Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
Skip to content
World desk12 min

How to Install Grafana Loki on a Linux VPS

A practical guide to installing Grafana Loki on a Linux VPS, choosing between a binary, Docker Compose, and Helm, securing port 3100, planning storage, and connecting Alloy and Grafana.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a small Linux VPS, install Grafana Loki in its single-binary (monolithic) mode. Download a Loki release and the configuration file for that same version, run Loki as a dedicated service account, keep port 3100 private, and put an authenticating TLS reverse proxy in front of it if Grafana or other clients connect over the network.

Docker Compose is convenient for evaluation and development. Use Helm when the VPS is actually a Kubernetes node or when you need Kubernetes-based scaling and high availability. Grafana’s installation documentation covers the local binary, Docker, and Helm paths in detail: local installation, Docker installation, and Helm installation.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose the installation method before you begin

The right method depends more on the operating environment than on the VPS provider.

Method Best fit Operational complexity Persistence and backup Scaling and upgrades Security surface
Linux package or release binary A small, dedicated Linux VPS running one Loki instance Lowest; you manage the service, configuration, disk, and updates Local filesystem by default; you must plan retention, backups, and disk monitoring Single-node operation; upgrades are manual or managed with your package process Smallest exposed surface when Loki listens only on localhost and a proxy handles access
Docker or Docker Compose Evaluation, testing, development, or a host already managed with Compose Moderate; container lifecycle and mounted configuration must be maintained Persistent host volume or filesystem mount is required; container recreation alone is not a backup Easy image replacement, but still fundamentally a single node unless you build a larger platform Published ports can accidentally expose Loki directly; bind to localhost unless a protected network requires otherwise
Helm on Kubernetes A VPS that is a Kubernetes node, or a managed Kubernetes cluster Highest; Kubernetes, chart values, storage classes, and upgrades are additional responsibilities Configured through Kubernetes storage and Loki’s backend settings Monolithic mode suits a small stack; microservices mode is intended for high availability and scalability Ingress, service exposure, tenant controls, secrets, and cluster policy must all be secured

Grafana documents monolithic, microservices, and scalable Helm modes. Its guide recommends monolithic mode for a small monitoring stack and microservices mode for high availability and scalability; it also notes that Simple Scalable Deployment is being deprecated. A plain Linux VPS that is not running Kubernetes should use the local binary or package path instead.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Plan the VPS and Loki configuration

Use a supported Linux installation

Apply security updates first and confirm that you can administer the machine with a non-root account using sudo. Reserve a dedicated directory for configuration and data. A service account with no interactive shell limits the damage if the Loki process is compromised.

  1. Create a system user such as loki with no login shell.
  2. Create configuration and data directories, for example /etc/loki and /var/lib/loki.
  3. Give the service account ownership only of the directories Loki must read or write.
  4. Decide whether Loki will listen on localhost (recommended when a reverse proxy is on the same VPS) or on a private interface.

There is no authoritative CPU, memory, ingestion-rate, or retention number in the installation documentation. Size the VPS from your expected log volume, retention period, query concurrency, compression and index overhead, and the chosen storage backend. Start with conservative retention and watch resource use rather than relying on a generic VPS size.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep the configuration and binary versions aligned

Download loki-local-config.yaml that matches the Loki release you install. Review its schema, storage paths, retention settings, and listen address before starting Loki. Configuration fields can change between releases, so do not copy an older file into a newer installation without checking it against that version’s documentation.

The quick-start configuration uses a filesystem object store and runs Loki as a single binary. That is useful for learning and small experiments, but it is not a substitute for a deliberate production storage and backup design.

