From 8abb1a532e4a5ee5d548d907cc611677dbb74ae7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20=C4=8Ctvrtka?= <j.ctvrtka@gmail.com>
Date: Thu, 18 Jun 2026 09:37:43 +0200
Subject: [PATCH 1/3] PMM-14717 Improvements.

---
 .../connect-database/mongodb.md               | 88 +++++++++++--------
 .../connect-database/mysql/mysql.md           | 44 ++++++----
 .../install-pmm-client/prerequisites.md       |  7 +-
 documentation/docs/quickstart/quickstart.md   | 10 +--
 .../docs/use/qan/QAN-stored-metrics.md        | 19 +++-
 documentation/docs/use/qan/index.md           | 13 +--
 6 files changed, 106 insertions(+), 75 deletions(-)

diff --git a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
index 19d49f15f9f..1ee5d996edc 100644
--- a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
+++ b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
@@ -9,26 +9,25 @@ Before you start, ensure you have:
 - [PMM Server installed](../../install-pmm-server/index.md) and running with a known IP address or hostname accessible from the Client node.
 - [PMM Client installed](../../install-pmm-client/index.md) and the nodes are registered with PMM Server.
 - admin privileges to install and configure PMM Client on the host.
-- preconfigured MongoDB user with appropriate monitoring privileges, or sufficient privileges to create the required roles and users.
 - MongoDB server version 6.0 or higher. PMM may work with MongoDB versions as old as 4.4, but we recommend using MongoDB 6.0+ for complete feature support.
 
-## Step 1: Set up MongoDB monitoring permissions
+| Query source | Database QAN permissions | Host file access |
+| :--- | :--- | :--- |
+| **Profiler** (default) | `find` on `system.profile` — [Step 1](#step-1-configure-query-analytics) | Not required |
+| **Mongolog** | Not required | Read access to the MongoDB log file for `pmm-agent` — [Step 1](#step-1-configure-query-analytics) |
 
-Set up MongoDB with a dedicated user for PMM and the required permissions. First, create custom roles with the necessary privileges, then assign them to a PMM-specific user.
+### Create MongoDB monitoring user (for metrics)
 
-Role privileges depend on:
+PMM needs a dedicated MongoDB user for **dashboard metrics** (`mongodb_exporter`), regardless of the Query Analytics query source.
 
-- MongoDB version: 8.0+ requires the additional `directShardOperations` role for shard metrics
-- Required features: basic monitoring only, or monitoring plus backup management.
-- Query collection method: profiler or diagnostic log.
+Create custom roles with the necessary privileges, then assign them to a PMM-specific user.
 
-### Create monitoring role
+Role privileges depend on:
 
-After connecting to your MongoDB instance, create a custom role with the privileges required for metric collection, working with Query Analytics (QAN) and optionally creating/restoring backups:
-  
-#### Minimum privileges
+- MongoDB version: 8.0+ requires the additional `directShardOperations` role for shard metrics
+- Required features: basic monitoring only, or monitoring plus backup management
 
-This role grants the essential minimum privileges needed for monitoring and QAN:
+#### Minimum privileges (metrics collection)
 
 ```javascript
 db.getSiblingDB("admin").createRole({
@@ -41,16 +40,12 @@ db.getSiblingDB("admin").createRole({
     {
     "resource": { "db": "", "collection": "system.version" },
     "actions": [ "find" ]
-    },
-    {
-    "resource": { "db": "", "collection": "system.profile" },
-    "actions": [ "dbStats", "collStats", "indexStats" ]
-    }         
+    }
 ],
 "roles": [ ]
 })
 ```
-        
+
 #### Full backup management privileges
 
