From the terminal

Once, with a login that can create users:

CREATE USER 'dbtrail'@'%' IDENTIFIED BY <a password>;
GRANT REPLICATION SLAVE, REPLICATION CLIENT, SELECT ON *.* TO 'dbtrail'@'%';
GRANT RELOAD, BACKUP_ADMIN, PROCESS, SHOW VIEW ON *.* TO 'dbtrail'@'%';

MariaDB has no BACKUP_ADMIN: leave that word out. Amazon RDS and Aurora take other grants for the last line: read this first.

And the forwarding user: what DBTrail's MySQL port runs a statement as when the copy cannot answer it. Your application's grants, and no more:

CREATE USER 'shop_fwd'@'%' IDENTIFIED BY <another password>;
GRANT SELECT ON shop.* TO 'shop_fwd'@'%';

The options are the ones of the mysql client. -p asks for the password.

dbtrail server add -h db1.example.com -u dbtrail -p --name shop

DBTrail runs its checks and starts recording changes when they pass. The first server also turns the MySQL port on: the command prints its password, once, and asks for the forwarding user (Enter skips it).

Each command ends by naming the next one. Without a terminal, put the forwarding user in the option file instead (--defaults-file, under [dbtrail-forward]).

dbtrail snapshot run shop
dbtrail snapshot schedule shop --every 1h

The first command reads every table once, with a short lock so they are all read at one moment: pick a quiet time. It waits until the copy is ready. The second keeps the copy current from the recorded changes, without reading your MySQL again.

The user is your server's name, and the password is the one server add printed. Lost it? dbtrail port new-password makes another.