Your own Prometheus and Grafana server, sized and kept private

What you are setting up

There are three pieces. A small program called an exporter runs on each server you care about and publishes its numbers on a web page: node_exporter, the usual one for Linux, does this on port 9100. Prometheus visits those pages on a schedule (the scrape interval), saves every reading with a timestamp, and answers queries on port 9090. Grafana asks Prometheus for those readings and draws the dashboards you look at, on port 3000.

This is different from a check that only asks whether a site answers. If that is all you need, Uptime Kuma is the lighter job. Prometheus is for questions like why the disk filled up last Tuesday, or how memory has crept over three months.

How much disk will your history take?

Enough for retention times ingest times sample size. The Prometheus storage docs give this rough formula, and say a sample averages 1-2 bytes:

needed_disk_space = retention_time_seconds * ingested_samples_per_second * bytes_per_sample

Here is a worked example of our own, so you can see the shape of it. Say you track 6,000 series and Prometheus reads each one every 30 seconds. That is 200 samples a second. Keep them for a year, 31,536,000 seconds, at 2 bytes each, and you need about 12.6 GB. The number that moves the answer most is how many series you collect, so count yours before you buy.

How long Prometheus keeps data is set in prometheus.yml, under storage, then tsdb, then retention. Older guides use command-line flags for this, which Prometheus now marks as deprecated. time is a period, and it is 15 days if you set neither value. size is a ceiling in bytes, counted in powers of two and off by default; the docs suggest no more than 80-85% of the space you give Prometheus, so compactions have room to work. Whichever limit is reached first applies.

Keep the data on a local disk. The Prometheus docs say NFS, AWS EFS included, is not supported, and that filesystems which are not POSIX-compliant can corrupt the database beyond repair.

And how much for Grafana?

Less than you might think. Grafana's requirements page puts the minimum at 1 core and 512 MB, and its sizing guide describes tiers by how busy the dashboards are:

• Small (under 25 people at once, alert rules below 100, data sources below 5, dashboards below 200): 2 cores, 2-4 GB of memory, 10-20 GB of SSD, one instance.
• Medium (25-200 people at once): 8-16 GB of memory over 4-8 cores, with 20-50 GB of SSD, two instances behind a load balancer, and a MySQL or PostgreSQL database instead of the built-in SQLite.
• These figures cover Grafana alone. Prometheus needs its own share of memory and the disk from the formula above; its docs give no memory figure, so leave headroom and watch it once real servers are reporting.

The server that fits

Give the monitoring its own machine. If it lives on one of the servers it watches, it goes down with that server, right when you need the graphs. A Primcast dedicated server is a whole physical computer with nobody else on it, so no other customer's load competes with your queries.

• Small and cheap: the cartridge servers are made for one job, and a metrics stack for a handful of servers is one job. The Xeon D-1587 option carries a 1.92 TB NVMe drive, roomy for a long history; more on NVMe servers.
• Everyday servers: one processor and headroom, a good home if Grafana gets its own PostgreSQL database alongside.
• Serious workloads: two processors, for many servers, long retention, or several Prometheus jobs on one box.

Every reading Prometheus collects is network traffic arriving at the box, all day, every day. The port is unmetered: there is no allowance to run over and no bandwidth line on the invoice. A ready server is handed over within 30 minutes of approval, and you pay month to month. On the rack servers and blades, a remote console gives you the screen and power button if a firewall change locks you out.

Up and running in an evening

1. Switch on the firewall before anything else, with only SSH allowed: sudo ufw allow OpenSSH first and sudo ufw enable second.
2. Install node_exporter on each server you want to watch, this one included, from the Prometheus downloads page (version 1.12.1 on 22 October 2026). Give it a dedicated system account and a systemd unit.
3. Install Prometheus from the same page and point it at your servers, as below. Check the file with promtool check config before you start it.
4. Install Grafana from its APT repository and start it.
5. Sign in, change the password, and connect Grafana to Prometheus.

Prometheus comes as a ready-built archive; the service file is ours, not the project's. The configuration keeps 30 days and caps the data at 200GB (Prometheus counts in powers of two, so that is 200 GiB, sized for a volume of about 240 GiB, roughly 260 GB as disks are sold), and the service makes Prometheus listen on 127.0.0.1 only, so only programs on the server itself can query it. Always compare the download's SHA256 with the one on the downloads page.