 If you plan to use PMM's backup features, also create a role with full backup management privileges:
@@ -68,7 +63,7 @@ db.getSiblingDB("admin").createRole({
 });
 ```
 
-### Create user and assign created role
+#### Create user and assign roles
 
 After creating the custom roles, create the PMM user and assign the roles based on your MongoDB version and requirements:
 
@@ -140,9 +135,9 @@ After creating the custom roles, create the PMM user and assign the roles based
     })      
     ```
 
-## Step 2: Configure query source for MongoDB query analytics
+## Step 1: Configure Query Analytics
 
-PMM offers two methods for collecting MongoDB queries. Choose based on your environment's requirements and constraints.
+Complete the section for your query source before [adding the service](#step-2-add-mongodb-service-to-pmm).
 
 ### Compare query source methods
 
@@ -159,6 +154,9 @@ PMM offers two methods for collecting MongoDB queries. Choose based on your envi
 | Scales with DB count       | Linear degradation| Constant         |
 
 === "MongoDB Profiler (Default)"
+    !!! note "Using mongolog?"
+        Skip this section and use [Diagnostic Log](#diagnostic-log-recommended-for-scale) instead.
+
     Choose this standard method for simple setups with fewer than 100 databases, remote MongoDB instances, or when you need real-time query collection. 
 
     The MongoDB Profiler stores query performance data in `system.profile` collections for each database. PMM continuously reads from these collections to provide query analytics.
@@ -168,7 +166,20 @@ PMM offers two methods for collecting MongoDB queries. Choose based on your envi
     - Real-time query collection and analysis
     - No additional file system access required
     - Works with managed MongoDB services
-    - Immediate data availability after profiling is enabled 
+    - Immediate data availability after profiling is enabled
+
+    #### Database permissions for Profiler QAN
+
+    Add `find` on `system.profile` to the `pmmMonitor` role:
+
+    ```javascript
+    db.getSiblingDB("admin").grantPrivilegesToRole("pmmMonitor", [
+        {
+        "resource": { "db": "", "collection": "system.profile" },
+        "actions": [ "find", "dbStats", "collStats", "indexStats" ]
+        }
+    ])
+    ```
 
     To enable the MongoDB Profiler, choose one of the following methods:
 
@@ -222,27 +233,30 @@ PMM offers two methods for collecting MongoDB queries. Choose based on your envi
         db.setProfilingLevel(2, {slowms: 0})
         ```
 
-    If you have already [added a service](#step-3-add-mongodb-service-to-pmm), you should remove it and re-add it after changing the profiling level.   
+    If you have already [added a service](#step-2-add-mongodb-service-to-pmm), you should remove it and re-add it after changing the profiling level.   
 
 === "Diagnostic Log (Recommended for scale)"
-     Choose this method for production environments with 100+ databases, when experiencing connection pool issues, or when monitoring mongos routers.
+    !!! note "Using Profiler?"
+        Skip this section and use [MongoDB Profiler](#mongodb-profiler-default) instead.
+
+    Choose this method for production environments with 100+ databases, connection pool issues, or `mongos` routers.
 
-    Available from PMM 3.3.0+, this method reads query data directly from MongoDB's log files instead of querying the database. This eliminates connection pool usage and reduces performance impact.
+    Available from PMM 3.3.0+, this method reads query data from MongoDB log files instead of `system.profile`.
 
     Key advantages:
 
-    - Zero database connections required for metrics collection
-    - Eliminates connection pool errors completely
-    - Scales linearly regardless of database count
-    - Identical query analytics data as traditional profiler
+    - Zero database connections for query collection
+    - Scales regardless of database count
+    - Supports `mongos` routers
 
-    Prerequisites for Diagnostic Log: 
+    #### Requirements
 
     - MongoDB 5.0+ (tested with 5.0.20-17)
-    - Write access to the configured log directory for MongoDB process
-    - Read access to log file for PMM Agent user
+    - MongoDB process has write access to the log directory
+    - `pmm-agent` user has read access to the log file
+    - Monitoring user has `getCmdLineOpts` (included in `clusterMonitor` from Prerequisites)
 
-    To configure mongolog for MongoDB: 
+    To configure mongolog for MongoDB:
     {.power-number}
 
