WIUNIX ACADEMY

Build a Prometheus + Grafana monitoring stack

Install Prometheus, node_exporter and Grafana with private access, validated configuration and checks that prove metrics reach your dashboard.

Intermediate70 min readUpdated 2026-10-20

Make this guide yours

YOUR SYSTEM. YOUR STEPS.

Where are you working?

Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.

Debian 12Reviewed against official documentation · 2026-10-20

USE YOUR OWN VALUES

Configure this tutorial

Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.

Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.

Set values for my environment2 editable values

THE OUTCOME

What will you have at the end?

Build a self-hosted monitoring stack that stores local system metrics in Prometheus, visualizes them in Grafana and leaves you with a clean path for adding more Linux nodes later.

01Linux nodesRun node_exporter to expose host metrics in Prometheus format.

02Prometheus serverScrapes targets on a schedule and stores time-series data locally.

03GrafanaUses Prometheus as a data source and renders dashboards.

04Browser accessAdministrators sign in to Grafana and explore metrics visually.

05Future growthAdd more exporters and alerting later without redesigning the base stack.

Supported operating systems and versions

Reviewed against official documentation on 2026-10-20. The selected Prometheus 3.15.0, node_exporter 1.12.1 and Grafana 13.2.4 binaries, configuration, provisioning and query chain were exercised in an isolated Ubuntu 22.04.5 container. This is not an APT/systemd installation test or a test of every selectable OS; all OS paths retain documented basis. Hero DEMO scenes and sample outputs are illustrative.

Before you begin

A fresh amd64 Ubuntu or Debian server with systemd, sudo access, internet access and at least 2 GB RAM and 10 GB free disk for this small lab; size production storage for your series volume and retention.
An existing SSH account and SSH client on your workstation. All three HTTP listeners stay on loopback; Grafana is accessed through an SSH local forward.
For the optional remote node: a trusted private network and an already active UFW firewall with default deny incoming, or equivalent managed network rules. Do not enable a new firewall blindly over SSH.

LET’S BUILD

Confirm the host role and the monitoring scope

Prometheus stores metrics, node_exporter exposes the local host counters, and Grafana queries Prometheus. These commands target a fresh amd64 systemd host, not an existing monitoring installation.

Reserve local ports 3000, 9090 and 9100. Keep them off the public network. The Grafana login and password change will travel through your existing encrypted SSH connection.

Monitoring server terminal. Commands that begin with sudo need administrative privileges.

hostnamectl
hostname -I
uname -m
sudo ss -lntup

How do I know it worked?

You can identify the host, see its IP addresses, confirm the architecture, and verify that port 3000 is available while local ports 9090 and 9100 are not already reserved by another monitoring stack.

LET’S BUILD

Install the base packages

Install the download, JSON, archive and editor tools used below. SHA256 checks use coreutils, already part of these systems. Grafana will use its signed official APT repository.

Monitoring server terminal.

(
set -euo pipefail
sudo apt-get update
sudo apt-get install -y curl tar adduser ca-certificates gnupg apt-transport-https jq nano
)

How do I know it worked?

APT completes without dependency errors and the host now has the tools required to download Prometheus, node_exporter and the Grafana repository key.

LET’S BUILD

Create service accounts and directories

Use dedicated system users and separate directories so binaries, configuration and time-series data remain organized. Prometheus needs a writable data directory, while node_exporter only needs its binary and a system account.

The directory layout below matches the later systemd services and keeps ownership explicit.

Monitoring server terminal.

(
set -euo pipefail
sudo adduser --system --no-create-home --group prometheus
sudo adduser --system --no-create-home --group node_exporter
sudo install -d -o root -g prometheus -m 0750 /etc/prometheus
sudo install -d -o prometheus -g prometheus -m 0750 /var/lib/prometheus
)

How do I know it worked?

Configuration remains root-owned and readable by the Prometheus group; only the data directory is service-writable.

LET’S BUILD

Download and install Prometheus

The official download page reviewed on 2026-10-20 lists Prometheus 3.15.0 (latest) and 3.13.4 (LTS). This guide selects 3.15.0 and pins its official linux-amd64 SHA256. A failed download or checksum stops this block before installation.

Prometheus 3 archives no longer ship the example consoles and console_libraries directories. Install the two binaries only; this configuration does not need console flags.

Monitoring server terminal.

(
set -euo pipefail
[ "$(uname -m)" = x86_64 ] || { echo 'This download requires amd64/x86_64' >&2; exit 1; }
work=$(mktemp -d)
cd "$work"
curl -fL --connect-timeout 10 --max-time 180 -o prometheus-3.15.0.linux-amd64.tar.gz \
  https://github.com/prometheus/prometheus/releases/download/v3.15.0/prometheus-3.15.0.linux-amd64.tar.gz
printf '%s  %s\n' '2a542df32eac02ee17b9d844fb2aa1de00dafa5476579ba8a3ba862e9d572ea0' 'prometheus-3.15.0.linux-amd64.tar.gz' | sha256sum --check --strict -
tar -xzf prometheus-3.15.0.linux-amd64.tar.gz
cd prometheus-3.15.0.linux-amd64
sudo install -o root -g root -m 0755 prometheus promtool /usr/local/bin/
prometheus --version
)

How do I know it worked?

SHA256 reports OK before extraction; prometheus reports 3.15.0. Keep the temporary download directory until validation is complete.

Open the next configuration file

Open the file, paste the contents in the following panel, then save and exit (nano: Ctrl+O, Enter, Ctrl+X). Do not run file contents as shell commands.

Monitoring server terminal.

sudo nano /etc/prometheus/prometheus.yml

How do I know it worked?

The command completes successfully; stop and inspect any error before continuing.

LET’S BUILD

Write the Prometheus configuration

Start with a compact configuration that scrapes Prometheus itself and the local node_exporter endpoint every 15 seconds. This is enough to prove the stack works before you add remote servers or alerting later.

Create the file exactly as shown and keep the targets on localhost for this first node.

File contents; save in the named file, not in the shell.

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: prometheus
    static_configs:
      - targets:
          - 127.0.0.1:9090

  - job_name: node-exporter
    static_configs:
      - targets:
          - 127.0.0.1:9100

How do I know it worked?

The Prometheus configuration file contains two scrape jobs and is ready for validation by the service start-up step.

Explore all tutorials ↗