Create a least-privilege database user

Run the setup statements as a DBA, then use the new account only for dbtempo. Replace the example database, schema, host, and password before running them. Restrict network access to the collector host whenever possible.

CREATE USER 'dbtempo_readonly'@'<collector-host>'
  IDENTIFIED BY '<strong-password>';

GRANT SELECT, SHOW VIEW ON `<app-database>`.*
  TO 'dbtempo_readonly'@'<collector-host>';
GRANT SELECT ON performance_schema.*
  TO 'dbtempo_readonly'@'<collector-host>';
GRANT PROCESS ON *.*
  TO 'dbtempo_readonly'@'<collector-host>';

Repeat the application-database grant for every database you want analyzed.SHOW VIEW is needed for any query that reads a view: MySQL refuses to EXPLAIN it without that privilege (error 1345), and dbtempo then skips the query. PROCESS is recommended but fail-soft: without it, dbtempo loses instance-wide process-list and InnoDB diagnostics. Collectors do not need REPLICATION CLIENT. Add a replication-status grant only if the readiness panel's "Server role detection" check warns: REPLICATION CLIENT on MySQL, REPLICA MONITOR (also spelled SLAVE MONITOR) on MariaDB 10.5.9 and later, and REPLICATION SLAVE ADMIN on MariaDB 10.5.2 to 10.5.8.

Performance Schema is the primary query source. MariaDB commonly relies on the slow-query log instead. A CLI collector can read a local log file, and an SSH collector can fetch one from its host; a managed direct connection cannot read a database host's filesystem.

CREATE ROLE dbtempo_readonly LOGIN
  PASSWORD '<strong-password>';

GRANT pg_read_all_stats TO dbtempo_readonly;
GRANT CONNECT ON DATABASE "<app-database>" TO dbtempo_readonly;
GRANT USAGE ON SCHEMA "<app-schema>" TO dbtempo_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA "<app-schema>"
  TO dbtempo_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA "<app-schema>"
  GRANT SELECT ON TABLES TO dbtempo_readonly;

Repeat the schema grants for every analyzed schema. Usepg_read_all_stats for query and session visibility;pg_monitor also works but is broader.pg_stat_statements must be preloaded and enabled by a DBA for live collection. hypopg is optional.