     1. Choose one of the following methods to configure MongoDB to log slow operations to the diagnostic log file:
@@ -321,9 +335,9 @@ PMM offers two methods for collecting MongoDB queries. Choose based on your envi
         - Avoid moving/renaming log files as this breaks mongolog's file tail
         - Do not delete active log files during rotation
       
-## Step 3: Add MongoDB service to PMM
+## Step 2: Add MongoDB service to PMM
 
-After configuring your database server, add a MongoDB service using either the user interface or the command line.
+After completing [Prerequisites](#prerequisites) and [Step 1](#step-1-configure-query-analytics) for your chosen query source, add a MongoDB service using either the user interface or the command line. Select the query source that matches your Step 1 configuration (`profiler` or `mongolog`).
 
 !!! caution alert alert-warning "Important"
     To monitor MongoDB sharded clusters, PMM requires access to all cluster components. Make sure to add all config servers, all shards, and at least one or two mongos routers. Otherwise, PMM will not be able to correctly collect metrics and populate dashboards.
@@ -409,7 +423,7 @@ After configuring your database server, add a MongoDB service using either the u
 
     1. Select **Inventory > Add service > MongoDB**.
 
-    2. Fill in the required fields.
+    2. Fill in the required fields, including **Query Source** (`Profiler` or `Diagnostic log (mongolog)`) to match your [Step 1](#step-1-configure-query-analytics) configuration.
 
     3. Click **Add service**.
 
@@ -430,7 +444,7 @@ After configuring your database server, add a MongoDB service using either the u
     
     Only variables already set in the `pmm-agent` environment will be passed to the exporter.
 
-## Step 4: Verify MongoDB service configuration
+## Step 3: Verify MongoDB service configuration
 
 After adding MongoDB service to PMM, verify that it's properly configured and collecting data. This ensures your monitoring setup is working correctly.
 {.power-number}
diff --git a/documentation/docs/install-pmm/install-pmm-client/connect-database/mysql/mysql.md b/documentation/docs/install-pmm/install-pmm-client/connect-database/mysql/mysql.md
index 1749796ecdf..44877cf5798 100644
--- a/documentation/docs/install-pmm/install-pmm-client/connect-database/mysql/mysql.md
+++ b/documentation/docs/install-pmm/install-pmm-client/connect-database/mysql/mysql.md
@@ -7,14 +7,16 @@ Easily connect your MySQL databases—whether self-hosted or running on AWS EC2
 Get your MySQL instance connected to PMM in just a few steps:
 {.power-number}
 
-1. Create a dedicated MySQL user with the required permissions.  If you are using an [Administrative Connection](https://dev.mysql.com/doc/refman/8.4/en/administrative-connection-interface.html), you will also need to grant the `SERVICE_CONNECTION_ADMIN` privilege to the `pmm` user:
+1. Create a dedicated MySQL user with the permissions required for **metrics collection**. If you are using an [Administrative Connection](https://dev.mysql.com/doc/refman/8.4/en/administrative-connection-interface.html), you will also need to grant the `SERVICE_CONNECTION_ADMIN` privilege to the `pmm` user:
 
     ```sql
-    -- Create PMM user with required permissions
+    -- Create PMM user with permissions for metrics collection
     CREATE USER 'pmm'@'localhost' IDENTIFIED BY 'StrongPassword123!' WITH MAX_USER_CONNECTIONS 10;
     GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD ON *.* TO 'pmm'@'localhost';
     ```
 
+    Query Analytics setup depends on the query source. See [Configure data source](#configure-data-source).
+
 2. Register your MySQL instance with PMM:
 
     ```sh
@@ -54,15 +56,20 @@ For monitoring Amazon RDS MySQL instances, see [Connect Amazon RDS instance](../
 
     1. **[Prerequisites](#prerequisites)**: Ensure PMM Server is running and PMM Client is installed
     2. **[Create PMM user](#create-a-database-account-for-pmm)**: `CREATE USER 'pmm'@'localhost' IDENTIFIED BY '<StrongPassword>'`  
-    3. **[Grant permissions](#create-a-database-account-for-pmm)**: `GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD ON *.* TO 'pmm'@'localhost'`
-    4. **[Configure data source](#configuring-data-sources)**: Enable Slow Query Log or Performance Schema 
-    5. **[Add service](#adding-mysql-services-to-pmm)**: Use PMM UI or command line to add the MySQL instance
