Kubernetes

In your watchlog-node-agent.yaml, locate the MySQL env vars:

      - name: MONITOR_MYSQL
        value: "false"
      - name: MYSQL_HOST
        value: "127.0.0.1"
      - name: MYSQL_PORT
        value: "3306"
      - name: MYSQL_USERNAME
        value: ""
      - name: MYSQL_PASSWORD
        value: ""
      - name: MYSQL_DATABASES
        value: ""

Update as follows:

-       value: "false"
+       value: "true"

MYSQL_DATABASES is only read by the legacy collector — the advanced collector discovers every schema itself, so it can stay empty.

Then apply:

kubectl apply -f watchlog-node-agent.yaml

Keep the password in a Secret

apiVersion: v1
kind: Secret
metadata:
  name: watchlog-mysql
  namespace: watchlog
type: Opaque
stringData:
  password: "your_password"

      - name: MYSQL_PASSWORD
        valueFrom:
          secretKeyRef:
            name: watchlog-mysql
            key: password

Create the account as 'watchlog_monitor'@'%'. From MySQL's perspective the connection arrives from a pod IP that changes on every restart, so a host-pinned grant will start failing the first time the agent pod is rescheduled.

Creating the monitoring user

kubectl exec -i -n database statefulset/mysql -- \
  mysql -uroot -p"$MYSQL_ROOT_PASSWORD" <<'SQL'
CREATE USER IF NOT EXISTS 'watchlog_monitor'@'%' IDENTIFIED BY 'your_password';
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'watchlog_monitor'@'%';
GRANT SELECT ON performance_schema.* TO 'watchlog_monitor'@'%';
GRANT SELECT ON information_schema.* TO 'watchlog_monitor'@'%';
FLUSH PRIVILEGES;
SQL

kubectl exec needs -i for the heredoc to reach the container.

Which agent should monitor it?

A DaemonSet means every node's agent polls MySQL — N agents collecting the same data. Watchlog identifies an instance by host:port, so they all write to the same integration and the data stays correct, but the polling is wasted.

Preferred: run a single-replica Deployment of the agent dedicated to integrations, and keep the DaemonSet for host and container metrics only.
Or use a node selector so only one node's agent carries the MySQL env vars.

Advanced options in Kubernetes

The env vars cover the connection. For collection caps and throttle intervals, mount an integration.json through a ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: watchlog-integrations
  namespace: watchlog
data:
  integration.json: |
    [
      {
        "service": "mysql",
        "monitor": true,
        "host": "mysql.database.svc.cluster.local",
        "port": "3306",
        "username": "watchlog_monitor",
        "database": [],
        "advanced": {
          "queries": true,
          "schema": true,
          "indexes": true,
          "locks": true,
          "replication": true,
          "maxDigests": 200,
          "schemaIntervalSeconds": 300
        },
        "slowQuery": { "thresholdMs": 100 }
      }
    ]

          volumeMounts:
            - name: integrations
              mountPath: /app/app/config/integration.json
              subPath: integration.json
              readOnly: true
      volumes:
        - name: integrations
          configMap:
            name: watchlog-integrations

Warning

Do not put the password in the ConfigMap — a ConfigMap is readable by anything with get on the namespace. Keep it in the MYSQL_PASSWORD Secret env var.

performance_schema

Confirm it is on, since it unlocks the Queries, Indexes and Locks tabs:

kubectl exec -n database statefulset/mysql -- \
  mysql -uwatchlog_monitor -p'your_password' \
  -e "SHOW VARIABLES LIKE 'performance_schema'"

If a Helm chart mounts a custom my.cnf, check it there. Enabling it requires a pod restart.