Install Grafana on Ubuntu and keep it updated

All steps run on graf01 as student. You install Grafana 13.2.x first, look around, back it up, then upgrade to 13.3.x. If 13.2.5 is no longer listed when you do this, pick any older line from apt-cache policy instead.

1Add the Grafana APT repository

Paste this whole block on graf01:

sudo apt-get update
sudo apt-get install -y apt-transport-https wget gnupg
sudo mkdir -p /etc/apt/keyrings
sudo wget -q -O /etc/apt/keyrings/grafana.asc https://apt.grafana.com/gpg-full.key
sudo chmod 644 /etc/apt/keyrings/grafana.asc
echo "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
sudo apt-get update

The tee command echoes the repository line back:

deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main

After it, the second apt-get update lists the Ubuntu mirrors as usual and adds lines for https://apt.grafana.com stable InRelease and stable/main amd64 Packages, then ends with “Reading package lists… Done”. Use tee without -a so running the block twice doesn’t add a duplicate line.

On 24.04 you’ll see “noble” instead of “resolute” in the Ubuntu lines, and the Grafana lines are the same for both.

✅ Checkpoint: apt-get update fetches apt.grafana.com stable InRelease with no GPG or NO_PUBKEY error.

2See which versions are available

Run this:

apt-cache policy grafana | head -8

You should see:

grafana:
  Installed: (none)
  Candidate: 13.3.0
  Version table:
     13.3.0 500
        500 https://apt.grafana.com stable/main amd64 Packages
     13.2.5 500
        500 https://apt.grafana.com stable/main amd64 Packages

Candidate is what a plain apt install grafana would give you. The version table lists every release the repository still carries, and the exact strings in this list are what you use with grafana=<version>. Newer releases may sit above 13.3.0 by the time you read this.

Make sure you see grafana and not only grafana-enterprise.

✅ Checkpoint: apt-cache policy grafana shows a Candidate from apt.grafana.com and at least two versions.

3Install an older release on purpose

Run this:

sudo apt-get install -y grafana=13.2.5

Near the end of the output you should see:

Setting up grafana (13.2.5) ...
### NOT starting on installation, please execute the following statements to configure grafana to start automatically using systemd
 sudo /bin/systemctl daemon-reload
 sudo /bin/systemctl enable grafana-server
### You can start grafana-server by executing
 sudo /bin/systemctl start grafana-server

On Ubuntu 24.04 a few info: lines about adding the system user grafana appear between those two, while 26.04 creates the user quietly. The package tells you plainly that it hasn’t started anything. That’s normal for Grafana and catches people who expect a web page straight after apt install.

✅ Checkpoint: dpkg shows grafana 13.2.5 installed and the “NOT starting on installation” message appeared.

4Enable and start the service

Run this:

sudo systemctl daemon-reload
sudo systemctl enable --now grafana-server
systemctl status grafana-server --no-pager | head -6
sudo ss -ltnp | grep ':3000'

You should see (your times, IDs and PIDs will differ):

Created symlink '/etc/systemd/system/multi-user.target.wants/grafana-server.service' → '/usr/lib/systemd/system/grafana-server.service'.
● grafana-server.service - Grafana instance
     Loaded: loaded (/usr/lib/systemd/system/grafana-server.service; enabled; preset: enabled)
     Active: active (running) since Sun 2026-11-08 06:41:12 UTC; 4s ago
 Invocation: 3b1f0c7e9a2d4c58b6e1f0a9d2c7b483
       Docs: http://docs.grafana.org
   Main PID: 2731 (grafana)
LISTEN 0      4096               *:3000            *:*    users:(("grafana",pid=2731,fd=11))

That’s the Ubuntu 26.04 output. On 24.04 the symlink paths have no quotes and there’s no Invocation line, so the Main PID line moves up one. enable --now does two things in one go: start at every boot, and start right now. Port 3000 on * means all addresses, so your laptop can reach it for the moment; Lesson 3 moves it to 127.0.0.1 behind Nginx.

✅ Checkpoint: grafana-server is active (running), enabled, and listening on port 3000.

5First login and the forced password change

Browse to http://192.168.56.70:3000 from your laptop and log in as admin / admin. This time don’t skip the next screen: set a real password and keep it in your password manager. Then open Administration > General > Default preferences if you want to change the theme, and look at the help menu (the ? icon) to confirm the version reads 13.2.5.

Then check from graf01:

curl -s localhost:3000/api/health; echo
sudo stat -c '%U:%G %a %n' /var/lib/grafana /var/lib/grafana/grafana.db /etc/grafana/grafana.ini /etc/grafana/provisioning

You should see:

{
  "database": "ok",
  "version": "13.2.5",
  "commit": "..."
}
grafana:grafana 755 /var/lib/grafana
grafana:grafana 640 /var/lib/grafana/grafana.db
root:grafana 640 /etc/grafana/grafana.ini
root:grafana 755 /etc/grafana/provisioning

Your “commit” line shows the real Git hash of the build. Each stat line is owner:group, the mode in numbers, then the path. Notice that grafana.ini belongs to root and only the grafana group can read it.