+    3. **[Grant permissions](#create-a-database-account-for-pmm)**: `GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD ON *.* TO 'pmm'@'localhost'` (metrics collection only)
+    4. **[Configure data source](#configuring-data-sources)**: Enable Slow Query Log or Performance Schema, and complete the query-source-specific permissions
+    5. **[Add service](#adding-mysql-services-to-pmm)**: Use PMM UI or command line to add the MySQL instance, selecting the matching query source
     6. **[Verify connection](#verifying-the-setup)**: Check PMM Inventory and dashboards for data
 
 ### Prerequisites
 
 Before connecting MySQL to PMM, review the prerequisites for your monitoring setup:
 
+| Query source | Database QAN permissions | Host file access |
+| :--- | :--- | :--- |
+| **Performance Schema** (`perfschema`) | `SELECT` on Performance Schema (included in metrics grants) | Not required |
+| **Slow query log** (`slowlog`) | Not required beyond metrics grants | Read access to the slow query log file for `pmm-agent` |
+
 === "Local MySQL monitoring"
     - [PMM Server is installed](../../../install-pmm-server/index.md) and running.
     - [PMM Client is installed](../../../install-pmm-client/index.md) and the nodes are registered with PMM Server.
@@ -95,7 +102,7 @@ For security best practices, connect PMM Client to your database using a dedicat
     - Avoid common words or patterns
     - Never use default, test, or example passwords in production
 
-This example creates a pmm user account that has just enough access to collect monitoring data without full administrative privileges:
+This example creates a pmm user for **dashboard metrics**. For Query Analytics, see [Configure data source](#configure-data-source).
 
 === "On MySQL 5.7/MariaDB 10.x"
 
@@ -141,11 +148,15 @@ Here are the benefits and drawbacks of Slow query log and Performance Schema met
 ### Configure data source
 
 === "Slow query log"
-        
-    The *slow query log* records the details of queries that take more than a certain amount of time to complete. 
-    
-    With the database server configured to write this information to a file rather than a table, PMM Client parses the file and sends aggregated data to PMM Server via the Query Analytics part of `pmm-agent`.
-    
+
+    !!! note "Using Performance Schema?"
+        Skip this section and use [Performance Schema](#performance-schema) instead.
+
+    PMM reads the slow query log file via `pmm-agent`. Ensure:
+
+    - `pmm-agent` has read access to the slow query log file (root/sudo may be required with RPM/DEB packages)
+    - The monitoring user has `SELECT` to read `@@slow_query_log_file`; `RELOAD` only if using automatic log rotation (`--size-slow-logs`)
+
     #### Settings
     
     | Variable | Value | Description |
@@ -241,9 +252,12 @@ Here are the benefits and drawbacks of Slow query log and Performance Schema met
         If you prefer to handle log rotation manually, such as with [logrotate][LOGROTATE], you can disable PMM Client's automatic log rotation. To do this, set a negative value for the `--size-slow-logs` option when adding a service with the `pmm-admin add` command.
 
 === "Performance Schema"
-        
-    To configure a MySQL-based database server to use Performance Schema as a source of metrics:
-    
+
+    !!! note "Using slowlog?"
+        Skip this section and use [Slow query log](#slow-query-log) instead.
+
+    The `SELECT` grant from [Create a database account for PMM](#create-a-database-account-for-pmm) is sufficient. Enable and configure Performance Schema as described below.
+
     #### Applicable versions
     
     - **Percona Server for MySQL**: 5.6, 5.7, 8.0, 8.4
@@ -523,7 +537,7 @@ The **command line** (`pmm-admin`) deploys an exporter directly on the database
         - **Port**: MySQL port (default: 3306)
         - **Username**: The PMM user created earlier
         - **Password**: Your PMM user password
-        - **Query Source**: Choose between **Slow Log** or **Performance Schema**
+        - **Query Source**: Choose **Slow Log** or **Performance Schema** to match your [Configure data source](#configure-data-source) setup
         - **PMM Agent**: Select which PMM agent should monitor this instance
         - **Disable query examples**: Check this option to prevent collection of actual query values in QAN. When enabled, PMM will continue to collect query metrics and statistics but will not store the actual query examples with real data values.
