Percona Monitoring and Management (PMM) on Ubuntu 24.04 on Azure User Guide

Overview

Percona Monitoring and Management (PMM) is a free, open source observability platform for databases and the systems they run on. It collects detailed metrics and query analytics from MySQL, PostgreSQL, MongoDB and ProxySQL alongside host operating system telemetry, then correlates them into a Grafana based web interface with prebuilt dashboards, alerting, Query Analytics, backup management and automated advisor checks that surface performance, security and configuration issues. It gives you a single self hosted pane of glass over your whole database estate without sending telemetry to a third party service.

The cloudimg image runs the single official upstream percona/pmm-server container, pinned by digest and run unmodified under one systemd service. By design that one container bundles the complete server stack: VictoriaMetrics for metrics, ClickHouse for Query Analytics, PostgreSQL for its internal inventory database, the Grafana based UI and an internal nginx, so a full monitoring backend is ready the moment it starts. The appliance then locks it down: PMM is bound to loopback 127.0.0.1:8080 and fronted by an nginx reverse proxy on port 80. PMM ships a default admin/admin login, so a unique admin password is generated on the first boot of your VM and set before the dashboard is ever reachable, which means the default login is never valid on the network. Backed by 24/7 cloudimg support.

What is included:

• Percona Monitoring and Management (PMM) Server 3.8.1 running as the percona-pmm systemd service via docker compose
• The single all-in-one percona/pmm-server container bundling VictoriaMetrics, ClickHouse, PostgreSQL and the Grafana based UI, pinned by digest and captured into the image so first boot needs no pull
• nginx on :80 fronting the dashboard, with PMM bound to loopback only and an unauthenticated /healthz for load balancer probes
• A per-VM admin password generated on first boot and set via GF_SECURITY_ADMIN_PASSWORD, so the upstream admin/admin default is never valid
• In-product auto-update disabled so the appliance stays on the pinned, tested version
• A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled

Percona and PMM are trademarks of Percona LLC. This image is provided by cloudimg and is not affiliated with, endorsed by, or sponsored by Percona LLC.

Prerequisites

• An Azure subscription and permission to create a VM
• An SSH key pair (ssh-keygen -t ed25519)
• Inbound access to port 22 (SSH) and port 80 (the web dashboard) on the VM, and optionally 443 if you add TLS
• A recommended size of Standard_B4ms (4 vCPU, 16 GiB) or larger, because PMM's bundled ClickHouse and VictoriaMetrics benefit from memory headroom (PMM's documented minimum is 8 GiB)

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Percona Monitoring and Management by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (choose Standard_B4ms or larger); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name percona-pmm \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name percona-pmm --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service percona-pmm.service nginx.service

All three report active. The percona-pmm.service unit runs the all-in-one PMM Server container with docker compose, published to the loopback address 127.0.0.1:8080, while nginx fronts the dashboard on port 80. PMM's internal VictoriaMetrics, ClickHouse, PostgreSQL and Grafana all run inside that single container.

Step 5 - Retrieve your admin password

PMM's web interface uses the username admin. A unique password is generated on the first boot of your VM, set on the PMM admin account before the dashboard is reachable, and written to a root-only file:

sudo cat /root/percona-pmm-credentials.txt

This file contains pmm.username, pmm.password and the pmm.url to open in a browser. There is no usable default login: the upstream admin/admin password is never valid because the per-VM password is set when PMM initialises, so no two deployments share a credential and nothing usable is baked into the image. Store the password somewhere safe.

Step 6 - Confirm the readiness endpoint

nginx fronts PMM's own readiness endpoint, which is unauthenticated and returns 200 only when the whole PMM stack is up:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/v1/server/readyz
curl -s http://localhost/healthz

The first prints 200 and the second prints ok. Either is safe for an Azure Load Balancer health probe: /v1/server/readyz reflects real PMM readiness, and the nginx /healthz endpoint always answers ok independent of the backend. Everything else requires the admin login.

Step 7 - Confirm the authentication gate

PMM's API and dashboards sit behind the Grafana login. The following reads the per-VM password from the credentials file and proves the round-trip: the readiness endpoint answers 200 with no auth, an unauthenticated API call is rejected with 401, the upstream admin/admin default is rejected with 401, and only the per-VM password returns 200:

PW=$(sudo sed -n 's/^pmm.password=//p' /root/percona-pmm-credentials.txt)
echo "readyz      : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/v1/server/readyz)"
echo "unauth      : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' http://127.0.0.1/graph/api/user)"
echo "admin/admin : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' -u admin:admin http://127.0.0.1/graph/api/user)"
echo "per-VM pw   : $(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/json' -u admin:$PW http://127.0.0.1/graph/api/user)"

It prints readyz : 200, unauth : 401, admin/admin : 401, then per-VM pw : 200. The dashboard is only reachable with the per-VM admin password, because PMM itself is bound to loopback and nginx is the only way in.

