MySQL 9 on Rhel 9

az vm image terms accept --urn sac1647283583153:mysql-9-rhel-9:default:latest
az vm create -g <resource-group> -n mysql-9-vm -l eastus \
  --image sac1647283583153:mysql-9-rhel-9:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

For higher-load workloads, choose a memory-optimized SKU such as Standard_E4s_v5 (4 vCPU, 32 GB RAM). Tune innodb_buffer_pool_size after first boot, as described in Step 10.

Connect to the VM with the admin user:

ssh azureuser@<public-ip>

Confirm the operating system:

cat /etc/oracle-release

mysqld.service starts automatically at boot. Check that it is active:

sudo systemctl is-active mysqld.service

Show the full status:

sudo systemctl status mysqld.service --no-pager | head -12

On first boot, mysql-firstboot.service rotates the root password and writes the new credentials to /home/azureuser/CREDENTIALS.txt. Print the file:

sudo cat /home/azureuser/CREDENTIALS.txt

The file is owned by root:root with mode 0600. It contains the per-VM password, the default database name and the path to your configuration file. Copy the password to a secure location, then remove the file.

Check that MySQL is listening on port 3306:

sudo ss -tlnp | grep ':3306'

Open an interactive session as root. Enter the password from Step 4 when prompted:

mysql -uroot -p

Run a quick smoke test:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SELECT VERSION(), NOW()"

The default SecureAnyCloud database is fine for testing. For production workloads, create a dedicated database and a least-privilege user instead of connecting as root. Set the password to a strong value of your own choice:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') <<'SQL' CREATE DATABASE IF NOT EXISTS appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci; CREATE USER IF NOT EXISTS 'appuser'@'%' IDENTIFIED BY 'CHANGE_ME_StrongPasswordExample123!'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%'; FLUSH PRIVILEGES; SHOW GRANTS FOR 'appuser'@'%'; SQL

For a localhost-only user, which is more secure if your application runs on the same VM, replace 'appuser'@'%' with 'appuser'@'localhost'.

The operating system firewall (firewalld) already permits port 3306, but the Azure network security group (NSG) attached to the VM blocks it by default. Open the port to your application VNet only. For production, never open it to 0.0.0.0/0:

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-mysql-3306 \
  --priority 200 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 3306

Replace 10.0.0.0/16 with your application subnet's CIDR. Then test the connection from a client machine on that VNet:

mysql -h <vm-private-ip> -P 3306 -u appuser -p

Create a logical dump of a single database:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --single-transaction --routines --triggers --events \
  appdb > /home/azureuser/appdb-$(date +%Y%m%d).sql

To take a full server snapshot, back up everything with --all-databases:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --all-databases --single-transaction --routines --triggers --events \
  --master-data=2 > /home/azureuser/full-$(date +%Y%m%d).sql

Restore a dump into a target database:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') appdb < /home/azureuser/appdb-20260509.sql

For routine production backups, schedule the dump with cron and copy it to Azure Blob Storage or an Azure Files share.

The image sets innodb_buffer_pool_size to 512 MB, so MySQL fits comfortably on the Standard_B2s build target (4 GB RAM in total). On a larger VM, allocate roughly 50 to 70 percent of system RAM to the buffer pool. For example, on a Standard_E4s_v5 (32 GB RAM), use about 16 GB.

Add an override file at /etc/my.cnf.d/local.cnf. It loads after sac.cnf, so its values win. Replace <buffer-pool-size> with a value appropriate to your VM's RAM (for example, 16G on Standard_E4s_v5):

sudo tee /etc/my.cnf.d/local.cnf >/dev/null <<CNF [mysqld] innodb_buffer_pool_size = <buffer-pool-size> innodb_buffer_pool_instances = 8 innodb_log_file_size = 1G max_connections = 500 CNF
sudo systemctl restart mysqld.service

Confirm that the new value is applied:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size'"

The local override survives package upgrades. sac.cnf is not regenerated on package upgrade, but to change a shipped default, always set it in local.cnf rather than editing sac.cnf in place.

The image enables the slow query log at /var/log/mysql/slow.log with a 2-second threshold. Generate some load, then inspect the log:

sudo tail -30 /var/log/mysql/slow.log 2>/dev/null || echo "no slow queries logged yet"

Use the bundled mysqldumpslow to summarize the top offenders by total time:

sudo mysqldumpslow -s t /var/log/mysql/slow.log | head -30

To lower the threshold temporarily for debugging, run the following. No restart is needed:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SET GLOBAL long_query_time = 0.5"

When you finish debugging, set it back with SET GLOBAL long_query_time = 2.

MySQL 9 generates self-signed SSL certificates automatically on first initialization. Verify that they are in place and that the server accepts TLS:

sudo ls -la /var/lib/mysql/*.pem
sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'have_ssl'"

Require a single user to connect over TLS only:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "ALTER USER 'appuser'@'%' REQUIRE SSL"

For production, replace the auto-generated certificates with ones from Azure Key Vault or Let's Encrypt. Then point ssl-cert, ssl-key and ssl-ca in /etc/my.cnf.d/local.cnf at the new files.