         - **Connection timeout**: How long PMM should wait when connecting to this service. Increase this for remote or high-latency databases. If the connection times out, PMM retries the next time it collects metrics. Leave empty to use the default of 2s.
diff --git a/documentation/docs/install-pmm/install-pmm-client/prerequisites.md b/documentation/docs/install-pmm/install-pmm-client/prerequisites.md
index 168460d3724..8a0766a5672 100644
--- a/documentation/docs/install-pmm/install-pmm-client/prerequisites.md
+++ b/documentation/docs/install-pmm/install-pmm-client/prerequisites.md
@@ -44,14 +44,13 @@ For a complete list of ports and detailed network configuration options, see [Ne
 
 To ensure successful database monitoring with PMM, confirm the following:
 
-- **Monitoring users**: Create database accounts with the required permissions  
-- **Log access**: Enable file system access to database logs (where applicable)  
-- **Performance Schema**: Recommended for enhanced MySQL monitoring  
+- **Monitoring users**: Permissions for dashboard metrics — see database-specific setup guides
+- **Query Analytics**: Depends on query source (Profiler/mongolog, slowlog/perfschema) — see the same guides
 
 === ":material-database: Core databases"
 
     - [MySQL monitoring requirements](../install-pmm-client/connect-database/mysql/mysql.md#create-a-database-account-for-pmm)  
-    - [MongoDB monitoring requirements](../install-pmm-client/connect-database/mongodb.md#create-a-database-account-and-set-permissions)  
+    - [MongoDB monitoring requirements](../install-pmm-client/connect-database/mongodb.md#prerequisites)  
     - [PostgreSQL monitoring requirements](../install-pmm-client/connect-database/postgresql.md#create-a-database-account-for-pmm)
 
 === ":material-cloud: Cloud services"
diff --git a/documentation/docs/quickstart/quickstart.md b/documentation/docs/quickstart/quickstart.md
index 587f9fb5e85..36eed6d21ec 100644
--- a/documentation/docs/quickstart/quickstart.md
+++ b/documentation/docs/quickstart/quickstart.md
@@ -238,7 +238,7 @@ Once PMM is set up, choose the database or the application that you want it to m
     To connect a MongoDB database:
     { .power-number}
     
-    1.  Run the following command in `mongo` shell to create a role with the monitoring permissions: 
+    1.  Run the following command in `mongo` shell to create a role with the permissions required for **metrics collection**:
  
         ```
         db.createRole({
@@ -252,16 +252,14 @@ Once PMM is set up, choose the database or the application that you want it to m
                {
                  "resource": { "db": "", "collection": "system.version" },
                  "actions": [ "find" ]
-               },
-               {
-                 "resource": { "db": "", "collection": "system.profile" },
-                 "actions": [ "dbStats", "collStats", "indexStats" ]
-               }                  
+               }
             ],
             "roles": []
         })
         ```
 
+        For Profiler QAN, also run `grantPrivilegesToRole` from [Step 1](../install-pmm/install-pmm-client/connect-database/mongodb.md#step-1-configure-query-analytics). For mongolog, configure log file access there instead.
+
     2. Create a user and grant it the role created above:
 
         === "MongoDB 8.0+"
diff --git a/documentation/docs/use/qan/QAN-stored-metrics.md b/documentation/docs/use/qan/QAN-stored-metrics.md
index eb82d3c7ef4..a1619fef380 100644
--- a/documentation/docs/use/qan/QAN-stored-metrics.md
+++ b/documentation/docs/use/qan/QAN-stored-metrics.md
@@ -12,7 +12,18 @@ Stored metrics supports MySQL, MongoDB, and PostgreSQL with the following requir
     - Percona Server 5.6+ (all Performance Schema and slow log features)
     - MariaDB 5.2+ (for user statistics), 10.0+ (for Performance Schema)
 
-    Some limitations and tuning options apply when using MySQL's Performance Schema. See [Query Analytics with MySQL](mysql.md#limitations-with-performance-schema).
+    **Slow query log requirements**
+
+    - Slow query log enabled and configured to write to a file
+    - PMM agent has read permissions to the slow query log file on the host
+    - MySQL monitoring user needs `SELECT` to read the log file path; `RELOAD` is required only for automatic log rotation
+
+    **Performance Schema requirements**
+
+    - Performance Schema enabled and configured
+    - MySQL monitoring user needs `SELECT` to read Performance Schema tables (no log file access required)
+
+    Some limitations and tuning options apply when using MySQL's Performance Schema. See [Query Analytics with MySQL](mysql.md#missing-query-examples-in-mysql-performance-schema).
 
