---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# MySQL check

# MySQL check {#ariaid-title1}

Release version: Brazil  
Updated September 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Learn about the credential and permission requirements for the MySQL checks `app.mysql.check-mysql-alive`, `util.metrics-mysql-query`, `app.mysql.check-mysql-threads`,
`app.mysql.metrics-mysql`, `app.mysql.metrics-mysql-processes`, and `util.check-mysql-query`
MySQL checks require two separate accounts with different permissions:

## MySQL database account {#mysql-check__section_qdf_hy5_skc}

The database user configured in the ServiceNow® credential must have the following permissions:

* Basic login privilege on the target host and port, or socket
* SELECT access to whatever schema or table is targeted by a custom query
* PROCESS privilege for checks that read server-wide thread or connection state

{#mysql-check__ul_a3g_jy5_skc}{#mysql-check__table_zyc_ny5_skc__entry__2}

| Check | Additional requirement |
|-|-|
| `check-mysql-alive` | Login privilege only |
| `check-mysql-query-result-count, metrics-mysql-query-result-count` | SELECT access on the object targeted by the configured `--query` |
| `check-mysql-threads, metrics-mysql-processes` | PROCESS privilege. Without it, the account only sees its own connection or thread, not the server-wide count, and the check silently under-reports instead of erroring. |
| `metrics-mysql-graphite` | Login privilege only |
[Table 1. Checks and additional requirements]

{#mysql-check__table_zyc_ny5_skc}

## Agent Client Collector Agent OS account {#mysql-check__section_psb_vy5_skc}

There is no special OS permission required. The Agent Client Collector agent OS account only needs additional access if:

* A UNIX socket is used instead of TCP through `--socket`. The agent needs read and execute access to the socket file and its parent directory.
* An `ini` file is used to source connection settings through `--ini` or `--ini_section`, `my.cnf-style`. The agent needs read access to this `ini` file.
{#mysql-check__ul_vfj_yy5_skc}

Depending on the deployment, this typically means group membership on the socket's owning group, or read ACLs on the my.cnf file. It doesn't usually require root or DBA-level access.  
Configuration Prerequisites:

* MySQL or MariaDB TCP endpoint that is reachable from the agent host through `--hostname` and `--port`, or through `--socket`
* Database credentials are valid and not blocked by host-based grant restrictions, such as `user@'agent-host'` compared to `user@'%'`
* For thread or process metrics, confirm PROCESS is granted by running `SHOW GRANTS FOR 'user'@'host';`
{#mysql-check__ul_hvr_rz5_skc}