Grafana can read its settings but can’t change them, which is what you want from a service that faces a network.

✅ Checkpoint: You logged in with a new admin password and /api/health shows version 13.2.5.

6Make your first grafana.ini changes

Give the instance a name in the browser tab and switch off the call-home features you don’t need in a lab. Open the file with sudo nano /etc/grafana/grafana.ini, find each section and uncomment or change these lines:

[server]
domain = graf01.lab

[analytics]
reporting_enabled = false
check_for_updates = false

[users]
default_theme = light

[log]
mode = console file
level = info

Then run this:

sudo grep -E '^(domain|reporting_enabled|check_for_updates|default_theme|level) ' /etc/grafana/grafana.ini
sudo systemctl restart grafana-server
sudo grep 'HTTP Server Listen' /var/log/grafana/grafana.log | tail -n 1

You should see (your time will differ):

domain = graf01.lab
reporting_enabled = false
check_for_updates = false
default_theme = light
level = info
logger=http.server t=2026-11-08T06:48:20.114208341Z level=info msg="HTTP Server Listen" address=[::]:3000 protocol=http subUrl= socket=

The grep proves your lines are active, because commented lines start with ; and don’t match. Each key must sit under the right section header; a domain line placed under [users] is silently ignored.

✅ Checkpoint: grep shows your five uncommented settings, Grafana restarted cleanly and the login page is light.

7Reset a forgotten admin password

Pretend you lost the admin password. On graf01, the grafana cli command can set a new one straight in the database. The grafana command the package puts on your PATH is a small wrapper script that passes the package’s home path, config file and data path, so you don’t type them yourself.

Run this:

sudo grafana cli admin reset-admin-password 'Lab@Grafana2026'

The last line of the output should read:

Admin password changed successfully ✔

Log in with the new password to prove it. The older spelling grafana-cli admin reset-admin-password still works but prints a deprecation warning, so get used to the new form. If you renamed the admin user, the command says “Admin user cannot be found” and lists admin users with their IDs; add --user-id <id> and run it again.

Keep the password out of your shell history in real life by using --password-from-stdin.

✅ Checkpoint: You can log in as admin with the password you set.

8Back up before upgrading

The SQLite file must be copied while Grafana is stopped, otherwise you can copy it half-written. Back up the config and plugins too.

Paste this whole block:

sudo systemctl stop grafana-server
B=/var/backups/grafana-$(dpkg-query -W -f='${Version}' grafana)-$(date +%F)
sudo mkdir -p $B
sudo cp -a /var/lib/grafana $B/data
sudo cp -a /etc/grafana $B/etc
sudo systemctl start grafana-server
sudo ls $B

You should see:

data  etc

The data folder is a copy of /var/lib/grafana with grafana.db and any plugins you install later, and etc is a copy of /etc/grafana. cp -a keeps the owner and mode, so a restore puts files back as they were. The folder name carries the installed version, for example /var/backups/grafana-13.2.5-2026-11-08, so you always know which release a backup belongs to.

✅ Checkpoint: The backup folder holds data (with grafana.db inside) and etc, and Grafana is running again.

9Upgrade to the current release

Run this:

sudo apt-get update
sudo apt-get install -y --only-upgrade grafana
dpkg-query -W grafana
curl -s localhost:3000/api/health | grep version

Among the apt lines, and from the last two commands, you should see:

Unpacking grafana (13.3.0) over (13.2.5) ...
Setting up grafana (13.3.0) ...
Restarting grafana-server service... OK
grafana	13.3.0
  "version": "13.3.0",

Because RESTART_ON_UPGRADE=true, the package restarted the service for you. A plain sudo apt-get upgrade would also do this along with every other package, which is fine on a lab VM but at work you usually upgrade Grafana on its own so you know what changed. Your dashboards, users and the light theme are still there, because only program files were replaced.

✅ Checkpoint: dpkg-query and /api/health both show 13.3.x and you can still log in.

10Hold the version and take a snapshot

Stop routine apt upgrade runs from moving Grafana without you deciding, then save the VM state.

Run this:

sudo apt-mark hold grafana
apt-mark showhold

You should see:

grafana set on hold.
grafana

When you’re ready for the next release, sudo apt-mark unhold grafana, back up as in step 8 and upgrade. Shut graf01 down and take a VirtualBox snapshot called grafana-installed; Lesson 3 starts from it.

✅ Checkpoint: apt-mark showhold lists grafana and graf01 has a snapshot called grafana-installed.