 === "PostgreSQL"
     - PostgreSQL 11 or later
@@ -26,15 +37,15 @@ Stored metrics supports MySQL, MongoDB, and PostgreSQL with the following requir
     **Profiler requirements**
 
     - Profiling enabled for Query Analytics
-    - Appropriate user roles: `clusterMonitor`, `read` (local), and custom monitoring roles
+    - Appropriate user roles: `clusterMonitor`, `read` (local), and custom monitoring roles with `find` on `system.profile`
     - For MongoDB 8.0+: Additional `directShardOperations` role required for sharded clusters
 
     **Mongolog requirements**
 
     - MongoDB configured to log slow operations to a file
     - MongoDB server has write permissions to the log directory and file
-    - PMM agent has read permissions to the MongoDB log file
-    - Appropriate user roles: `clusterMonitor`, or custom monitoring roles (`getCmdLineOpts` privilege on `{ cluster: true }`)
+    - PMM agent has read permissions to the MongoDB log file on the host (no `system.profile` database privileges required)
+    - MongoDB monitoring user needs `getCmdLineOpts` privilege to discover the log file path (included in the built-in `clusterMonitor` role)
 
 ## Dashboard layout
 
diff --git a/documentation/docs/use/qan/index.md b/documentation/docs/use/qan/index.md
index f4ea47670b3..fe29c27580a 100644
--- a/documentation/docs/use/qan/index.md
+++ b/documentation/docs/use/qan/index.md
@@ -26,17 +26,12 @@ Query Analytics offers two ways to analyze queries:
 | **Query details** | Raw operation data from `db.currentOp()` (no aggregation, grouping, or processing) | Aggregated metrics and query fingerprints |
 | **Best for** | "What's slowing down my database right now?" | "Which queries should I optimize?" |
 
-### Requirements for Profiler
+### Query Analytics requirements by query source
 
-    - Profiling enabled for Query Analytics
-    - Appropriate user roles: `clusterMonitor`, `read` (local), and custom monitoring roles. For MongoDB 8.0+: Additional `directShardOperations` role required for sharded clusters
+See [QAN Stored metrics](QAN-stored-metrics.md#supported-databases) for per-database requirements. Setup details are in the install guides:
 
-    ### Requirements for Mongolog
-
-    - MongoDB configured to log slow operations to a file
-    - MongoDB server has write permissions to the log directory and file
-    - PMM agent has read permissions to the MongoDB log file
-    - Appropriate user roles: `clusterMonitor`, or custom monitoring roles (`getCmdLineOpts` privilege on `{ cluster: true }`)
+- [MongoDB](../../install-pmm/install-pmm-client/connect-database/mongodb.md#prerequisites)
+- [MySQL](../../install-pmm/install-pmm-client/connect-database/mysql/mysql.md#prerequisites)
 
 ## Dashboard components
 Query Analytics displays metrics in both visual and numeric form. Performance-related characteristics appear as plotted graphics with summaries.

From 0671fb1fe34ad237abf73923d65bd61fe6788d2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20=C4=8Ctvrtka?= <j.ctvrtka@gmail.com>
Date: Thu, 18 Jun 2026 10:04:44 +0200
Subject: [PATCH 2/3] PMM-14717 Changes.

---
 .../connect-database/mongodb.md               | 23 +++++++------------
 documentation/docs/quickstart/quickstart.md   |  8 ++++---
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
index 1ee5d996edc..c2008b12f20 100644
--- a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
+++ b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
@@ -13,7 +13,7 @@ Before you start, ensure you have:
 
 | Query source | Database QAN permissions | Host file access |
 | :--- | :--- | :--- |
-| **Profiler** (default) | `find` on `system.profile` — [Step 1](#step-1-configure-query-analytics) | Not required |
+| **Profiler** (default) | `find` on `system.profile` in `pmmMonitor` role | Not required |
 | **Mongolog** | Not required | Read access to the MongoDB log file for `pmm-agent` — [Step 1](#step-1-configure-query-analytics) |
 
 ### Create MongoDB monitoring user (for metrics)
@@ -27,7 +27,9 @@ Role privileges depend on:
 - MongoDB version: 8.0+ requires the additional `directShardOperations` role for shard metrics
 - Required features: basic monitoring only, or monitoring plus backup management
 
-#### Minimum privileges (metrics collection)
+#### Create pmmMonitor role
+
+Include all three privilege blocks below for **Profiler** (default). If you use **mongolog**, omit the `system.profile` block.
 