Step 8 - Confirm PMM is monitoring its own node

Out of the box PMM monitors the node it runs on, so there is real telemetry to explore before you connect any database. The authenticated API reports the server version and the monitored inventory:

PW=$(sudo sed -n 's/^pmm.password=//p' /root/percona-pmm-credentials.txt)
curl -s -u admin:$PW http://127.0.0.1/v1/server/version | python3 -c 'import json,sys; d=json.load(sys.stdin); print("pmm version:", d.get("version"))'
curl -s -u admin:$PW http://127.0.0.1/v1/inventory/nodes | python3 -c 'import json,sys; d=json.load(sys.stdin); ns=d.get("generic",[]); print("generic nodes monitored:", len(ns)); [print("  -", n.get("node_name")) for n in ns[:5]]'

It prints pmm version: 3.8.1 and generic nodes monitored: 1 with the pmm-server node listed. As you add database services, they appear here too and their dashboards fill with data.

Step 9 - Sign in to the PMM dashboard

Open pmm.url from your credentials file (http://<vm-public-ip>/) in a browser. PMM presents a Grafana based sign in page branded "Percona Monitoring and Management - Your single pane of glass"; enter the username admin and the per-VM password from your credentials file, then click Log in.

Step 10 - Explore the PMM home page

After signing in, PMM opens its Home page with the full navigation for PostgreSQL, Operating system, all dashboards, Query Analytics (QAN), Alerts, Advisors, Inventory and Backups down the left, and a Welcome panel that walks you through adding your first database service.

Step 11 - Browse the prebuilt dashboard library

PMM ships an extensive library of prebuilt dashboards. Open All dashboards -> Browse all dashboards to see folders for MySQL, PostgreSQL, MongoDB, the operating system (OS), Query Analytics, PMM Health and more, each containing curated dashboards you can open the moment a matching service is connected.

Step 12 - Inspect the node metrics dashboards

Because PMM monitors its own node, the OS -> Nodes Overview dashboard already renders real charts: CPU utilisation, memory and swap usage, disk space and I/O, and network throughput for the monitored node. Selecting a node drills into detailed per-host panels, and once you connect databases the MySQL, PostgreSQL and MongoDB dashboards fill the same way.

Step 13 - Connect a database to monitor

To start monitoring a database, install PMM Client on the database host and register it with this server, using the per-VM admin password:

# On the database host (Debian/Ubuntu example):
curl -LO https://repo.percona.com/apt/percona-release_latest.generic_all.deb
sudo dpkg -i percona-release_latest.generic_all.deb
sudo percona-release enable pmm3-client
sudo apt-get update && sudo apt-get install -y pmm-client

# Register with this PMM server (replace the IP and password):
sudo pmm-admin config --server-insecure-tls \
  --server-url="https://admin:<per-VM-password>@<vm-public-ip>:443" \
  <db-host-address> generic <db-host-name>

# Then add the database service, for example MySQL:
sudo pmm-admin add mysql --username=<db-user> --password=<db-pass> --host=127.0.0.1 --port=3306

Within a minute the service appears under Inventory and its dashboards and Query Analytics begin to populate. See the PMM documentation for MongoDB, PostgreSQL and ProxySQL clients and for cloud database monitoring.

Maintenance

Change the admin password. Sign in to the dashboard, open the account menu and change the password under your profile, or reset it from the server:

sudo docker exec -t pmm-server change-admin-password <new-password>

Data retention. Metrics and Query Analytics retention are configured under Configuration -> Settings -> Advanced Settings in the dashboard. PMM stores all of its data in the container's /srv volume.

Add TLS and a domain. PMM's internal HTTPS runs on port 8443; for production, point a DNS name at the VM and terminate HTTPS at the appliance nginx with a certificate from Let's Encrypt (certbot --nginx) so the dashboard is served over https://.

Service management.

systemctl status percona-pmm nginx --no-pager
sudo docker compose -f /etc/percona-pmm/compose.yaml ps

The PMM Server container logs to the Docker journal; view them with sudo docker compose -f /etc/percona-pmm/compose.yaml logs.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating PMM on Azure, contact the cloudimg team through the Azure Marketplace listing. For PMM's features, clients and configuration, see the Percona Monitoring and Management documentation.