V=3.15.1   # current on 2026-10-22; use the latest from prometheus.io/download
cd /tmp && wget https://github.com/prometheus/prometheus/releases/download/v$V/prometheus-$V.linux-amd64.tar.gz
sha256sum prometheus-$V.linux-amd64.tar.gz
tar xvf prometheus-$V.linux-amd64.tar.gz
sudo cp prometheus-$V.linux-amd64/prometheus prometheus-$V.linux-amd64/promtool /usr/local/bin/
sudo useradd --system --no-create-home --shell /usr/sbin/nologin prometheus
sudo mkdir -p /etc/prometheus /var/lib/prometheus && sudo chown prometheus:prometheus /var/lib/prometheus

sudo tee /etc/prometheus/prometheus.yml >/dev/null <<'EOF'
global:
  scrape_interval: 30s
storage:
  tsdb:
    retention:
      time: 30d
      size: 200GB
scrape_configs:
  - job_name: node
    static_configs:
      - targets: ['localhost:9100', '198.51.100.31:9100', '198.51.100.32:9100']
EOF
promtool check config /etc/prometheus/prometheus.yml

sudo tee /etc/systemd/system/prometheus.service >/dev/null <<'EOF'
[Unit]
Description=Prometheus metrics store
Wants=network-online.target
After=network-online.target
[Service]
User=prometheus
ExecStart=/usr/local/bin/prometheus --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/var/lib/prometheus --web.listen-address=127.0.0.1:9090
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload && sudo systemctl enable --now prometheus

Grafana's own instructions for Debian and Ubuntu add its signed repository, so later versions arrive with your normal apt upgrades:

sudo apt-get install -y apt-transport-https wget gnupg
sudo mkdir -p /etc/apt/keyrings
sudo wget -O /etc/apt/keyrings/grafana.asc https://apt.grafana.com/gpg-full.key
sudo chmod 644 /etc/apt/keyrings/grafana.asc
echo "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" | sudo tee -a /etc/apt/sources.list.d/grafana.list
sudo apt-get update && sudo apt-get install grafana
sudo systemctl daemon-reload
sudo systemctl start grafana-server
sudo systemctl enable grafana-server.service

To sign in, open a tunnel from your own computer, signing in as yourself (ssh -L 3000:127.0.0.1:3000 you@198.51.100.10), and browse to http://localhost:3000. The username and password are both admin; Grafana asks you to change the password straight away, so do it then. In Connections, add a new connection, pick Prometheus, and use http://localhost:9090 as the server URL.

Keeping strangers out of your graphs

Prometheus's security page assumes that untrusted people can reach its web endpoint, and whoever does can read every series it holds. A password or TLS comes only from a web configuration file you pass with --web.config.file, a feature the docs still label experimental. Until you add one, Prometheus on 9090 and node_exporter on 9100 answer anybody.

• Prometheus listens on 127.0.0.1 in the service file above. Out of the box it would listen on 0.0.0.0:9090, every address.
• On each watched server, switch ufw on the same way (sudo ufw allow OpenSSH first, sudo ufw enable second), then open 9100 to the monitoring server's address and nothing else: sudo ufw allow proto tcp from 198.51.100.10 to any port 9100. Careful on a server that already does a job: if its firewall was off, allow each port it already serves before you enable ufw, or its visitors are cut off. Make sure /etc/default/ufw has IPV6=yes, so IPv6 is fenced too.
• Grafana listens on every address on port 3000 by default. When your team needs it, put it behind a reverse proxy with HTTPS and set http_addr = 127.0.0.1 under the [server] heading of /etc/grafana/grafana.ini, or allow 3000 only from your office.
• The admin API (--web.enable-admin-api) can delete data over HTTP. Turn it on only while Prometheus listens on 127.0.0.1.

Looking after it

• Backups: the Prometheus docs recommend snapshots, taken through the admin API. A plain copy without one can miss whatever arrived after the newest block was written, which usually covers the last three hours.
• Grafana's own data: dashboards and users live in Grafana's database. Back it up as well, and move to MySQL or PostgreSQL before you rely on it in production, as Grafana advises.
• One copy only: Prometheus's local storage is not clustered or replicated, so a failed drive takes its history with it. Keep the snapshots on another machine.
• Who watches the watcher: a monitoring server cannot tell you it is down. Run a simple outside check from somewhere else.

If something on the machine itself puzzles you, our chat answers first with an AI assistant that can check your account and your server, and a member of the team joins when you ask for a person. Running your software stays your job; keeping the hardware and network up is ours.

Questions people ask

Do I need a big server to run Prometheus and Grafana?

Usually not. Grafana itself starts at a single core and 512 MB, and for a small team it suggests 2 cores with 2-4 GB. The bigger question is disk for Prometheus, which grows with how many series you collect and how long you keep them. Work it out with the formula on this page before you choose.

How long does Prometheus keep my metrics?

Fifteen days, if you set neither retention value. In prometheus.yml, give retention a longer time under storage and tsdb, and a size as a safety ceiling below the disk's size. Expired data may linger for as long as two hours before it is cleaned up.

Can I open Grafana to my team over the internet?

Yes, once the admin password has changed and Grafana sits behind HTTPS. A reverse proxy in front, with Grafana itself listening on 127.0.0.1, is the usual way. Keep Prometheus and node_exporter closed either way; Grafana reaches Prometheus over the machine's own loopback.

Will collecting metrics from many servers cost me bandwidth?

Not on a Primcast server. The port is unmetered, so there is no transfer allowance to use up and no overage charge, however often Prometheus scrapes.

What if I lock myself out with the firewall?

On the rack servers and blades, the remote console gives you the server's screen and power button without SSH, so you can undo the rule yourself. That is a good reason to allow SSH before you ever run ufw enable.