Install Loki as a Linux package or release binary

The local-install procedure supports Linux package installation with apt-get or dnf, as well as downloading a release binary. Use the current package-repository instructions or release artifact linked from Grafana’s local installation guide; do not mix a binary from one release with a configuration file from another.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

1. Install the package or place the binary

With a package installation, use the package manager instructions for your distribution and let the package’s service definition handle the executable path when one is supplied. With a release download, place the executable at a controlled path such as /usr/local/bin/loki, make it executable, and confirm that the installed version prints successfully before configuring the service.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

2. Install and review the configuration

Place the matching file at /etc/loki/loki-local-config.yaml (or another root-owned location) and inspect:

  • HTTP listen address and port: Loki’s HTTP service and metrics endpoint use port 3100 in the documented examples. Bind to localhost when only local clients or a reverse proxy need access.
  • Storage paths: Every directory referenced by the configuration must exist and be writable by the Loki service account.
  • Schema: Keep the schema configuration valid for the installed release. A schema mismatch can prevent startup or make data inaccessible.
  • Object store: Filesystem storage is appropriate for a quick start. For a larger or multi-node deployment, configure durable S3-compatible object storage through Loki’s storage settings.
  • Retention: Set a period that fits available storage and your compliance needs. Retention is a storage policy, not a replacement for backups.
  • Authentication: Treat auth_enabled: false as a lab setting unless an equivalent trust boundary and authenticating proxy protect the service.

3. Start Loki manually for the first test

From the directory containing the binary and configuration, the documented form is:

./loki-linux-amd64 -config.file=loki-local-config.yaml

If you installed a package, use its system service or the executable path supplied by the package. Keep the first process in the foreground and read its logs. Configuration parsing errors, missing directories, and permission failures are much easier to correct before creating a background service.

4. Verify the HTTP service and metrics

On the VPS, query the metrics endpoint:

curl http://localhost:3100/metrics

A successful response confirms that the HTTP listener is reachable and that Loki is exposing Prometheus-format metrics. Also inspect the process log for storage, schema, or authentication warnings. If the command cannot connect, check that Loki is running, that it is listening on the address you configured, and that another process is not already using port 3100.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

5. Create a systemd service for unattended operation

After the foreground test works, create a unit such as the following and adjust the executable and configuration paths to your installation:

[Unit]
Description=Grafana Loki
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=loki
Group=loki
ExecStart=/usr/local/bin/loki -config.file=/etc/loki/loki-local-config.yaml
Restart=on-failure
RestartSec=5
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

Save it as /etc/systemd/system/loki.service, then load and enable it:

sudo systemctl daemon-reload
sudo systemctl enable --now loki
sudo systemctl status loki
sudo journalctl -u loki -e

If Loki needs to create files under a data directory, ensure that directory is owned by loki. Do not solve permission errors by running the service as root; correct ownership and the configured paths instead.

Run Loki with Docker or Docker Compose

Grafana’s Docker documentation lists Docker and optional Docker Compose as prerequisites. Its Linux example uses the grafana/loki:3.7.0 image, mounts a configuration directory, and publishes port 3100. The same documentation positions Docker and Compose for evaluating, testing, or developing Loki and recommends Helm or Tanka for production.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Prepare a persistent configuration directory

Create a host directory for the configuration and data that must survive container replacement. Put a configuration file matching the image version in that directory. In the quick-start tutorial, Loki runs in single-binary mode and uses object_store: filesystem; the tutorial also deploys Grafana and Grafana Alloy so container logs can be collected and forwarded to Loki.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Use a Compose service with a protected port binding

A minimal Compose shape is:

services:
  loki:
    image: grafana/loki:3.7.0
    command: -config.file=/etc/loki/loki-config.yaml
    volumes:
      - ./loki-config:/etc/loki:ro
      - ./loki-data:/loki
    ports:
      - "127.0.0.1:3100:3100"
    restart: unless-stopped

Use the configuration’s actual storage path for the data mount. Binding the host port to 127.0.0.1 prevents direct Internet access; a reverse proxy can still reach Loki locally. If another container on the same Compose network is the only client, you can omit the host-port publication and use the Loki service name internally.

