Percona PMM

Prerequisites

• An Azure subscription and permission to create a VM
• An SSH key pair (ssh-keygen -t ed25519)
• Inbound access to port 22 (SSH) and port 80 (the web dashboard) on the VM, and optionally port 443 if you add TLS
• A VM size of Standard_B4ms (4 vCPU, 16 GiB) or larger. PMM's bundled ClickHouse and VictoriaMetrics benefit from memory headroom, and PMM's documented minimum is 8 GiB

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Percona Monitoring and Management by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (choose Standard_B4ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms, create the VM, and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:percona-pmm-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name percona-pmm \
  --image sac1647283583153:percona-pmm-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name percona-pmm --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as the administrator user you chose:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Docker, PMM and nginx are active:

systemctl is-active docker.service percona-pmm.service nginx.service

All three report active. The percona-pmm.service unit runs the all-in-one PMM Server container with docker compose, published to the loopback address 127.0.0.1:8080. nginx fronts the dashboard on port 80.

PMM's own VictoriaMetrics, ClickHouse, PostgreSQL and Grafana all run inside that single container.

Step 5 - Retrieve your admin password

The PMM web interface uses the username admin. A unique password is generated on the first boot of your VM and set on the PMM admin account before the dashboard is reachable. It is written to a root-only file. Read it as root:

sudo cat /root/percona-pmm-credentials.txt

The file contains pmm.username, pmm.password and the pmm.url to open in a browser.

There is no usable default login. The upstream admin/admin password is never valid, because the per-VM password is set when PMM initializes. No two deployments share a credential, and nothing usable is baked into the image. Store the password somewhere safe.

Step 6 - Confirm the readiness endpoint

nginx fronts PMM's own readiness endpoint. It is unauthenticated and returns 200 only when the whole PMM stack is up. Query both endpoints:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/v1/server/readyz
curl -s http://localhost/healthz

The first command prints 200 and the second prints ok. Either endpoint is safe for an Azure Load Balancer health probe. /v1/server/readyz reflects real PMM readiness, while the nginx /healthz endpoint always answers ok, independent of the backend.

Everything else requires the admin login.

Step 7 - Confirm the authentication gate

PMM's API and dashboards sit behind the Grafana login. The following commands read the per-VM password from the credentials file and prove the round trip. The readiness endpoint answers 200 with no authentication. An unauthenticated API call is rejected with 401. The upstream admin/admin default is also rejected with 401. Only the per-VM password returns 200:

PW=$(sudo sed -n 's/^pmm.password=//p' /root/percona-pmm-credentials.txt)
echo "readyz : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/v1/server/readyz)"
echo "unauth : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' http://127.0.0.1/graph/api/user)"
echo "admin/admin : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' -u admin:admin http://127.0.0.1/graph/api/user)"
echo "per-VM pw : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' -u admin:$PW http://127.0.0.1/graph/api/user)"

The output is readyz : 200, unauth : 401, admin/admin : 401, then per-VM pw : 200.

The dashboard is reachable only with the per-VM admin password, because PMM itself is bound to loopback and nginx is the only way in.

Step 8 - Confirm PMM is monitoring its own node

Out of the box, PMM monitors the node it runs on, so there is real telemetry to explore before you connect any database. Query the authenticated API for the server version and the monitored inventory:

PW=$(sudo sed -n 's/^pmm.password=//p' /root/percona-pmm-credentials.txt)
curl -s -u admin:$PW http://127.0.0.1/v1/server/version | python3 -c 'import json,sys; d=json.load(sys.stdin); print("pmm version:", d.get("version"))'
curl -s -u admin:$PW http://127.0.0.1/v1/inventory/nodes | python3 -c 'import json,sys; d=json.load(sys.stdin); ns=d.get("generic",[]); print("generic nodes monitored:", len(ns)); [print(" -", n.get("node_name")) for n in ns[:5]]'

The output is pmm version: 3.8.1 and generic nodes monitored: 1, with the pmm-server node listed. As you add database services, they appear here too and their dashboards fill with data.

Step 9 - Sign in to the PMM dashboard

Open the pmm.url value from your credentials file (http://<vm-public-ip>/) in a browser. PMM presents a Grafana-based sign-in page branded "Percona Monitoring and Management - Your single pane of glass".

Enter the username admin and the per-VM password from your credentials file, then click Log in.

Step 10 - Explore the PMM home page

After you sign in, PMM opens its Home page. The left navigation covers PostgreSQL, Operating system, all dashboards, Query Analytics (QAN), Alerts, Advisors, Inventory and Backups. A Welcome panel walks you through adding your first database service.

Step 11 - Browse the prebuilt dashboard library

PMM ships an extensive library of prebuilt dashboards. Open All dashboards, then Browse all dashboards, to see folders for MySQL, PostgreSQL, MongoDB, the operating system (OS), Query Analytics, PMM Health and more.

Each folder holds curated dashboards that you can open as soon as a matching service is connected.

Step 12 - Inspect the node metrics dashboards

Because PMM monitors its own node, the OS folder's Nodes Overview dashboard already shows real charts: CPU utilization, memory and swap usage, disk space and I/O, and network throughput for the monitored node.

Select a node to drill into detailed per-host panels. Once you connect databases, the MySQL, PostgreSQL and MongoDB dashboards fill the same way.

Step 13 - Connect a database to monitor

To monitor a database, install PMM Client on the database host and register it with this server, using the per-VM admin password:

# On the database host (Debian/Ubuntu example):
curl -LO https://repo.percona.com/apt/percona-release_latest.generic_all.deb
sudo dpkg -i percona-release_latest.generic_all.deb
sudo percona-release enable pmm3-client
sudo apt-get update && sudo apt-get install -y pmm-client
# Register with this PMM server (replace the IP and password):
sudo pmm-admin config --server-insecure-tls \
  --server-url="https://admin:<per-VM-password>@<vm-public-ip>:443" \
  <db-host-address> generic <db-host-name>
# Then add the database service, for example MySQL:
sudo pmm-admin add mysql --username=<db-user> --password=<db-pass> --host=127.0.0.1 --port=3306

Within a minute, the service appears under Inventory, and its dashboards and Query Analytics begin to populate.

See the PMM documentation for MongoDB, PostgreSQL and ProxySQL clients and for cloud database monitoring.

Maintenance

Change the admin password. Sign in to the dashboard, open the account menu, and change the password under your profile. Alternatively, reset it from the server:

sudo docker exec -t pmm-server change-admin-password <new-password>

Data retention. Configure metrics and Query Analytics retention under Configuration, Settings, Advanced Settings in the dashboard. PMM stores all of its data in the container's /srv volume.

Add TLS and a domain. PMM's built-in HTTPS runs on port 8443. For production, point a DNS name at the VM and terminate HTTPS at the appliance nginx with a certificate from Let's Encrypt (certbot --nginx), so the dashboard is served over https://.

Service management. Check the services and the container:

systemctl status percona-pmm nginx --no-pager sudo docker compose -f /etc/percona-pmm/compose.yaml ps

The PMM Server container logs to the Docker journal. View the logs with sudo docker compose -f /etc/percona-pmm/compose.yaml logs.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating PMM on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing.

For PMM's features, clients and configuration, see the Percona Monitoring and Management documentation.

Deploy on Azure

Launch Percona Monitoring and Management (PMM) on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com