MySQL 9 on Rocky 9

az vm image terms accept --urn sac1647283583153:mysql-9-rocky-9:default:latest
az vm create -g <resource-group> -n mysql-9-vm -l eastus \
  --image sac1647283583153:mysql-9-rocky-9:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

For higher-load workloads, choose a memory-optimized SKU such as Standard_E4s_v5 (4 vCPU, 32 GB RAM). Tune innodb_buffer_pool_size after first boot, as described in Step 10.

ssh azureuser@<public-ip>

Confirm the OS:

cat /etc/rocky-release

mysqld.service starts automatically at boot.

sudo systemctl is-active mysqld.service

Show full status:

sudo systemctl status mysqld.service --no-pager | head -12

On first boot, mysql-firstboot.service rotates the root password and writes the new credentials to /home/azureuser/CREDENTIALS.txt. Display the file:

sudo cat /home/azureuser/CREDENTIALS.txt

The file is owned by root:root with mode 0600. It contains the per-VM password, the default database name and the path to your config file. Copy the password to a secure location, then remove the file.

sudo ss -tlnp | grep ':3306'

Run a one-shot version check using the password that first boot rotated:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SELECT VERSION(), NOW()"

For an interactive session:

mysql -uroot -p

Check server uptime and the schemas shipped with the image:

sudo bash -c 'PASS=$(grep "^Password:" /home/azureuser/CREDENTIALS.txt | awk "{print \$2}"); mysqladmin -uroot -p"$PASS" status; mysql -uroot -p"$PASS" --table -e "SHOW DATABASES;"'

The default SecureAnyCloud database is fine for testing. For production, create a dedicated database and a least-privilege user instead of connecting as root. Set the password to a strong value of your own choice:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') <<'SQL' CREATE DATABASE IF NOT EXISTS appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci; CREATE USER IF NOT EXISTS 'appuser'@'%' IDENTIFIED BY 'CHANGE_ME_StrongPasswordExample123!'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%'; FLUSH PRIVILEGES; SHOW GRANTS FOR 'appuser'@'%'; SQL

For a localhost-only user, which is more secure if your application runs on the same VM, replace 'appuser'@'%' with 'appuser'@'localhost'.

A round-trip CREATE / INSERT / SELECT against the default SecureAnyCloud database looks like this:

Rocky Linux 9 ships with firewalld, but the SecureAnyCloud image leaves it inactive. The network boundary is the Azure NSG. Open port 3306 from your application VNet only, and never from 0.0.0.0/0 in production:

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-mysql-3306 \
  --priority 200 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 3306

Replace 10.0.0.0/16 with your application subnet's CIDR. Then test from a client machine on that VNet:

mysql -h <vm-private-ip> -P 3306 -u appuser -p

Create a logical dump of a single database:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --single-transaction --routines --triggers --events \
  sac > /home/azureuser/sac-$(date +%Y%m%d).sql

Or back up everything. Use --all-databases for a full server snapshot:

sudo mysqldump -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') \
  --all-databases --single-transaction --routines --triggers --events \
  > /home/azureuser/full-$(date +%Y%m%d).sql

Restore a dump into a target database:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') sac < /home/azureuser/sac-20260517.sql

For routine production backups, schedule the dump with cron and copy it to Azure Blob Storage or an Azure Files share.

SecureAnyCloud defaults innodb_buffer_pool_size to 512 MB so that MySQL fits comfortably on the Standard_B2s build target (4 GB RAM total). On a larger VM, allocate roughly 50 to 70 percent of system RAM to the buffer pool. For example, on a Standard_E4s_v5 (32 GB RAM):

Add a customer override file at /etc/my.cnf.d/local.cnf. It loads after sac.cnf, so its values win. Replace <buffer-pool-size> with a value appropriate to your VM RAM (for example, 16G on Standard_E4s_v5):

sudo tee /etc/my.cnf.d/local.cnf >/dev/null <<CNF [mysqld] innodb_buffer_pool_size = <buffer-pool-size> innodb_buffer_pool_instances = 8 innodb_log_file_size = 1G max_connections = 500 CNF
sudo systemctl restart mysqld.service

Confirm the new value is applied:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size'"

The local override survives package upgrades. sac.cnf does not regenerate on package upgrade, but if you need to change shipped defaults, always do it in local.cnf rather than editing sac.cnf in place.

SecureAnyCloud enables the slow query log out of the box at /var/log/mysql/slow.log, with a 2-second threshold. Generate some load, then inspect the log:

sudo tail -30 /var/log/mysql/slow.log 2>/dev/null || echo "no slow queries logged yet"

Use the bundled mysqldumpslow to summarize the top offenders by total time:

sudo mysqldumpslow -s t /var/log/mysql/slow.log 2>/dev/null | head -30 || echo "no slow queries"

To lower the threshold temporarily for debugging, run the following. No restart is needed:

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SET GLOBAL long_query_time = 0.5"

When you finish debugging, set the threshold back with SET GLOBAL long_query_time = 2.

MySQL 9 generates self-signed SSL certificates automatically on first initialization. Verify that they are in place and that the server accepts TLS connections:

sudo ls -la /var/lib/mysql/*.pem
sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "SHOW VARIABLES LIKE 'have_ssl'"

Require a single user to connect over TLS only. This applies once appuser exists (see Step 7):

sudo mysql -uroot -p$(grep '^Password:' /home/azureuser/CREDENTIALS.txt | awk '{print $2}') -e "ALTER USER 'appuser'@'%' REQUIRE SSL"

For production, replace the auto-generated certificates with ones from Azure Key Vault or Let's Encrypt. Point ssl-cert, ssl-key and ssl-ca in /etc/my.cnf.d/local.cnf at the new files.