Zabbix 8.0 went stable in November 2026, and the Ubuntu 24.04 packages install without workarounds. It is an LTS release, so the setup you build today stays supported for years. The 8.0 line locks the API down by default, verifies TLS on HTTP checks, and adds APM views, JSON item types and a scatter plot widget. This guide installs the full stack with PostgreSQL and Nginx, then walks the setup wizard to a working dashboard.
Every command below ran on a fresh Ubuntu 24.04 VM, and we captured the wizard end to end. Tested on Ubuntu 24.04 LTS with Zabbix 8.0, PostgreSQL 16.15, Nginx 1.24 and PHP 8.3 in November 2026. If you’re still running the previous LTS in production, our guide on Zabbix 7.0 LTS on Ubuntu 24.04 with PostgreSQL and Nginx covers that path.
Before You Begin
You need a server that meets the raised 8.0 minimums, because the older stacks Zabbix 7.0 accepted now fail the frontend check. Everything below fits on one VM:
- An Ubuntu 24.04 LTS server with 2 CPU cores and 4 GB RAM
- PostgreSQL 15 or newer (16 ships with Ubuntu 24.04)
- PHP 8.2 or newer (8.3 on Ubuntu 24.04)
- Root or sudo access
- Ports 80, 443, 10050 and 10051 open in the firewall
- A domain for SSL, optional in a lab and expected in production
Treat the 4 GB figure as a lab floor, because real memory use scales with the number of items you collect and how long you keep history. A busy enterprise collector wants several times that before you configure a single template.
How It Fits Together
Everything lands on one VM, and the architecture diagram shows how the pieces talk before the first command. Read it once now and again after the firewall step, because each arrow is a port the UFW rules below must match:
Only nginx faces the network, and every port in the picture is one the firewall section opens. Nothing here needs a second server, which is why the stack suits a small office or a first monitoring build.
Add the Zabbix 8.0 Repository
Zabbix publishes its own repository package, so grab the latest one for Ubuntu 24.04 and install it. Pick the package built for your exact Ubuntu release, because a mismatch between repo and distro shows up later as unmet dependencies:
wget https://repo.zabbix.com/zabbix/8.0/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_8.0+ubuntu24.04_all.deb
sudo dpkg -i zabbix-release_latest_8.0+ubuntu24.04_all.deb
sudo apt updateThe package ships three repository definitions, and knowing which one serves what saves confusion later. You only ever enable the first one by hand, but apt reads all three from the moment the package lands:
zabbix-release, the stable repositoryzabbix-unstable, pre-release buildszabbix-tools, extra tooling packages
One release-day detail caught us. The release repository held only the zabbix-release package itself when 8.0 went stable, so apt resolves the server packages from the unstable repository the same package enables. That is normal for the first days after a GA announcement, and it doesn’t change a single command below. Confirm what you will actually get before you install, since the policy output names the exact source:
apt-cache policy zabbix-server-pgsql | head -3Our run showed the release candidate build coming from the unstable repo, which is what you should expect to see on release day. The candidate version and its source repo are the two fields worth reading here:
zabbix-server-pgsql:
Installed: 2:8.0.0~rc3-1+ubuntu24.04
Candidate: 2:8.0.0~rc3-1+ubuntu24.04The candidate moves to the final build once Zabbix publishes it in the release repository, and nothing after this step changes either way. The repository package itself is current at revision 0.4, as the capture below shows along with the exact server build apt installed. Keep an eye on that revision number if an install misbehaves, because most release-week bug reports trace back to a stale package:
Once the final build lands, zabbix_server --version reports it the same way the capture above reports the release candidate. Use that command as your ground truth rather than this page, because package versions move faster than any guide can.
Install the Server, Frontend and Agent 2
Install the server with the PostgreSQL backend, the PHP frontend, the Nginx config, the SQL scripts and Agent 2 in one pass, because apt resolves every cross-dependency in a single transaction. Doing it piecewise risks a half-installed frontend that fails the wizard checks in confusing ways:
sudo apt install -y zabbix-server-pgsql zabbix-frontend-php php8.3-pgsql zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2 zabbix-agent2-plugin-postgresqlThat single transaction pulls in everything the frontend check will look for later, because each package covers a dependency the wizard verifies. The versions also land as a matched set, which is exactly what you want on a fresh install:
- Nginx, with the Zabbix vhost template
- PHP-FPM 8.3 and every extension the frontend requires
- Agent 2, with its PostgreSQL plugin
If the transaction dies on a GPG signature instead, our note on the Zabbix GPG check FAILED error covers the recovery, and it is usually a stale keyring rather than a broken mirror. Running apt update again after fixing the key clears the error without any package changes.
