The setup includes Aurora PostgreSQL , PMM Server (Docker) and PMM Client (pmm-admin) running on EC2.

Here are the steps.

Prepare the database
Connect from the EC2 machine to Aurora as admin. Get the endpoint from the AWS console →Aurora and RDS

psql –host=<aurora-endpoint> –port=5432 –username=postgres –dbname=postgres

–create monitoring user
CREATE USER pmm WITH ENCRYPTED PASSWORD ‘your_password’;
GRANT rds_superuser TO pmm;
–enable pg_stat_statements extension
CREATE EXTENSION IF NOT EXISTS pg_stat_statements;

Install PMM Client on the EC2 Host
sudo yum install -y https://repo.percona.com/yum/percona-release-latest.noarch.rpm
wget https://downloads.percona.com/downloads/pmm3/3.1.0/binary/redhat/2023/x86_64/pmm-client-3.1.0-7.amzn2023.x86_64.rpm
sudo yum install -y ./pmm-client-3.1.0-7.amzn2023.x86_64.rpm

Register EC2 Host as PMM Client
pmm-admin config –server-insecure-tls –server-url=https://admin:welcome1@localhost

If this fails with

Checking local pmm-agent status…
pmm-agent is running.
Registering pmm-agent on PMM Server…
Failed to register pmm-agent on PMM Server: Post “https://localhost:443/v1/management/nodes”: EOF.

then port 443 must be added for listen to docker. How to add a port in docker(and to test it with curl) is described in Part 1 .But if only listen 443; is added, then curl http… is ok, but curl https… returns “curl: (35) OpenSSL/3.2.2: error:0A0000C6:SSL routines::packet length too long”

This is because we have to add in docker file /etc/nginx/conf.d/pmm.conf not only
listen 443;
but also
listen 443 ssl http2;

Now testing it with ‘curl -k https://localhost:443’  is working (-k to skip certificate validation. EC2 instance’s curl just doesn’t trust the (self-signed) certificate, which is normal for PMM by default)

Then registering the host as PMM client is fine.

Register Aurora PostgreSQL to PMM
pmm-admin add postgresql \
–username=pmm \
–password=’xxxxxxxx’ \
–query-source=pgstatstatements \
–service-name=aurora-postgres \
–host=db-postgres-1-instance-1.cxf8co3va5da.eu-central-1.rds.amazonaws.com \
–port=5432

PostgreSQL Service added.
Service ID : dd2e0625-b47c-4534-9f63-7e345f55bd5f
Service name: aurora-postgres

Verify the Registration
pmm-admin list

You should see the following agent types conencted and running – pmm_agent
node_exporter
postgres_exporter
vmagent

 

View in PMM Web UI
Open: https://<your-ec2-public-ip>

Go to:
Dashboards → PostgreSQL Overview
and you’ll see your Aurora instance metrics.

To avoid costs, do not forget to stop and drop your Aurora DB when you have finished with this hands-on.

Happy clouding!

1. Launch EC2 instance.
I will use t2.medium type, 2 cCPU / 4G RAM, 30G gp3 storage.

2. When the EC2 instance is ready, logon and install/configure PMM docker
sudo dnf install -y docker
sudo systemctl enable –now docker
sudo usermod -aG docker $USER (Log out and log back in for the group changes to take effect.)
docker pull percona/pmm-server:latest
docker create –name pmm-server \
-p 80:80 -p 443:443 \
-v pmm-data:/srv \
percona/pmm-server:latest
sudo docker start pmm-server

3. Now the PMM Server should be accessible at:

http://your-ec2-public-ip/
User: admin/admin

But trying http://your-ec2-public-ip/ doesn’t work. Lets try to find out what could be the reason. For this test I have the following inbound rules.
Rule Name Protocol Port Source
HTTP TCP 80 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0
SSH TCP 22 0.0.0.0/0
Of course this should not be set for production environment, it is too much, but for testing purposes it is fine, after finishing the lab all resources will be deleted.

My EC2 instance is in public subnet, there is access to/from internet. So, from the network side it should work.
Let see if curl is working for the localhost –

curl -I http://localhost
curl: (56) Recv failure: Connection reset by peer

Hm, the EC2 instance is not accepting connections on port 80 inside the instance, even locally.

sudo lsof -i -P -n | grep LISTEN | grep :80
docker-pr 28689 root 4u IPv4 72736 0t0 TCP *:80 (LISTEN)
docker-pr 28695 root 4u IPv6 72740 0t0 TCP *:80 (LISTEN)

docker inspect pmm-server –format='{{json .NetworkSettings.Ports}}’ | jq .
{
“443/tcp”: [
{
“HostIp”: “0.0.0.0”,
“HostPort”: “443”
},
{
“HostIp”: “::”,
“HostPort”: “443”
}
],
“80/tcp”: [
{
“HostIp”: “0.0.0.0”,
“HostPort”: “80”
},
{
“HostIp”: “::”,
“HostPort”: “80”
}
],
“8080/tcp”: null,
“8443/tcp”: null
}

Ok, Docker is binding port 80 correctly (both IPv4 and IPv6) – confirmed via lsof. The container is marked as healthy by Docker and the Security Groups are open. The last lines from the docker logfile (docker logs pmm-server –tail 50) is showing
2025-04-21 12:17:19,390 INFO success: qan-api2 entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-04-21 12:17:20,529 INFO spawned: ‘pmm-agent’ with pid 407
2025-04-21 12:17:21,581 INFO success: pmm-agent entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-04-21 12:17:21,643 INFO exited: pmm-init (exit status 0; expected)

This is also fine. Lets take a look inside the container.

docker exec -it pmm-server bash
and then from inside
docker exec -it pmm-server bash
[pmm@e39b524f3153 opt] # curl -I http://localhost
curl: (7) Failed to connect to localhost port 80: Connection refused

Great, we almost nailed it – inside the PMM container, nothing is listening on port 80. Let check the managed services inside the container –

supervisorctl status
clickhouse RUNNING pid 15, uptime 0:36:54
grafana RUNNING pid 16, uptime 0:36:54
nginx RUNNING pid 17, uptime 0:36:54
pmm-agent RUNNING pid 407, uptime 0:36:51
pmm-init EXITED Apr 21 12:17 PM
pmm-managed RUNNING pid 29, uptime 0:36:54
postgresql RUNNING pid 14, uptime 0:36:54
qan-api2 RUNNING pid 337, uptime 0:36:53
victoriametrics RUNNING pid 18, uptime 0:36:54
vmalert RUNNING pid 19, uptime 0:36:54
vmproxy RUNNING pid 23, uptime 0:36:54

nginx is indeed running inside the container — which means that
– the webserver is alive
– the container is healthy
– docker is exposing port 80 correctly