VPS Monitoring with Prometheus and Grafana: Installation, Node Exporter and Alertmanager

Running a VPS without monitoring is operating blind. Prometheus collects system and application metrics as time-series data. Grafana renders them as dashboards. Alertmanager routes notifications—to email, Slack, PagerDuty, or a webhook—when a metric crosses a threshold. Together, they give you a production observability stack that costs nothing in licences and runs on the same VPS it monitors or on a dedicated monitoring instance.

Architecture Overview

• node_exporter: Runs on every VPS you want to monitor. Exposes system metrics (CPU, RAM, disk, network) on port 9100 in Prometheus exposition format.
• Prometheus server: Scrapes node_exporter endpoints on a configured interval (default 15 seconds). Stores data in a local TSDB. Evaluates alerting rules.
• Grafana: Queries Prometheus via its HTTP API and renders dashboards. Runs on port 3000.
• Alertmanager: Receives firing alerts from Prometheus and routes them to configured receivers (email, Slack webhook, etc.).

Install node_exporter on the Monitored VPS

# Download and install (replace VERSION with latest from github.com/prometheus/node_exporter/releases)
wget https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-amd64.tar.gz
tar xvf node_exporter-1.8.2.linux-amd64.tar.gz
cp node_exporter-1.8.2.linux-amd64/node_exporter /usr/local/bin/

# Create systemd service
cat > /etc/systemd/system/node_exporter.service << 'EOF'
[Unit]
Description=Prometheus Node Exporter
After=network.target

[Service]
User=node_exporter
ExecStart=/usr/local/bin/node_exporter
Restart=always

[Install]
WantedBy=multi-user.target
EOF

useradd --no-create-home --shell /bin/false node_exporter
systemctl daemon-reload
systemctl enable --now node_exporter
# Verify metrics endpoint
curl localhost:9100/metrics | head -30

Secure port 9100: it should be reachable only from the Prometheus server's IP. Add a UFW rule: ufw allow from <prometheus-server-ip> to any port 9100.

Install Prometheus

wget https://github.com/prometheus/prometheus/releases/download/v2.54.0/prometheus-2.54.0.linux-amd64.tar.gz
tar xvf prometheus-2.54.0.linux-amd64.tar.gz
cp prometheus-2.54.0.linux-amd64/prometheus /usr/local/bin/
cp prometheus-2.54.0.linux-amd64/promtool /usr/local/bin/
mkdir -p /etc/prometheus /var/lib/prometheus

# /etc/prometheus/prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

alerting:
  alertmanagers:
    - static_configs:
        - targets: ['localhost:9093']

rule_files:
  - "/etc/prometheus/alerts.yml"

scrape_configs:
  - job_name: 'node'
    static_configs:
      - targets:
          - 'localhost:9100'        # the Prometheus server itself
          - '10.0.0.2:9100'        # additional VPS targets
          - '10.0.0.3:9100'

Key Alerting Rules

# /etc/prometheus/alerts.yml
groups:
  - name: vps_alerts
    rules:
      - alert: HighCPUUsage
        expr: 100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[2m])) * 100) > 90
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "CPU usage above 90% for 5 minutes on {{ $labels.instance }}"

      - alert: LowDiskSpace
        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 15
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Disk space below 15% on {{ $labels.instance }}"

      - alert: HighMemoryUsage
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 90
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "RAM usage above 90% on {{ $labels.instance }}"

      - alert: HighNetworkIn
        expr: rate(node_network_receive_bytes_total{device!="lo"}[5m]) > 100000000
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Inbound network traffic above 100 MB/s on {{ $labels.instance }}"

The HighNetworkIn alert is particularly useful on VPS instances: sustained inbound traffic above your expected baseline often indicates a DDoS event or a misconfigured service accepting unexpected connections.

Install Grafana

apt install -y apt-transport-https software-properties-common
wget -q -O - https://packages.grafana.com/gpg.key | apt-key add -
add-apt-repository "deb https://packages.grafana.com/oss/deb stable main"
apt update && apt install -y grafana
systemctl enable --now grafana-server

Access Grafana at http://<your-vps-ip>:3000. Default credentials: admin / admin (change immediately). Add Prometheus as a data source: Configuration → Data Sources → Add data source → Prometheus → URL: http://localhost:9090.

Import Dashboard ID 1860 (Node Exporter Full) from Grafana's dashboard library for a ready-made system overview covering CPU, memory, disk, and network with no manual panel configuration.

Alertmanager: Route to Email or Slack

# /etc/alertmanager/alertmanager.yml
global:
  resolve_timeout: 5m

route:
  group_by: ['alertname', 'instance']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h
  receiver: 'slack-webhook'

receivers:
  - name: 'slack-webhook'
    slack_configs:
      - api_url: 'https://hooks.slack.com/services/YOUR/WEBHOOK/URL'
        channel: '#vps-alerts'
        title: '{{ .CommonLabels.alertname }}'
        text: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'

VPSWala Plan Sizing for the Monitoring Stack

A Prometheus + Grafana stack monitoring 3–10 servers with 15-second scrape intervals uses approximately 1–2 GB RAM and 10–30 GB of TSDB storage per month (at default 15-day retention). A 2 vCPU / 4 GB RAM VPSWala plan covers this comfortably. For longer retention or higher cardinality metrics (many unique label combinations), scale up RAM and storage accordingly.

Scaling the Monitoring Stack

The setup above runs comfortably on a 2 vCPU / 4 GB RAM VPS monitoring 3–10 servers with 15-second scrape intervals. As your infrastructure grows, consider:

• Remote Write to Thanos or Cortex: For long-term metric retention beyond Prometheus's default 15 days, configure remote_write to a Thanos or Cortex object-storage backend. This decouples retention from the Prometheus server's local disk.
• Federation: For large fleets, run a hierarchical Prometheus setup: per-cluster Prometheus instances that federate aggregated metrics to a central global Prometheus server. This reduces cardinality at the global level while retaining per-cluster detail locally.
• Service discovery: Instead of hardcoding target IPs in static_configs, use Prometheus's file_sd or consul_sd discovery mechanisms so new VPS instances auto-appear in the monitoring stack when provisioned.

Grafana Dashboard Tips

Beyond the Node Exporter Full dashboard (ID 1860), useful community dashboards for VPS monitoring include:

• Dashboard 13978: A minimal server overview with clean, dark-mode gauges for CPU, RAM, disk, and network—good for TV-mounted NOC displays.
• Dashboard 405: MySQL overview, useful if your VPS runs a MariaDB or MySQL database alongside the main application.
• Dashboard 11835: Redis overview for cache hit rate, memory fragmentation, and eviction metrics.

Pin time ranges: when debugging a past incident, always set the Grafana time range to bracket the event with 30 minutes of buffer on each side. Drilling from a broad "last 7 days" view to a 1-hour incident window narrows noise and makes the anomaly obvious.

See VPSWala VPS plans for specifications, and VPSWala 9950X VPS for high-frequency plans suited to Prometheus at scale.

Sources

• Prometheus: Monitoring Linux Host Metrics with Node Exporter
• Grafana: Getting Started with Grafana and Prometheus
• VPSWala: KVM VPS Plans
• VPSWala: Ryzen 9 9950X VPS