Grafana Admin flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Default Grafana HTTP port

Grafana listens on TCP port 3000 by default. Change it with the [server] http_port setting in grafana.ini or the GF_SERVER_HTTP_PORT environment variable.

Environment variable override syntax

Grafana maps environment variables to config keys using the GF_ prefix, uppercased section and key, with underscores replacing dots. For example, GF_SERVER_HTTP_PORT overrides [server] http_port.

Default Grafana database

A fresh Grafana install uses SQLite3, storing data in /var/lib/grafana/grafana.db. For production, configure MySQL or PostgreSQL in the [database] section to avoid file-lock and scaling limits.

Reset admin password CLI

Run grafana-cli admin reset-admin-password <newpassword> on the server. The command updates the admin user in the configured database and requires access to the Grafana binary and configuration.

Provisioning datasources directory

Datasource provisioning YAML files are placed in /etc/grafana/provisioning/datasources. Grafana reads them at startup and can reload them periodically, creating or updating datasources without UI interaction.

Provisioning dashboards directory

Dashboard provider YAML files live in /etc/grafana/provisioning/dashboards. Each provider points to a folder of dashboard JSON files and defines update behavior and folder assignment.

Organization isolation

Each Grafana organization has its own dashboards, datasources, users, and preferences. Users can be members of multiple organizations with a different role in each, and data is not shared across organizations by default.

Viewer Editor Admin roles

Within an organization, Viewer can view dashboards, Editor can also create and edit dashboards and alerts, and Admin can also manage users, datasources, and org settings. These are org-scoped roles.

Server Admin global role

The Server Admin flag is stored on the user account and grants access to all organizations, server-wide settings, and user management. It is separate from an organization Admin role.

Configuration precedence order

Grafana resolves settings in this order: built-in defaults, then grafana.ini, then environment variables, then command-line flags. Later sources override earlier ones for the same key.

Log configuration section

The [log] section sets mode (console, file, syslog) and level (debug, info, warn, error). Default mode is console and default level is info; file mode also needs a file path.

Snapshot sharing setting

The [snapshot] section controls internal and external snapshot creation. External snapshots are uploaded to an external service by default, so disable external snapshots in environments where dashboard data must not leave the network.

Grafana CLI plugin commands

grafana-cli plugins install <plugin-id> installs a plugin, grafana-cli plugins update-all updates installed plugins, and grafana-cli plugins list shows installed plugins. A server restart is required afterward.

Anonymous access setting

The [auth.anonymous] section enables unauthenticated dashboard viewing. Set enabled to true and choose an org_role such as Viewer. Anonymous users are limited to the configured organization and role.

Auth proxy header login

The [auth.proxy] section trusts an upstream reverse proxy to authenticate users via a header such as X-WEBAUTH-USER. Enable it only when the proxy strips client-supplied headers and enforces authentication.

LDAP authentication configuration

LDAP is configured in [auth.ldap] with a TOML file (ldap.toml) defining servers, bind credentials, search filters, and group-to-role mappings. Group mappings assign org roles based on LDAP group membership.

OAuth generic integration

The [auth.generic_oauth] section configures an OAuth2 provider with client ID, secret, scopes, auth URL, and token URL. Role mapping can use a JMESPath expression against the user info response.

SAML authentication setup

SAML is configured in [auth.saml] with an IdP metadata URL or XML, a certificate and private key for signing, and attribute mappings for login, email, name, and role. It is available in Grafana Enterprise.

API key vs service account

Legacy API keys are created under an organization and carry a fixed role. Service accounts are the recommended replacement, with tokens that can be rotated and scoped to a service account rather than a user.

Team and folder permissions

Teams group users for permission assignment. Folder permissions grant View, Edit, or Admin on a folder and its dashboards to users, teams, or roles, and override organization-wide default permissions.

Dashboard version history

Grafana stores dashboard revisions, allowing comparison and restoration of earlier versions. Version history is available from the dashboard settings and is retained according to the database configuration.

Data source permissions

Data source permissions restrict which users or teams can query a data source. When enabled, only explicitly granted users and teams can use it, and queries from other users are denied.

Alerting high availability

In HA mode, multiple Grafana instances coordinate alert evaluation through a shared database. Only one instance evaluates each alert rule at a time to avoid duplicate notifications.

Unified alerting vs legacy

Unified alerting is the current alerting system, configured per organization with alert rules, contact points, and notification policies. Legacy dashboard alerting is deprecated and should be migrated.

Contact point configuration

A contact point defines where notifications are sent, such as email, Slack, PagerDuty, or webhook. Multiple integrations can be combined in one contact point, and notification policies route alerts to them.

Notification policy tree

Notification policies form a tree of matchers that route alerts to contact points. The root policy is the default, and child policies override it for alerts matching their label matchers.

Silences and mute timings

Silences suppress notifications for matching alerts during a time window. Mute timings define recurring time intervals, such as maintenance windows, during which notifications are not sent.

Grafana image renderer

The image renderer is a separate service that renders panels and dashboards to PNG for alerts and reports. Configure it in [rendering] with server_url and callback_url, and install the renderer plugin.

Reporting scheduled PDF

Reporting generates scheduled PDF reports of dashboards and emails them to recipients. It requires the image renderer and is configured per dashboard with a schedule, recipients, and orientation.

Usage insights and auditing

Usage insights record dashboard and datasource access for analytics. Auditing logs administrative and security-relevant actions. Both are configured in the [analytics] and [auditing] sections and are Enterprise features.

Database migration command

grafana-cli admin migrate-database applies pending schema migrations. Run it during upgrades or when switching database backends, after backing up the existing database.

Backup Grafana database

Back up the configured database (SQLite file or MySQL/PostgreSQL dump) and the grafana.ini and provisioning directories. Restoring requires stopping Grafana, restoring the database, and restarting.