Start and inspect the container

docker compose up -d
docker compose ps
docker compose logs --tail=100 loki
curl http://localhost:3100/metrics

Pin an image version rather than silently tracking a moving tag. When upgrading, read the release notes, obtain the matching configuration, stop or roll the service in a controlled way, and verify the metrics endpoint and stored data afterward. A container volume is not a backup: copy important data to a separate protected destination and test restoration.

Use Helm only when Kubernetes is part of the design

Helm is appropriate when the VPS is itself a Kubernetes node or when you are deploying to a managed Kubernetes service. Grafana’s Helm documentation includes deployment guidance for Amazon EKS, Azure AKS, and Google GKE, as well as the available Loki modes: monolithic, microservices, and scalable configurations.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose the mode deliberately

  • Monolithic: the practical starting point for a small monitoring stack. It keeps the deployment simpler and maps closely to the single-binary VPS installation.
  • Microservices: appropriate when independent components, high availability, and horizontal scaling justify the operational overhead.
  • Simple Scalable Deployment: do not choose it for a new long-lived design without checking the current chart guidance, because Grafana says this mode is being deprecated.

Typical Helm workflow

  1. Install or update Helm and verify that the cluster context points to the intended Kubernetes service.
  2. Read the current chart’s values and select the Loki mode, replica counts, resource requests, storage classes, and exposure method.
  3. Configure persistent volumes or a durable object store rather than relying on ephemeral pod filesystems.
  4. Keep Loki behind an authenticated ingress or internal service; do not publish an unauthenticated gateway to the Internet.
  5. Apply the chart, inspect pod and StatefulSet events, and query Loki from a client inside the allowed network.
  6. Record the values file and chart version so upgrades are repeatable.

A Kubernetes deployment changes the failure and backup model. Persistent-volume recovery, object-store credentials, ingress TLS, tenant isolation, and chart upgrades become cluster operations rather than single-server tasks.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Secure a Loki VPS before sending real logs

Grafana states plainly: “Grafana Loki does not come with any included authentication layer.” A public port 3100 therefore gives an unauthenticated caller access unless you add controls outside Loki.

Put an authenticating TLS proxy in front

  1. Keep Loki bound to localhost or a private interface.
  2. Run an authenticating reverse proxy such as NGINX on the VPS or at the trusted network edge.
  3. Terminate TLS at the proxy with a certificate for the hostname clients use.
  4. Forward only the required Loki HTTP paths to the local listener.
  5. Require authentication at the proxy and log rejected requests.

Point Grafana, Alloy, and other clients at the proxy’s HTTPS URL, not at a publicly reachable Loki socket. If you use a proxy on another host, permit only that host’s private address to reach port 3100.

Apply firewall and filesystem controls

  • Deny inbound TCP 3100 at the VPS firewall and provider firewall unless a tightly restricted private network requires it.
  • Allow only the proxy, administration network, and required monitoring paths.
  • Use least-privilege ownership for /etc/loki, data directories, and any object-store credential files.
  • Keep the operating system, proxy, container runtime, and Loki release patched.
  • Monitor authentication failures, disk growth, process restarts, and unusual query volume.

Understand tenant headers

In a multi-tenant or non-monolithic deployment, clients must send the tenant header required by your Loki configuration. Do not expose an unauthenticated gateway and assume that a tenant identifier alone provides security; enforce identity and authorization at the proxy or platform boundary.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose storage, retention, and backups

The filesystem object store shown in the quick-start tutorial is suitable for learning and small experiments. On a production VPS, local disk is a deliberate trade-off: it is simple and fast, but the node, disk, and all locally stored data share one failure domain.

Local filesystem storage

  • Reserve a dedicated filesystem or directory so log growth cannot consume the operating system’s free space.
  • Set retention intentionally and monitor actual directory growth.
  • Back up the data and configuration to storage outside the VPS.
  • Test restoring a backup before you depend on it for incident investigation.

