Deploying Grafana Loki for

What we are setting up and why

In today's world, where applications and services generate huge volumes of data, centralized logging becomes not just a convenience, but a necessity. We will be deploying Grafana Loki — a horizontally scalable, highly available, multi-tenant log aggregation system developed by Grafana Labs. Loki differs from other logging systems in that it indexes only log metadata (labels), while storing the logs themselves in a compressed form. This makes it very efficient in terms of resource usage and storage cost.

As part of this tutorial, we will set up a complete stack for centralized collection, storage, and access to logs:

• Grafana Loki: The core of the system, which accepts logs, indexes them by labels, and stores them.
• Promtail: An agent installed on each server where logs are generated. It monitors specified log files, applies labels to them, and sends them to Loki.
• Nginx: Will act as a reverse proxy for Loki, providing secure access via HTTPS and the ability to host Loki on standard ports.
• Systemd: We will use Systemd to manage Loki and Promtail services, ensuring their automatic startup and monitoring.

Ultimately, the reader will get a fully functional centralized logging system. This will allow collecting logs from all your applications and services on a VPS (or multiple VPSs), viewing them in a convenient Grafana interface (which can be connected to Loki), quickly finding necessary events, debugging problems, and monitoring system status. This significantly simplifies infrastructure management, especially when you have multiple services or microservices deployed on one or different servers.

Alternatives: Cloud-managed vs. Self-hosted on VPS

There are several approaches to centralized logging:

• Cloud-managed services (SaaS): Platforms such as Datadog, Splunk Cloud, Logz.io, AWS CloudWatch, Google Cloud Logging, Azure Monitor. They offer ready-made solutions with minimal setup, high availability, scalability, and rich functionality. Pros: Ease of use, no need to manage infrastructure, powerful analytical tools. Cons: High cost, especially with large log volumes; potential data privacy concerns, as logs are stored with a third-party provider; less control over the infrastructure.
• Self-hosted solutions on a dedicated server/VPS: This is the approach we are implementing with Loki. You have complete control over the entire system, from infrastructure to configuration. Pros: Full control over data and security, potentially significantly lower cost for large log volumes (paying only for VPS/dedicated), flexibility in customization for specific needs. Cons: Requires technical knowledge for deployment and maintenance, responsibility for availability and scaling lies with you.

Choosing a self-hosted solution on a VPS with Loki is particularly relevant for VPS owners, developers, solo founders, and enthusiasts who want full control over their infrastructure, optimize costs, and not depend on third-party cloud providers. Loki, thanks to its design, is an excellent choice for this task, as it is less resource-intensive compared to other systems like the ELK stack (Elasticsearch, Logstash, Kibana), especially in terms of RAM and disk space consumption due to indexing only metadata.

What VPS configuration is needed for this task

Choosing the right VPS for Grafana Loki depends on the volume of logs you plan to collect and their retention period. Loki efficiently compresses logs, but still requires sufficient disk space and moderate CPU/RAM resources for indexing and queries.

Minimum requirements for Loki and Promtail (for small projects, up to 100 GB logs per month)

• CPU: 2 cores. Loki and Promtail do not heavily load the processor in idle mode, but peak loads during indexing or complex queries may require more.
• RAM: 4 GB. Loki can be quite memory-hungry with large query volumes or long-term index storage in memory. Promtail consumes little.
• Disk: NVMe SSD from 100 GB. Disk speed is critical for writing logs and executing queries. Volume depends on log volume and retention policy. For 100 GB of logs per month and 3 months of storage, about 300 GB will be needed.
• Network: 100 Mbps. For transferring logs from Promtail to Loki and accessing the UI.

Recommended VPS plan for medium projects (up to 500 GB logs per month, multiple sources)

For more serious tasks, where you collect logs from several applications or servers, and expect up to 500 GB of logs per month, you should consider a more powerful configuration:

• CPU: 4 cores.
• RAM: 8 GB.
• Disk: NVMe SSD from 500 GB to 1 TB.
• Network: 1 Gbps.

Such a plan will provide sufficient performance for processing queries and storing a larger volume of data. You can consider a VPS with the specified characteristics for deploying your centralized logging system.

When a dedicated server is needed, not a VPS

A dedicated server becomes preferable when:

• Very large log volumes: If you plan to collect terabytes of logs per month (e.g., from a large Kubernetes cluster or many microservices).
• High query performance: Instant access to logs and execution of complex analytical queries on huge data arrays are required.
• Guaranteed resources: You need 100% guaranteed CPU, RAM, and disk resources, without the "noisy neighbor" effect sometimes found on VPS.
• Strict storage requirements: Need for RAID arrays to increase disk subsystem reliability or specific disk type requirements (e.g., high-performance HDDs for archival log storage, together with SSDs for hot data).
• Physical isolation: To comply with strict security standards and compliance (e.g., PCI DSS, HIPAA), where complete physical isolation is required.

For most individual developers, solo founders, and small teams, a VPS will be more than sufficient and more cost-effective. However, if you see that your log volume exceeds 1-2 TB per month, or VPS performance begins to suffer, transitioning to a suitable dedicated server will be justified.

VPS Location: What it affects

The choice of VPS location affects several key aspects:

• Latency: The closer the VPS is to the log sources (your other servers, application clients), the lower the latency for log transmission. This is important for operational monitoring and reducing network load.
• Legal compliance: Some jurisdictions have strict data storage requirements, including logs. Ensure that the chosen location complies with applicable data privacy laws (e.g., GDPR in Europe).
• Cost: VPS prices can vary depending on the region.
• Availability: Choose regions with good network infrastructure and high data center availability.