Set Up PostgreSQL
Ubuntu 24.04 ships PostgreSQL 16 in its default repositories, which clears the 8.0 minimum, and it starts on its own after installation. Install it, then create the Zabbix role and database:
sudo apt install -y postgresql
sudo -u postgres createuser --pwprompt zabbix
sudo -u postgres createdb -O zabbix zabbixGive the role a strong password when createuser prompts you, because both the server and the frontend use it. Then import the schema. On 8.0 the file lives under /usr/share/zabbix/sql-scripts/postgresql/, one directory shorter than the path older guides quote:
zcat /usr/share/zabbix/sql-scripts/postgresql/server.sql.gz | sudo -u zabbix psql zabbixThe import takes about a minute and ends in a COMMIT, and it is worth letting it run to the end, because a partial import looks healthy until the server tries to read its first configuration row. Do not background the command or close the terminal mid-run.
The 8.0 schema creates 230 tables, so that count doubles as your version check:
sudo -u zabbix psql zabbix -tAc "SELECT count(*) FROM pg_tables WHERE schemaname='public';"You should see 230. A lower number means the import died partway, so drop the database, recreate it and run the import again rather than trying to resume, because a half-empty schema fails later in ways that are hard to trace. The count comes back instantly, so it costs nothing to run it twice.
Configure the Zabbix Server
The server needs the database password you set on the role, and it won’t read it from anywhere else. Open the config and find the commented DBPassword line:
sudo vi /etc/zabbix/zabbix_server.confSet the line and save the file. We deliberately leave every other parameter at its default here, because cache tuning only makes sense once the server has run and shown you its real behavior.
The DBName and DBUser defaults are already zabbix, so unless you named things differently, that is the only line you change. We have seen installs stall for an hour over a typo in this file, so test it with the log check below before you move on.
Configure Nginx for the Frontend
On Ubuntu the zabbix-nginx-conf package drops its vhost at /etc/zabbix/nginx.conf, not in /etc/nginx/conf.d/ like the RHEL-family guides you may have read. That is the difference most guides get wrong for Ubuntu, so it’s worth a minute before you edit anything. Set the port and name your host:
sudo vi /etc/zabbix/nginx.confTwo lines at the top of the server block need uncommenting. The template ships them commented with the listen line sitting at 8080, which is why an unedited install answers on the wrong port if you skip this step:
listen 80;
server_name zabbix.example.com;The package handles the rest for you. The web root points at /usr/share/zabbix/ui, and PHP traffic goes to a dedicated pool listening at /var/run/php/zabbix.sock, which /etc/zabbix/php-fpm.conf defines. Both paths are worth knowing when something breaks, because Nginx logs upstream socket errors and PHP-FPM logs pool errors separately. Enable the vhost and drop the default site, because it claims port 80 first and would win every reload:
sudo ln -sf /etc/zabbix/nginx.conf /etc/nginx/sites-enabled/zabbix.conf
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxFor production you’ll want SSL, and the easy route is certbot with the Nginx plugin, which edits the enabled vhost in place. It also installs a renewal timer, so certificates keep themselves current without anything to schedule by hand:
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d zabbix.example.comUbuntu 24.04 ships Nginx 1.24, which keeps the older listen 443 ssl http2 syntax rather than the separate http2 on directive newer Nginx uses. Any hand-merged SSL block you copy from a Rocky guide needs that line adjusted to match.
Open the Firewall
Ubuntu uses UFW, and it denies everything by default once you turn it on. Allow SSH before you enable it, because that is the session you’re connected through, then the Zabbix ports:
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10050/tcp
sudo ufw allow 10051/tcp
sudo ufw enablePort 10051 is where agents and proxies connect to the server, and 10050 is the port the server itself dials when it checks a classic agent directly. Keep 10051 open even when you front the server with proxies, because they connect through it, while 10050 only matters for direct agent checks. Our status below shows the services active and the five rules loaded:
Every rule and service in this capture matches the commands above, so if yours differ, diff the UFW list before moving on.
Start the Services
Enable and start the server, agent, Nginx and PHP-FPM together, because they only work as a set. A server without PHP-FPM loads no frontend, and Nginx without the vhost serves the default page:
sudo systemctl enable --now zabbix-server zabbix-agent2 nginx php8.3-fpmThen check the server log before you open a browser, because a wrong database password shows up there and nowhere else:
sudo grep "enabling Zabbix agent checks" /var/log/zabbix/zabbix_server.logYou’re looking for this line, which means the server connected to the database and the local agent interface is live:
16438:20261105:102603.630 enabling Zabbix agent checks on host "Zabbix server": interface became availableThe 230 tables and that log line together tell you the whole backend is sound. Both show up in our capture from the lab run:
That closes out the server side. Everything after this point happens in a browser, not on the shell.
Walk Through the Web Setup Wizard
Open http://zabbix.example.com in a browser and the wizard starts on its own. It walks six pages in a fixed order, and each one fails loudly when the step before it is wrong:
- Welcome, which hands you to the checks
- Check of pre-requisites, the PHP and extension gate
- Configure DB connection
- Settings, for the frontend name and locale
- Pre-installation summary
- Install, which writes the config file
Click Next step through the welcome and pre-requisites pages. The second one confirms PHP 8.3 and every required extension, and on our run nothing needed attention:
The welcome page is pure formality. The checks come next, and they are the first real gate.
On the database page, only PostgreSQL appears in the Database type list, because we installed php8.3-pgsql and nothing else. Fill the DB user password field with the password you created earlier, and leave the host, port and database name alone, since the defaults match what we set up in the database section:
- 1Database type
- 2DB user password
The settings page takes the frontend name and locale. We typed the host name into the Frontend name field, but the defaults are fine if you’d rather skip it:
The summary reflects what you entered, and the install page writes /etc/zabbix/web/zabbix.conf.php with the database credentials. When it finishes, the wizard hands you the login. That file is also the one to delete if you ever need to rerun the wizard, because the frontend skips it while the file exists. It is owned by www-data and readable only by that user, so a shell under any other account cannot read your database password out of it:
Nothing on the summary page edits anything. The install step after it is the one that writes the config file.
Log in with the default Admin / zabbix pair, then change the password immediately, because every scanner on the internet tries those two words against a fresh Zabbix. The change lives under the user icon at the bottom of the sidebar, in User settings, not under the admin Users menu:
The Global view dashboard proves the loop is closed. System information reports the server running on localhost port 10051, and the sidebar carries the new APM and Services entries this release adds. If System information says No instead, the server cannot reach the database, and the log check from the previous section tells you why:
Ubuntu needs no SELinux boolean for the database connection, unlike Rocky Linux where the wizard fails against PostgreSQL until you allow it. AppArmor, which Ubuntu ships instead, carries no equivalent restriction on this connection. That difference bites people moving between the two, so it’s the first thing to check when a Rocky install won’t connect while the Ubuntu one did.
Ubuntu vs Rocky Linux: Key Differences
If you also run this stack on Rocky Linux, here is what changes between the two installs:
| Item | Ubuntu 24.04 | Rocky Linux 10 |
|---|---|---|
| Package manager | apt install | dnf install |
| Nginx version | 1.24.0 (listen 443 ssl http2) | 1.26.3 (separate http2 on) |
| PHP-FPM service | php8.3-fpm | php-fpm |
| PHP-FPM socket | /var/run/php/zabbix.sock | /run/php-fpm/zabbix.sock |
| Nginx vhost path | /etc/zabbix/nginx.conf (symlink to sites-enabled) | /etc/nginx/conf.d/zabbix.conf |
| SELinux | Not present (AppArmor instead) | Enforcing (needs setsebool) |
| Firewall | UFW | firewalld |
| PostgreSQL | 16 (auto-starts) | 16 (needs initdb) |
| Frontend PHP package | zabbix-frontend-php | zabbix-web-pgsql |
The vhost path is the difference most guides get wrong for Ubuntu. The RHEL-family package writes straight into /etc/nginx/conf.d/, while the Debian package keeps its config under /etc/zabbix/ and expects you to link it in. Once you know that, the rest of the table is routine distro translation.
Using MySQL Instead of PostgreSQL
If your team standardizes on MySQL or MariaDB, swap the backend packages and repeat the database steps against MariaDB. The 8.0 line requires MySQL 8.4 or MariaDB 10.11 or newer, and the MySQL that Ubuntu 24.04 ships in its own repositories is 8.0, which falls short, so install the MariaDB that noble carries instead of the distro mysql-server package:
sudo apt install -y zabbix-server-mysql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2 mariadb-serverStart MariaDB, create the database with the utf8mb4 collation Zabbix requires, import the MySQL schema, and set DBPassword the same way as before. The log_bin_trust_function_creators line matters during the import, because the schema creates stored functions and binary logging blocks them without it, so the last line turns it back off once the import is done:
sudo systemctl enable --now mariadb
sudo mariadb -e "CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;"
sudo mariadb -e "CREATE USER 'zabbix'@'localhost' IDENTIFIED BY 'YourPassword';"
sudo mariadb -e "GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix'@'localhost';"
sudo mariadb -e "SET GLOBAL log_bin_trust_function_creators = 1;"
zcat /usr/share/zabbix/sql-scripts/mysql/server.sql.gz | sudo mysql zabbix
sudo mariadb -e "SET GLOBAL log_bin_trust_function_creators = 0;"During the wizard, the database page then offers MySQL, and everything else in this guide stays the same. The PostgreSQL path is what we’d run for a new deployment, but a team with existing MySQL operations knowledge loses more to an unfamiliar database than it gains from a preference.
Harden the New Install
Two 8.0 defaults change how a fresh server behaves, and both are worth an hour before you point real agents at it. The API starts closed, which means new installs ship with API access disabled for every user role, and a role with an empty allow list cannot call any method. Enable it per role under User roles only when an integration needs it, because an open API is the first thing automated scanners probe. The templates for HTTP-based items and webhook media types also verify TLS by default now, and the {$HTTP.TLS.VERIFY} macro they carry sets the level, from no verification up to full certificate and hostname checks. Older templates that talk to self-signed endpoints will fail until you set that macro on them.
From here, change the default Admin password, point your first agents at port 10051 and let the server collect for a day before you build dashboards. If you’re moving an existing 7.0 install forward instead of starting fresh, the steps differ enough that our Zabbix 7 to 8 upgrade guide is the safer route. The Agent 2 install guide for Debian covers the client side of the fleet.