S3-compatible object storage

When retention or availability needs exceed one small node, configure Loki’s storage settings for durable S3-compatible object storage. Keep credentials outside world-readable configuration files, restrict the bucket policy, and account for object-store request and egress costs. The Helm documentation is the appropriate entry point for storage settings in a Kubernetes deployment: https://grafana.com/docs/loki/latest/setup/install/helm/.

Capacity planning without a false number

No single RAM, CPU, ingestion-rate, or retention limit applies to every VPS. Measure your incoming log volume, label cardinality, query patterns, compression, index growth, and retention period. Increase capacity when ingestion backlogs, query latency, memory pressure, or disk utilization trend upward; reducing noisy logs and shortening retention can be as effective as moving to a larger machine.

Send logs to Loki and connect Grafana

Use Grafana Alloy as the collector

Grafana’s local-install guidance recommends Grafana Alloy for sending logs to Loki. The quick-start tutorial demonstrates Alloy tailing Docker container logs and forwarding them to a Loki container. Run Alloy on the VPS or on the hosts whose logs you need, grant it read access only to the required log sources, and configure its Loki destination as the protected proxy URL or private service address.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Add Loki as a Grafana data source

  1. In Grafana, open Connections and choose Data sources.
  2. Select Loki and enter the URL that Grafana can actually reach: the local service name for Compose, the cluster service or ingress for Kubernetes, or the HTTPS reverse-proxy hostname for a secured VPS.
  3. Save and test the data source.
  4. Run a simple LogQL query after Alloy has forwarded at least one stream, then broaden the query only after labels and timestamps look correct.

The quick-start tutorial combines Loki, Grafana, and Alloy for a complete container-log example: https://grafana.com/docs/loki/latest/get-started/quick-start/tutorial/.

Troubleshoot the failures you are most likely to see

Symptom Likely cause What to check
Loki exits immediately Invalid or version-mismatched YAML Run the exact binary with the configuration in the foreground and read the first parsing error; obtain a configuration file matching the installed release.
curl http://localhost:3100/metrics cannot connect Service stopped, wrong listen address, or port conflict Inspect systemctl status loki or container logs, confirm the configured address and port, and check which process owns 3100.
Permission denied while starting The service account cannot read configuration or write storage Check ownership and mode bits on configuration, index, cache, and chunk directories; do not run Loki as root to bypass the error.
Grafana cannot reach Loki Incorrect URL or a firewall/proxy rule blocking the path Test the URL from the Grafana host, verify TLS and proxy authentication, and use the Compose service name or Kubernetes service address where appropriate.
Logs arrive but queries return nothing Collector destination, labels, timestamps, or tenant context is wrong Inspect Alloy logs, confirm the stream is sent to the intended Loki URL, check the selected time range, and supply the required tenant header in multi-tenant deployments.
Disk usage keeps rising Retention is too long for local storage, ingestion is higher than expected, or compaction is not keeping up Measure ingestion and directory growth, reduce unnecessary logs or retention, expand storage, and move to durable object storage when a single disk is no longer appropriate.
Direct Internet scans appear in Loki logs Port 3100 or an unauthenticated gateway is publicly exposed Close the port at both provider and host firewalls, bind Loki privately, and require authenticated TLS access through the reverse proxy.

Final deployment checklist

  • Loki runs in single-binary mode on a small non-Kubernetes VPS, or the chosen Helm mode matches the cluster’s availability needs.
  • The binary, container image, and configuration file are version-aligned.
  • The service runs as a dedicated unprivileged account and restarts automatically after failure.
  • Port 3100 is private; public clients use an authenticated TLS reverse proxy.
  • Filesystem paths, retention, schema, and object-store settings have been reviewed.
  • Backups exist outside the VPS and a restoration test has succeeded.
  • The metrics endpoint is monitored, and disk, restart, ingestion, and query behavior have alerts.
  • Grafana Alloy forwards logs to the protected Loki URL, and Grafana’s Loki data source test succeeds.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.