Ideally, choose a location that is geographically close to your main log-generating servers to minimize network latency and ensure fast data transfer.

Server preparation

Server Preparation

Before proceeding with the installation of Loki and Promtail, you need to perform basic setup of your fresh VPS. This will enhance security and usability.

It is assumed that you are using Ubuntu Server 22.04 LTS or 24.04 LTS distribution, which is a popular choice for VPS.

1. SSH Connection and System Update

Connect to your server via SSH using the credentials provided by your provider. This is usually the root user and password.

ssh root@YOUR_IP_ADDRESS

After successful login, update the package list and installed packages to their latest versions:

sudo apt update && sudo apt upgrade -y

2. Creating a New User with Sudo Privileges

Working as the root user is insecure. Let's create a new user and grant them sudo privileges.

adduser lokiadmin
usermod -aG sudo lokiadmin

Now, exit the root session and log in as the new user:

exit
ssh lokiadmin@YOUR_IP_ADDRESS

3. Configuring SSH Key Authentication

To enhance security, it is recommended to use SSH keys instead of passwords. If you don't have keys yet, generate them on your local machine:

ssh-keygen -t rsa -b 4096

Copy the public key to the server (replace lokiadmin and YOUR_IP_ADDRESS):

ssh-copy-id lokiadmin@YOUR_IP_ADDRESS

Now you can disable password authentication for SSH. Edit the file /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Find and change the following lines:

#PasswordAuthentication yes
PasswordAuthentication no
#PermitRootLogin yes
PermitRootLogin no

Save changes (Ctrl+O, Enter) and exit (Ctrl+X). Restart the SSH service:

sudo systemctl restart sshd

After this, ensure that you can log in with your SSH key before closing the current session.

4. Firewall Configuration (UFW)

UFW (Uncomplicated Firewall) is a convenient wrapper for iptables. Install and configure it:

sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow http
sudo ufw allow https
sudo ufw enable
sudo ufw status

Check the status. Ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) should be allowed. We will add a port for Loki later.

5. Installing Fail2Ban

Fail2Ban helps protect against brute-force attacks by blocking IP addresses that make too many failed login attempts.

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Fail2Ban protects SSH by default. You can configure it by editing the file /etc/fail2ban/jail.local (create it if it doesn't exist) and adding your rules.

6. Installing Basic Utilities

Install several useful utilities that will come in handy during setup and debugging:

sudo apt install curl wget git nano htop unzip -y

Your server is now ready for deploying Grafana Loki and Promtail.

Software Installation — Step-by-step

We will install Loki and Promtail by downloading binary files from official GitHub repositories and configuring them as Systemd services. Nginx will be installed from the APT repository.

The actual software versions for 2026 will be conditional, but we will use the latest stable releases available at the time of generation.

Installing Grafana Loki

Let's create directories for Loki and download the current binary file.

# 1. Create directories for Loki
sudo mkdir -p /etc/loki
sudo mkdir -p /var/lib/loki
sudo chown -R lokiadmin:lokiadmin /var/lib/loki # Grant write permissions to the current user

# 2. Change to a temporary directory
cd /tmp

# 3. Download the latest stable version of Loki (e.g., v3.1.0 for 2026)
# Always check the latest version on GitHub: https://github.com/grafana/loki/releases
LOKI_VERSION="3.1.0" # Specify the current version
wget "https://github.com/grafana/loki/releases/download/v${LOKI_VERSION}/loki-linux-amd64.zip"

# 4. Unzip the archive
unzip "loki-linux-amd64.zip"

# 5. Move the binary file to /usr/local/bin
sudo mv loki-linux-amd64 /usr/local/bin/loki

# 6. Ensure the file is executable
sudo chmod a+x /usr/local/bin/loki

# 7. Check the version
loki --version

Now, let's create a loki user, under whom the service will run, to ensure the principle of least privilege.

# 1. Create a system user loki without a home directory and shell
sudo useradd --system --no-create-home --shell /bin/false loki

# 2. Transfer ownership of the Loki data directory to the loki user
sudo chown -R loki:loki /var/lib/loki

Installing Promtail

Similar to Loki, let's download and install Promtail.

# 1. Create a directory for Promtail
sudo mkdir -p /etc/promtail

# 2. Change to a temporary directory
cd /tmp

# 3. Download the latest stable version of Promtail (e.g., v3.1.0 for 2026)
# Always check the latest version on GitHub: https://github.com/grafana/loki/releases
PROMTAIL_VERSION="3.1.0" # Specify the current version
wget "https://github.com/grafana/loki/releases/download/v${PROMTAIL_VERSION}/promtail-linux-amd64.zip"

# 4. Unzip the archive
unzip "promtail-linux-amd64.zip"

# 5. Move the binary file to /usr/local/bin
sudo mv promtail-linux-amd64 /usr/local/bin/promtail

# 6. Ensure the file is executable
sudo chmod a+x /usr/local/bin/promtail

# 7. Check the version
promtail --version

Let's create a promtail user to run the service.

# 1. Create a system user promtail without a home directory and shell
sudo useradd --system --no-create-home --shell /bin/false promtail

Installing Nginx and Certbot

Nginx will act as a reverse proxy and provide HTTPS access to Loki. Certbot will help automate the issuance and renewal of TLS certificates from Let's Encrypt.

# 1. Install Nginx from Ubuntu repositories
sudo apt install nginx -y

# 2. Start Nginx and enable it to start on boot
sudo systemctl start nginx
sudo systemctl enable nginx

# 3. Install Certbot and the Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

At this stage, the main components are installed. Now let's proceed to their configuration.