Install Grafana on Linux

Grafana is an open-source observability platform that turns time-series data from sources like Prometheus, InfluxDB, and MySQL into interactive dashboards. Installing it from the official Grafana repository rather than a distro-packaged version ensures you get current releases, security patches, and access to the full plugin catalogue. This guide walks through installation, securing the default login, connecting a datasource, building a basic dashboard, setting up an alert rule, and locking down authentication.

Add the Grafana Repository

Debian / Ubuntu

Install the prerequisites, import the GPG key, and add the stable repository.

sudo apt install -y apt-transport-https software-properties-common wget
wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor \
  | sudo tee /etc/apt/keyrings/grafana.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" \
  | sudo tee /etc/apt/sources.list.d/grafana.list
sudo apt update

Fedora / RHEL / Rocky

Drop a repo file directly into /etc/yum.repos.d/.

cat <<EOF | sudo tee /etc/yum.repos.d/grafana.repo
[grafana]
name=grafana
baseurl=https://rpm.grafana.com
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://rpm.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF

Arch Linux

Grafana is in the Arch extra repository; no third-party repo is needed.

sudo pacman -Sy grafana

Install Grafana

Debian / Ubuntu

sudo apt install -y grafana

Fedora / RHEL / Rocky

sudo dnf install -y grafana

The package installs the grafana-server binary, a systemd unit, and default configuration at /etc/grafana/grafana.ini.

Enable and Start the Service

Use systemd to enable Grafana at boot and start it immediately.

sudo systemctl daemon-reload
sudo systemctl enable --now grafana-server

Confirm it is running:

sudo systemctl status grafana-server

You should see active (running). Grafana binds to TCP port 3000 by default.

Open the Firewall Port

Skip this step if the server is behind a gateway that handles access control.

firewalld (Fedora / RHEL / Rocky)

sudo firewall-cmd --permanent --add-port=3000/tcp
sudo firewall-cmd --reload

ufw (Debian / Ubuntu)

sudo ufw allow 3000/tcp
sudo ufw reload

nftables (manual / Arch)

sudo nft add rule inet filter input tcp dport 3000 accept

Make that rule persistent by saving your ruleset to /etc/nftables.conf and ensuring nftables.service is enabled.

First Login and Changing the Admin Password

Open a browser and navigate to http://<server-ip>:3000. The default credentials are admin / admin. Grafana will immediately prompt you to set a new password — do not skip this.

You can also force a password reset from the CLI if you are locked out:

sudo grafana-cli admin reset-admin-password 'NewSecurePassword1!'

Configure Basic Settings in grafana.ini

The main configuration file is /etc/grafana/grafana.ini. At minimum, set a proper root_url and disable sign-up if this is not a public instance.

sudo nano /etc/grafana/grafana.ini

Locate and edit these keys (uncomment by removing the leading ;):

[server]
root_url = http://your.domain.com:3000

[users]
allow_sign_up = false

[security]
disable_gravatar = true

Restart to apply changes:

sudo systemctl restart grafana-server

Add a Datasource

A datasource tells Grafana where to read metrics. Prometheus is the most common pairing. In the web UI:

1. Go to Connections → Data sources → Add data source.
2. Select Prometheus.
3. Set the URL to http://localhost:9090 (or your Prometheus server address).
4. Leave authentication empty if Prometheus has no auth configured.
5. Click Save & test — you should see a green success banner.

For a MySQL or PostgreSQL datasource, the process is identical: choose the type, supply host, database name, user, and password, then save and test.

Create Your First Dashboard

1. Click Dashboards → New → New dashboard.
2. Click + Add visualization.
3. Select your Prometheus datasource.
4. In the query box enter a PromQL expression, for example rate(node_cpu_seconds_total{mode="idle"}[5m]).
5. Choose a visualization type (Time series, Gauge, Stat, etc.) from the right panel.
6. Click Apply, then Save dashboard and give it a name.

For a quick start without manual panel building, import a community dashboard. Go to Dashboards → New → Import and enter dashboard ID 1860 (Node Exporter Full) from grafana.com. This gives you a production-quality system metrics dashboard in under a minute.

Set Up an Alert Rule

Grafana's unified alerting (enabled by default since Grafana 9) lives under Alerting → Alert rules.

1. Click New alert rule.
2. Give the rule a name, e.g. High CPU.
3. Under Set a query and alert condition, select your datasource and enter a query such as 100 - (avg by(instance)(rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100).
4. Set the condition: IS ABOVE 80 for 5 minutes.
5. Assign a folder and evaluation group (create one if needed, e.g. every 1 minute).
6. Under Notifications, choose or create a Contact point (email, Slack, PagerDuty, etc.).
7. Save the rule.

To configure email delivery, add SMTP settings to grafana.ini:

[smtp]
enabled = true
host = smtp.example.com:587
user = [email protected]
password = yourpassword
from_address = [email protected]
from_name = Grafana

Harden Authentication

Disable Anonymous Access

Anonymous access is off by default; confirm it stays that way in grafana.ini:

[auth.anonymous]
enabled = false

Enable OAuth (Google as example)

[auth.google]
enabled = true
client_id = YOUR_CLIENT_ID
client_secret = YOUR_CLIENT_SECRET
scopes = openid email profile
auth_url = https://accounts.google.com/o/oauth2/auth
token_url = https://oauth2.googleapis.com/token
allowed_domains = yourcompany.com
allow_sign_up = true

Put Grafana Behind a Reverse Proxy

Running Grafana on port 3000 and letting Nginx or Caddy handle TLS on 443 is strongly recommended for production. Set root_url to the HTTPS URL and add serve_from_sub_path = true if you mount it at a path like /grafana.

Verify the Installation

sudo systemctl is-active grafana-server
curl -s http://localhost:3000/api/health | python3 -m json.tool

The health endpoint returns something like {"commit": "abc1234", "database": "ok", "version": "11.x.x"}. A "database": "ok" response confirms Grafana's internal SQLite (or configured) database is accessible.

Troubleshooting

• Port 3000 refused: Check sudo ss -tlnp | grep 3000. If nothing listens, the service did not start — run sudo journalctl -u grafana-server -n 50 --no-pager for the error.
• "Database locked" errors: This happens with SQLite when the data directory has wrong ownership. Fix with sudo chown -R grafana:grafana /var/lib/grafana.
• Datasource test fails: Verify network connectivity from the Grafana host — curl http://localhost:9090/api/v1/query?query=up should return JSON. Check SELinux or AppArmor if connectivity is fine but the test still fails.
• Alert rules not firing: Confirm the evaluation group interval is set and that the contact point has been tested. Check Alerting → Contact points → Test to send a test notification.
• SELinux blocking connections (RHEL/Rocky): Run sudo setsebool -P httpd_can_network_connect 1 if Grafana is behind Nginx and connections are denied.