 ```javascript
 db.getSiblingDB("admin").createRole({
@@ -40,6 +42,10 @@ db.getSiblingDB("admin").createRole({
     {
     "resource": { "db": "", "collection": "system.version" },
     "actions": [ "find" ]
+    },
+    {
+    "resource": { "db": "", "collection": "system.profile" },
+    "actions": [ "find", "dbStats", "collStats", "indexStats" ]
     }
 ],
 "roles": [ ]
@@ -168,19 +174,6 @@ Complete the section for your query source before [adding the service](#step-2-a
     - Works with managed MongoDB services
     - Immediate data availability after profiling is enabled
 
-    #### Database permissions for Profiler QAN
-
-    Add `find` on `system.profile` to the `pmmMonitor` role:
-
-    ```javascript
-    db.getSiblingDB("admin").grantPrivilegesToRole("pmmMonitor", [
-        {
-        "resource": { "db": "", "collection": "system.profile" },
-        "actions": [ "find", "dbStats", "collStats", "indexStats" ]
-        }
-    ])
-    ```
-
     To enable the MongoDB Profiler, choose one of the following methods:
 
     === "In MongoDB configuration file (Recommended)"
diff --git a/documentation/docs/quickstart/quickstart.md b/documentation/docs/quickstart/quickstart.md
index 36eed6d21ec..48c99928ee6 100644
--- a/documentation/docs/quickstart/quickstart.md
+++ b/documentation/docs/quickstart/quickstart.md
@@ -238,7 +238,7 @@ Once PMM is set up, choose the database or the application that you want it to m
     To connect a MongoDB database:
     { .power-number}
     
