Create a least-privilege database user

Run the setup statements as a DBA, then use the new account only for dbtempo. Replace the example database, schema, host, and password before running them. Restrict network access to the collector host whenever possible.

CREATE USER 'dbtempo_readonly'@'<collector-host>'
  IDENTIFIED BY '<strong-password>';

GRANT SELECT ON `<app-database>`.*
  TO 'dbtempo_readonly'@'<collector-host>';
GRANT SELECT ON performance_schema.*
  TO 'dbtempo_readonly'@'<collector-host>';
GRANT PROCESS ON *.*
  TO 'dbtempo_readonly'@'<collector-host>';

Repeat the application-database grant for every database you want analyzed.PROCESS is recommended but fail-soft: without it, dbtempo loses instance-wide process-list and InnoDB diagnostics. Do not addREPLICATION CLIENT or SHOW VIEW; collectors do not use them.

Performance Schema is the primary query source. MariaDB commonly relies on the slow-query log instead. A CLI collector can read a local log file, and an SSH collector can fetch one from its host; a managed direct connection cannot read a database host's filesystem.

CREATE ROLE dbtempo_readonly LOGIN
  PASSWORD '<strong-password>';

GRANT pg_read_all_stats TO dbtempo_readonly;
GRANT CONNECT ON DATABASE "<app-database>" TO dbtempo_readonly;
GRANT USAGE ON SCHEMA "<app-schema>" TO dbtempo_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA "<app-schema>"
  TO dbtempo_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA "<app-schema>"
  GRANT SELECT ON TABLES TO dbtempo_readonly;

Repeat the schema grants for every analyzed schema. Usepg_read_all_stats for query and session visibility;pg_monitor also works but is broader.pg_stat_statements must be preloaded and enabled by a DBA for live collection. hypopg is optional.