GB RAM). Tune innodb_buffer_pool_size after first boot, as described in Step 10.

Connect to the virtual machine over SSH:

ssh azureuser@<public-ip>

Confirm the OS:

cat /etc/oracle-release

mysqld.service starts automatically at boot. Check that it is active:

sudo systemctl is-active mysqld.service

Show the full status:

sudo systemctl status mysqld.service --no-pager | head -12

The mysql-firstboot.service rotates the root password on first boot and writes the new credentials to /home/azureuser/CREDENTIALS.txt. Read the file:

sudo cat /home/azureuser/CREDENTIALS.txt

The file is owned by root:root with mode 0600. It contains the per-VM password, the default database name and the path to your config file.

Copy the password to a secure location, then remove the file.

Check that MySQL is listening on port 3306:

sudo ss -tlnp | grep ':3306'

Connect as root and enter the password from Step 4 when prompted:

mysql -uroot -p

Run a quick smoke test:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SELECT VERSION(), NOW()"

The default SecureAnyCloud database is fine for testing. For production workloads, use a dedicated database and a least-privilege user instead of connecting as root.

Create them with the commands below, and set the password to a strong value of your own choice:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') <<'SQL' CREATE DATABASE IF NOT EXISTS appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci; CREATE USER IF NOT EXISTS 'appuser'@'%' IDENTIFIED BY 'CHANGE_ME_StrongPasswordExample123!'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%'; FLUSH PRIVILEGES; SHOW GRANTS FOR 'appuser'@'%'; SQL

For a localhost-only user, replace 'appuser'@'%' with 'appuser'@'localhost'. This is more secure if your application runs on the same VM.

The OS firewalld already permits port 3306, but the Azure Network Security Group attached to the VM blocks it by default. Open the port from your application VNet only. For production, never open it from 0.0.0.0/0:

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-mysql-3306 \
  --priority 200 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 3306

Replace 10.0.0.0/16 with your application subnet's CIDR. Then test the connection from a client machine on that VNet:

mysql -h <vm-private-ip> -P 3306 -u appuser -p

Create a logical dump of a single database:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --single-transaction --routines --triggers --events \
  appdb > /home/azureuser/appdb-$(date +%Y%m%d).sql

To back up the whole server, use --all-databases:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --all-databases --single-transaction --routines --triggers --events \
  --master-data=2 > /home/azureuser/full-$(date +%Y%m%d).sql

Restore a dump into a target database:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') appdb < /home/azureuser/appdb-20260509.sql

For routine production backups, schedule the dump with cron and copy it to Azure Blob Storage or an Azure Files share.

SecureAnyCloud defaults innodb_buffer_pool_size to 512 MB, so that MySQL fits comfortably on the Standard_B2s build target (4 GB RAM total). On a larger VM, allocate roughly 50 to 70 percent of system RAM to the buffer pool. For example, on a Standard_E4s_v5 (32 GB RAM), use 16G.

Add an override file at /etc/my.cnf.d/local.cnf. It loads after sac.cnf, so its values win. Replace <buffer-pool-size> with a value that suits your VM RAM, for example 16G on Standard_E4s_v5:

sudo tee /etc/my.cnf.d/local.cnf >/dev/null <<CNF [mysqld] innodb_buffer_pool_size = <buffer-pool-size> innodb_buffer_pool_instances = 8 innodb_log_file_size = 1G max_connections = 500 CNF
sudo systemctl restart mysqld.service

Confirm the new value is applied:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size'"

The local override survives package upgrades. The sac.cnf file does not regenerate on package upgrade, but to change a shipped default, always do it in local.cnf rather than editing sac.cnf in place.

SecureAnyCloud enables the slow query log out of the box at /var/log/mysql/slow.log, with a 2-second threshold. Generate some load, then inspect the log:

sudo tail -30 /var/log/mysql/slow.log 2>/dev/null || echo "no slow queries logged yet"

Use the bundled mysqldumpslow to summarise the slowest queries by total time:

sudo mysqldumpslow -s t /var/log/mysql/slow.log | head -30

To lower the threshold temporarily for debugging, run the command below. No restart is needed:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SET GLOBAL long_query_time = 0.5"

When you finish, set it back with SET GLOBAL long_query_time = 2.

MySQL 9 generates self-signed SSL certificates automatically on first initialisation. Verify that they are in place and that the server accepts TLS:

sudo ls -la /var/lib/mysql/*.pem
sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'have_ssl'"

To force a single user to connect over TLS only, run:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "ALTER USER 'appuser'@'%' REQUIRE SSL"

For production, replace the auto-generated certificates with ones from Azure Key Vault or Let's Encrypt. Then point ssl-cert, ssl-key and ssl-ca in /etc/my.cnf.d/local.cnf at the new files.