Windows

1. Create a monitoring user

CREATE USER 'watchlog_monitor'@'%' IDENTIFIED BY 'your_password';

GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'watchlog_monitor'@'%';
GRANT SELECT ON performance_schema.* TO 'watchlog_monitor'@'%';
GRANT SELECT ON information_schema.* TO 'watchlog_monitor'@'%';

FLUSH PRIVILEGES;

No SUPER and no access to application data — the agent never reads a row from a user table.

2. Confirm performance_schema is on

SHOW VARIABLES LIKE 'performance_schema';

If it is OFF, add this to my.ini (usually C:\ProgramData\MySQL\MySQL Server 8.0\my.ini) and restart the service:

[mysqld]
performance_schema = ON

ON unlocks the Queries, Indexes and Locks tabs. Without it the rest of the integration still works.

3. Configure the agent

Open the config file:

C:\Program Files\watchlog-agent\integration.json

Locate the MySQL section:

{ "service": "mysql", "monitor": false, "host": "localhost", "port": "3306", "username": "root", "password": "", "database": [] }

3. Change `"monitor"` to `true` and populate the fields:
```diff
-  "monitor": false
+  "monitor": true

Use the dedicated monitoring account rather than root. database is only needed by the legacy collector — the advanced one discovers every schema itself, so [] is fine.

{
  "service": "mysql",
  "monitor": true,
  "host": "localhost",
  "port": "3306",
  "username": "watchlog_monitor",
  "password": "your_password",
  "database": []
}

Restart the service:
```
Restart-Service -Name "WatchlogAgent"
```

Verify

mysql -h 127.0.0.1 -u watchlog_monitor -p'your_password' -e "SELECT VERSION(); SELECT @@performance_schema;"

Then check the capability probes the agent makes — each one that succeeds is a tab that will appear:

mysql -h 127.0.0.1 -u watchlog_monitor -p'your_password' -e @"
SELECT COUNT(*) AS digests FROM performance_schema.events_statements_summary_by_digest;
SELECT COUNT(*) AS index_stats FROM performance_schema.table_io_waits_summary_by_index_usage;
"@

TLS

{
  "service": "mysql",
  "monitor": true,
  "host": "mysql.internal",
  "port": "3306",
  "username": "watchlog_monitor",
  "password": "your_password",
  "database": [],
  "ssl": true
}

The agent uses the Windows certificate store. A private CA must be installed into Local Computer → Trusted Root Certification Authorities, not the current user's store, because the agent runs as a service.

Slow queries

Nothing to enable. Watchlog reads performance_schema.events_statements_summary_by_digest rather than the slow query log file, so you get query-level detail without configuring a threshold or paying the log's write cost.

slowQuery.thresholdMs only decides what the dashboard labels slow. See the integration overview for how queries are ranked by impact rather than by average latency.