How To Install And Configure Grafana On CentOS

Grafana turns system and application metrics into dashboards, alerts, and searchable visualisations. On a CentOS server, it works well with Prometheus, Elasticsearch, InfluxDB, Loki, and other data sources used for Linux monitoring.

CentOS Stream 9 is the practical target for a new deployment. CentOS Linux 7 reached end of life in 2024, so it should not be used for a fresh monitoring server unless an existing environment requires it. The commands below assume a sudo-enabled account on CentOS Stream 9 or a compatible RHEL-based distribution.

A small virtual machine is usually enough for a basic installation. Place it near the systems being monitored, such as an AWS Sydney region workload or an Azure Australia East environment, when latency and data residency matter. Grafana itself stores configuration and dashboard metadata locally, while the data source holds the monitoring history.

The process involves adding Grafana’s package repository, starting the systemd service, opening the correct firewalld port, and securing access behind a reverse proxy or trusted network. The Linux administration reference also provides related command-line and server-maintenance material.

Prepare The CentOS Host

Update the operating system and install utilities required for repository management:

sudo dnf update -y
sudo dnf install -y ca-certificates curl policycoreutils-python-utils

Check the system clock before configuring alerts. Australian teams may operate across Sydney, Melbourne, Brisbane, Perth, and Adelaide, so keeping servers on UTC avoids daylight-saving confusion. Enable chronyd and confirm the current time:

sudo systemctl enable --now chronyd
timedatectl status

Grafana requires a reachable hostname or IP address. If DNS is not available, create a temporary local entry in /etc/hosts, but use proper internal DNS for production. Also confirm that the server can reach rpm.grafana.com over HTTPS.

Add The Grafana Repository

Create a repository definition using the official Grafana RPM source:

sudo tee /etc/yum.repos.d/grafana.repo > /dev/null <<'EOF'
[grafana]
name=grafana
baseurl=https://rpm.grafana.com
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://rpm.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF

Install the open-source Grafana package:

sudo dnf makecache
sudo dnf install -y grafana

The package creates the grafana user, service files, configuration directories, and a default SQLite database. For a larger installation, PostgreSQL or MySQL can be configured later so dashboard metadata is stored separately from the application host.

Verify the installed version and enable the service:

grafana-server -v
sudo systemctl enable --now grafana-server
sudo systemctl status grafana-server

If the service fails, inspect recent messages with sudo journalctl -u grafana-server -n 50 --no-pager. Common causes include invalid settings in /etc/grafana/grafana.ini, permission changes, or a port already being used.

Open The Firewall And Log In

Grafana listens on TCP port 3000 by default. Open that port only when direct access is appropriate:

sudo firewall-cmd --permanent --add-port=3000/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports

Browse to http://server-address:3000. The initial username and password are both admin; Grafana prompts you to change the password immediately. Use a long, unique password and avoid exposing port 3000 directly to the public internet.

A useful monitoring platform often combines metrics with centralised logs. For example, a CentOS host can forward system events using this rsyslog logging guide, while Grafana presents the resulting data through a compatible log data source.

Configure Grafana For Production

Edit the main configuration file:

sudo vi /etc/grafana/grafana.ini

Set a server name and URL under the [server] section when Grafana will sit behind DNS or Nginx:

[server]
protocol = http
http_addr = 127.0.0.1
http_port = 3000
domain = grafana.example.com
root_url = https://grafana.example.com/

With http_addr set to 127.0.0.1, remove the public firewall rule for port 3000 and allow Nginx to proxy requests locally. This is preferable for internet-facing systems because Nginx can provide TLS certificates, security headers, access logging, and rate controls.

Restart Grafana after editing:

sudo systemctl restart grafana-server
sudo journalctl -u grafana-server -f

If dashboards are intended for a local operations team, restrict access with firewalld zones or a VPN instead. This is particularly sensible for small businesses using an NBN connection, where exposing an administrative interface through a changing public IP can create unnecessary risk.

Add Data Sources And Dashboards

Sign in and open Connections or Data Sources, depending on the Grafana version. Select the required backend, enter its URL, and use Save & Test. For Prometheus, a common internal address is http://127.0.0.1:9090; for Loki, use the port configured by the Loki service.

Import a dashboard only after checking its queries and variables. Community dashboards can contain assumptions about metric names, recording rules, or exporter versions. Start with panels for CPU, memory, filesystem capacity, load, network traffic, and service health, then add alerts for conditions that require action.

Dashboard design should favour clear status panels and restrained colours. Even though Grafana is a web application rather than Android software, principles from this floating action button tutorial can help when considering concise controls and uncluttered operator workflows.

Australian organisations should also review whether dashboards display names, IP addresses, customer identifiers, or other personal information. The Privacy Act 1988 and Australian Privacy Principles may apply, particularly when monitoring user activity or storing logs in overseas regions.

Keep Grafana updated through the configured repository, review administrator accounts regularly, and back up /etc/grafana, provisioning files, and the Grafana database. A reliable setup is one where the service starts after reboot, access is encrypted or private, alerts have clear owners, and the monitoring data can be restored quickly.