-    1.  Run the following command in `mongo` shell to create a role with the permissions required for **metrics collection**:
+    1.  Run the following command in `mongo` shell to create the `pmmMonitor` role. Include the `system.profile` block for Profiler QAN (default); omit it for mongolog.
  
         ```
         db.createRole({
@@ -252,14 +252,16 @@ Once PMM is set up, choose the database or the application that you want it to m
                {
                  "resource": { "db": "", "collection": "system.version" },
                  "actions": [ "find" ]
+               },
+               {
+                 "resource": { "db": "", "collection": "system.profile" },
+                 "actions": [ "find", "dbStats", "collStats", "indexStats" ]
                }
             ],
             "roles": []
         })
         ```
 
-        For Profiler QAN, also run `grantPrivilegesToRole` from [Step 1](../install-pmm/install-pmm-client/connect-database/mongodb.md#step-1-configure-query-analytics). For mongolog, configure log file access there instead.
-
     2. Create a user and grant it the role created above:
 
         === "MongoDB 8.0+"

From 8e7cc2b7a3a59ae138198197b24fe3f39ce7aeaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20=C4=8Ctvrtka?= <j.ctvrtka@gmail.com>
Date: Thu, 18 Jun 2026 10:46:16 +0200
Subject: [PATCH 3/3] PMM-14717 Fix.

---
 .../install-pmm/install-pmm-client/connect-database/mongodb.md  | 2 +-
 .../reference/dashboards/dashboard-mongodb-backup-details.md    | 2 +-
 .../reference/dashboards/dashboard-mongodb-cluster-summary.md   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
index c2008b12f20..224c0abdeb5 100644
--- a/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
+++ b/documentation/docs/install-pmm/install-pmm-client/connect-database/mongodb.md
@@ -16,7 +16,7 @@ Before you start, ensure you have:
 | **Profiler** (default) | `find` on `system.profile` in `pmmMonitor` role | Not required |
 | **Mongolog** | Not required | Read access to the MongoDB log file for `pmm-agent` — [Step 1](#step-1-configure-query-analytics) |
 
-### Create MongoDB monitoring user (for metrics)
+### Create MongoDB monitoring user
 
 PMM needs a dedicated MongoDB user for **dashboard metrics** (`mongodb_exporter`), regardless of the Query Analytics query source.
 
diff --git a/documentation/docs/reference/dashboards/dashboard-mongodb-backup-details.md b/documentation/docs/reference/dashboards/dashboard-mongodb-backup-details.md
index 01a0257c33e..48284011c4a 100644
--- a/documentation/docs/reference/dashboards/dashboard-mongodb-backup-details.md
+++ b/documentation/docs/reference/dashboards/dashboard-mongodb-backup-details.md
@@ -11,7 +11,7 @@ Use the filters at the top to narrow down to specific environments, clusters, or
 ![MongoDB Backup Details dashboard](../../images/BackupDetails_Dashboard.png)
 
 !!! note
-    This dashboard requires MongoDB services to be added with the `--cluster` parameter. If panels show no data, see [Add MongoDB service to PMM](../../install-pmm/install-pmm-client/connect-database/mongodb.md#step-3-add-mongodb-service-to-pmm).
+    This dashboard requires MongoDB services to be added with the `--cluster` parameter. If panels show no data, see [Add MongoDB service to PMM](../../install-pmm/install-pmm-client/connect-database/mongodb.md#step-2-add-mongodb-service-to-pmm).
 
 ## Overview 
 
diff --git a/documentation/docs/reference/dashboards/dashboard-mongodb-cluster-summary.md b/documentation/docs/reference/dashboards/dashboard-mongodb-cluster-summary.md
index a15308c7e9e..578b6af51f9 100644
--- a/documentation/docs/reference/dashboards/dashboard-mongodb-cluster-summary.md
+++ b/documentation/docs/reference/dashboards/dashboard-mongodb-cluster-summary.md
@@ -31,7 +31,7 @@ Use these grids to confirm all cluster components are healthy before investigati
     - use the same `--cluster` name for all components of your sharded cluster.
     - add config servers, shard nodes, and mongos routers as separate services.
 
-    For details, see [Add MongoDB services via CLI](../../install-pmm/install-pmm-client/connect-database/mongodb.md#step-3-add-mongodb-service-to-pmm).
+    For details, see [Add MongoDB services via CLI](../../install-pmm/install-pmm-client/connect-database/mongodb.md#step-2-add-mongodb-service-to-pmm).
 
     Example: