Install Zabbix 8.0 LTS on Ubuntu 26.04

Install Zabbix on Ubuntu 26.04 from Zabbix’s own download page today and apt hands you a release candidate, not the new 8.0 LTS build. The release package still points at the unstable tree, so one extra source file is what gets you the GA packages. After that you’ll have a Zabbix 8.0 server behind HTTPS with a second host reporting in.

Original content from computingforgeeks.com - post 166145

The stack is PostgreSQL 18, Nginx, PHP 8.5 and agent 2. Two 8.0 defaults catch fresh installs on the way: API access is off for every role except Super admin, and HTTPS templates and webhooks verify certificates. Built and run on Ubuntu 26.04 in November 2026 with Zabbix 8.0.0 from the stable repo, on a fresh server VM and a 24.04 agent host.

Everything runs on one box, qs-01. Nginx is the only thing users hit and PostgreSQL stays on localhost. The server polls agents on 10050, and agents push active checks back on 10051.

Before you start

You need an Ubuntu 26.04 server with sudo, and a DNS A record (say zabbix.example.com) pointing at it with port 80 open for Let’s Encrypt. The lab box had 2 vCPU, 4 GB RAM and 20 GB of disk. That’s a floor for trying it out, not a sizing guide: real sizing follows how many metrics you collect and how long you keep history, and the database eats most of it. Zabbix’s published sizing table suggests 2 vCPU and 8 GB for about 1,000 monitored metrics and 4 vCPU and 16 GB for 10,000.

Set the values you’ll reuse. Swap in your own password and domain, and keep /, &, \ and quotes out of the password, because it lands in a sed expression and an SQL string:

export ZBX_DB_PASS='Change-Me-Zbx8-2026'
export ZBX_DOMAIN='zabbix.example.com'
export ADMIN_EMAIL='[email protected]'

These live only in your current shell, so run the rest of the server steps in the same session or export them again after you reconnect.

Install PostgreSQL

PostgreSQL 18 ships in the 26.04 archive, so there is no extra repo to add.

sudo apt update
sudo apt install -y postgresql

Check that the cluster is up before you point anything at it, because every later step talks to it. The version matters too, since Zabbix 8.0 won’t start on PostgreSQL older than 15 unless you set AllowUnsupportedDBVersions=1.

systemctl is-active postgresql
psql --version

You will see the 18.x build from the Ubuntu archive.

active
psql (PostgreSQL) 18.6 (Ubuntu 18.6-0ubuntu0.26.04.1)

Defaults are fine for a Zabbix server of this size. Tuning, remote access and backups live in the PostgreSQL 18 on Ubuntu 26.04 guide when you need them.

Add the Zabbix 8.0 repo

Start with the release package Zabbix’s download page gives you. It installs the signing key and the apt sources.

wget https://repo.zabbix.com/zabbix/8.0/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_8.0+ubuntu26.04_all.deb
sudo dpkg -i zabbix-release_latest_8.0+ubuntu26.04_all.deb
sudo apt update

Now check which build apt would install. This is the step most guides skip, and it is the one that matters here.

apt-cache policy zabbix-server-pgsql | head -3

In the lab the candidate was 2:8.0.0~rc3-1+ubuntu26.04, a release candidate, because the package behind the latest_8.0 link was still revision 1:8.0-0.4. You can see why in /etc/apt/sources.list.d/. It adds three sources:

• zabbix-release.sources: the release tree, which only holds the release package itself.
• zabbix-tools.sources: Zabbix’s extra tools repo.
• zabbix-unstable.sources: the unstable tree, where every alpha, beta and RC of 8.0 lives.

The GA packages sit in a separate 8.0/stable tree that none of them enable, so apt never sees them. A 2:8.0-0.3 release package also sits in the repo. Its changelog makes it older than 0.4, but its higher epoch makes apt treat it as an upgrade, and installing it changed nothing useful: same three sources, still no stable, and the URIs drop back to http://.

If your candidate already reads 8.0.0-1 or later with no ~rc in it, Zabbix has fixed its release package and you can skip to the next section. Otherwise add the stable source with the same signing key, switch unstable off so a future RC can’t outrank the GA build, and hold zabbix-release:

. /etc/os-release
printf '%s\n' 'Types: deb' 'URIs: https://repo.zabbix.com/zabbix/8.0/stable/ubuntu' "Suites: ${VERSION_CODENAME}" 'Components: main' 'Signed-By: /usr/share/keyrings/zabbix.gpg' | sudo tee /etc/apt/sources.list.d/zabbix-stable.sources
grep -q '^Enabled:' /etc/apt/sources.list.d/zabbix-unstable.sources || echo 'Enabled: no' | sudo tee -a /etc/apt/sources.list.d/zabbix-unstable.sources
sudo apt-mark hold zabbix-release
sudo apt update

The hold matters. Without it, that higher-epoch 0.3 package shows as upgradable straight away, and your edited zabbix-unstable.sources is a conffile, so the next apt upgrade asks whether to replace it; answering yes quietly turns unstable back on. With the hold in place, apt upgrade keeps zabbix-release back, even though it still shows up in apt list --upgradable. Lift it with sudo apt-mark unhold zabbix-release once Zabbix ships a release package that enables stable.

Run the same apt-cache policy again. Both runs from the lab box are below: the first is the release package alone, the second is after the stable source went in, with the candidate now coming from 8.0/stable:

Ubuntu’s own archive also carries a zabbix-server-pgsql (a 7.0 build with epoch 1), which shows up in the full version table. Zabbix’s packages use epoch 2, so they win as long as a Zabbix source is enabled, but it is one more reason to read the candidate line before you install.

Install the server, frontend and agent 2

It is one line. Name php-pgsql yourself: the frontend depends on php-mysql or php-pgsql, and apt picks the MySQL driver if you leave it to choose:

sudo apt install -y zabbix-server-pgsql zabbix-frontend-php php-pgsql zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2

That pulled 61 packages (about 63 MB) on the lab box, including Nginx and PHP 8.5 FPM. Confirm the build that actually landed:

apt-cache policy zabbix-server-pgsql | head -3

Installed and candidate should both be the GA revision:

zabbix-server-pgsql:
  Installed: 2:8.0.0-1+ubuntu26.04
  Candidate: 2:8.0.0-1+ubuntu26.04

A ~rc in either line means the stable source didn’t take, so go back and check zabbix-stable.sources before you load a schema you’d have to migrate later.

Create the database

Make the zabbix role and a database it owns. The server and the frontend both log in as this role, so the password you set here is the one you’ll type into the config file and the web installer later.

sudo -u postgres psql -c "CREATE USER zabbix WITH PASSWORD '${ZBX_DB_PASS}';"
sudo -u postgres createdb -O zabbix zabbix

Load the schema. The 8.0 scripts live under /usr/share/zabbix/sql-scripts/, not the /usr/share/zabbix-sql-scripts/ path that 7.0 LTS uses, so commands copied from 7.0 guides point at a path that doesn’t exist here. The import took about 26 seconds on the lab VM:

zcat /usr/share/zabbix/sql-scripts/postgresql/server.sql.gz | sudo -u zabbix psql -q zabbix > /dev/null

The server checks the schema version on every start, and a fresh import reports 08000000 for both the mandatory and optional versions, which you’ll see in the log in a minute.

Configure the server and Nginx

Give the server its database password. The line ships commented out, so the server can’t reach PostgreSQL until you set it:

sudo sed -i "s/^# DBPassword=.*/DBPassword=${ZBX_DB_PASS}/" /etc/zabbix/zabbix_server.conf

The Nginx config also ships with listen and server_name commented out. Turn both on with your domain, then read them back:

sudo sed -i -e 's/^#\s*listen\s*8080;/        listen 80;/' -e "s/^#\s*server_name\s*example.com;/        server_name ${ZBX_DOMAIN};/" /etc/zabbix/nginx.conf
grep -nE '^\s*(listen|server_name)' /etc/zabbix/nginx.conf

Both lines are live now.

2:        listen 80;
3:        server_name zabbix.example.com;

Nginx’s own default site still owns requests by IP, which is why the web installer below needs the domain name.

Start the stack and open the firewall

Test the Nginx config first, so a typo does not take Nginx down on restart, then start and enable all four services:

sudo nginx -t
sudo systemctl restart zabbix-server zabbix-agent2 nginx php8.5-fpm
sudo systemctl enable zabbix-server zabbix-agent2 nginx php8.5-fpm

Open the firewall. SSH goes first so you do not lock yourself out (on a non-standard SSH port, allow that port instead). The UFW guide for Ubuntu 26.04 has the rest of the syntax:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw allow 10051/tcp
sudo ufw --force enable

Port 10051 is only for agents in active mode, proxies and zabbix_sender. If every agent you add is passive, you can leave it closed and the server still polls them on 10050.

Add HTTPS with Let’s Encrypt

Nginx came in with the Zabbix packages, so there is no separate Nginx install to do. Certbot’s Nginx plugin finds the Zabbix server block by its server_name and adds TLS plus the HTTP to HTTPS redirect:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d "${ZBX_DOMAIN}" --non-interactive --agree-tos --redirect -m "${ADMIN_EMAIL}"

The lab box has no public DNS, so its run pointed certbot at a local ACME test server, and only the --server and --no-verify-ssl flags differed. Certbot writes straight into the Zabbix config:

Deploying certificate
Successfully deployed certificate for zabbix.example.com to /etc/nginx/conf.d/zabbix.conf
Congratulations! You have successfully enabled HTTPS on https://zabbix.example.com

/etc/nginx/conf.d/zabbix.conf is a symlink to /etc/zabbix/nginx.conf, and that file belongs to the zabbix-nginx-conf package. When a later Zabbix update ships a new version of it, apt asks whether to keep yours. Keep it, or certbot’s TLS lines disappear and the frontend drops back to plain HTTP.

A box on a private network with no public port 80 needs a DNS-01 plugin instead, such as python3-certbot-dns-cloudflare, -route53, -digitalocean, -google or -rfc2136. With Cloudflare and an API token scoped to DNS edit:

sudo apt install -y python3-certbot-dns-cloudflare
echo "dns_cloudflare_api_token = your-token-here" | sudo tee /root/cloudflare.ini > /dev/null
sudo chmod 600 /root/cloudflare.ini
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/cloudflare.ini -d "${ZBX_DOMAIN}" --non-interactive --agree-tos -m "${ADMIN_EMAIL}" --deploy-hook "systemctl reload nginx"
sudo certbot install --nginx --cert-name "${ZBX_DOMAIN}" --redirect --non-interactive

Keep --deploy-hook. A certonly cert has no installer in its renewal config, so without the hook renewals land on disk while Nginx keeps serving the old cert until it expires.

Finish the web installer

Browse to https://zabbix.example.com/. The 8.0 frontend sits at the web root with no /zabbix path, and you need the domain, not the IP, because the IP lands on Nginx’s default site. Work through the wizard in order:

1. Click Next step on the welcome screen and check that every pre-requisite reads OK.
2. On Configure DB connection, leave PostgreSQL and localhost as they are and type the zabbix user’s password.
3. On Settings, give the server a name (it shows under the logo) and pick your time zone.
4. Click Next step through the summary, then Finish.

The pre-requisites screen is where an old PHP shows up. Zabbix 8.0 raised the floor to PHP 8.2, and Ubuntu 26.04’s PHP 8.5.4 clears it with every check green:

On the database screen only the password field needs you. PostgreSQL is already selected because php-pgsql is the only database driver installed, which is the reason you named it in the apt line:

Once the wizard writes /etc/zabbix/web/zabbix.conf.php, 8.0 restricts access to setup.php, so nobody can rerun the installer over your config. Log in as Admin with the password zabbix, and change it straight away under User settings > Profile. The Global view loads with the server and frontend both on 8.0.0 and marked up to date:

Check it from the shell too. The version line, five active services and the listening ports tell you the whole stack is up:

zabbix_server -V | head -1
systemctl is-active zabbix-server zabbix-agent2 nginx php8.5-fpm postgresql
ss -tln '( sport = :10051 or sport = :443 or sport = :5432 )'

Look at the 5432 lines: PostgreSQL only listens on loopback, which is what you want with the database on the same box:

The server log agrees. Its startup line names the GA revision, and the database version matches what the server requires:

sudo grep -E 'Starting Zabbix Server|database version' /var/log/zabbix/zabbix_server.log

From the lab box:

 16621:20261105:104810.219 Starting Zabbix Server. Zabbix 8.0.0 (revision c81e276e505).
 16621:20261105:104810.252 current database version (mandatory/optional): 08000000/08000000

A mismatch between those two numbers and the required version is the first thing to look for if the server ever refuses to start after an upgrade.

Turn on API access for other roles

This is the 8.0 change that breaks integrations on a fresh install. The 8.0 upgrade notes say that on new installations API access is disabled by default for all roles. On the lab box the database told a slightly different story: Super admin role keeps API access (and its form is read-only), while Admin role, User role and Guest role have it off. So the built-in Admin account can call the API, and any service account you create on the Admin role can’t.

The catch is that login still works. A Grafana or Ansible user on the Admin role gets a valid token from user.login, then every real call fails with No permissions to call "host.get"., which reads like a host permissions problem when it is not. The terminal below is that user’s token before and after the fix:

Here is how you turn it on for a role.

1. Open Users > User roles and click the role your service account uses, for example Admin role.
2. Scroll to Access to API and tick Enabled.
3. Leave API methods on Deny list with an empty list, or switch to Allow list and add the methods the integration needs.
4. Click Update at the bottom of the form.

Watch the allow list in step 3. In 8.0 an Allow list with no methods in it denies every method, where older releases ignored an empty list. Also, the [] in the second terminal run is not an error: the API call now works, and the empty result only means that user’s group has no host group permissions yet. Grant those under Users > User groups.

Know the TLS verification default

The second 8.0 default is quieter. Templates and webhook media types that talk to HTTPS endpoints now verify the endpoint’s certificate, controlled by a {$HTTP.TLS.VERIFY} macro. On the lab database, 103 templates (the AWS, cloud and other “by HTTP” ones) carry that macro, every one set to full, and all 32 webhook media types (Slack, Telegram, Jira, Discord, PagerDuty and the rest) read it through a tls_verify parameter. The values work like this:

Macro value	What the template or webhook checks
full (default)	Certificate chain, expiry and that the hostname matches
peer	Certificate chain and expiry only, hostname not checked
none	Nothing; for webhooks, also the only value that accepts a plain http:// URL
Unset or anything else	Treated as full by the webhook scripts

That last row is in the media type scripts themselves: an unknown value falls back to full. With verification on, a webhook pointed at an http:// URL throws “TLS certificate verification is enabled by {$HTTP.TLS.VERIFY}, but the URL uses plain HTTP” before it sends anything. So an internal Jira or GLPI behind a self-signed cert needs its CA trusted on the Zabbix server, or the macro set to peer or none on that media type or host. Fix the certificate where you can; none is for a lab.

Add a host with agent 2

Now a second machine. The lab used demo on Ubuntu 24.04, which shows the 8.0 agent works across releases. On that host, set the Zabbix server’s address (hostname -I on the server prints it):

export ZBX_SERVER_IP='10.0.1.40'

Install agent 2 from the 8.0 repo. VERSION_ID picks the 26.04 or 24.04 release package, VERSION_CODENAME fills in the stable source, and the same stable-source fix applies here, since the 24.04 release package also enables unstable:

. /etc/os-release
wget "https://repo.zabbix.com/zabbix/8.0/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_8.0+ubuntu${VERSION_ID}_all.deb"
sudo dpkg -i "zabbix-release_latest_8.0+ubuntu${VERSION_ID}_all.deb"
printf '%s\n' 'Types: deb' 'URIs: https://repo.zabbix.com/zabbix/8.0/stable/ubuntu' "Suites: ${VERSION_CODENAME}" 'Components: main' 'Signed-By: /usr/share/keyrings/zabbix.gpg' | sudo tee /etc/apt/sources.list.d/zabbix-stable.sources
grep -q '^Enabled:' /etc/apt/sources.list.d/zabbix-unstable.sources || echo 'Enabled: no' | sudo tee -a /etc/apt/sources.list.d/zabbix-unstable.sources
sudo apt-mark hold zabbix-release
sudo apt update
sudo apt install -y zabbix-agent2

On demo that installed 2:8.0.0-1+ubuntu24.04. Next, tell the agent who may talk to it and what its hostname is. The 8.0 agent config is 0640 root:zabbix, so even reading it back needs sudo:

sudo sed -i -e "s/^Server=127.0.0.1/Server=${ZBX_SERVER_IP}/" -e "s/^ServerActive=127.0.0.1/ServerActive=${ZBX_SERVER_IP}/" -e "s/^Hostname=Zabbix server/Hostname=$(hostname)/" /etc/zabbix/zabbix_agent2.conf
sudo grep -E '^(Server|ServerActive|Hostname)=' /etc/zabbix/zabbix_agent2.conf

All three values should point at your server now.

Server=10.0.1.40
ServerActive=10.0.1.40
Hostname=demo

Restart the agent, and let only the Zabbix server reach port 10050:

sudo systemctl restart zabbix-agent2
sudo systemctl enable zabbix-agent2
sudo ufw allow OpenSSH
sudo ufw allow from "${ZBX_SERVER_IP}" to any port 10050 proto tcp
sudo ufw --force enable

Then register it in the frontend.

1. Go to Data collection > Hosts and click Create host.
2. Set Host name to demo. It must match Hostname= in the agent config, or active checks get rejected.
3. Add the template Linux by Zabbix agent and the host group Linux servers.
4. Under Interfaces, click Add, pick Agent and type the host’s IP. Port 10050 is filled in for you.
5. Click Add at the bottom of the dialog.

Filled in, the form on the lab box looked like this:

About a minute later the ZBX badge on Monitoring > Hosts turns green for both hosts, and demo already had 83 items in Latest data. You’re live:

A grey badge that stays grey usually means 10050 is blocked between the two hosts or Server= doesn’t list the address the server connects from. The agent log at /var/log/zabbix/zabbix_agent2.log names the rejected address.

Move an RC install to 8.0 GA

Installed an 8.0 release candidate from this page before GA? The upgrade is the same stable-source fix plus one apt run, and the server migrates its own database on the next start. The lab ran it on an rc3 box. Dump the database first, because Zabbix does not document RC to GA as a supported path:

sudo -u postgres pg_dump -Fc zabbix > zabbix-rc.dump

Add the stable source, switch off unstable and hold zabbix-release with the same lines from the repo section, then upgrade the Zabbix packages and restart:

sudo apt update
sudo apt install -y --only-upgrade zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2
sudo systemctl restart zabbix-server zabbix-agent2

The server log shows the schema move from the RC version to 08000000 in under a second, and the edited nginx.conf came through untouched:

 17649:20261105:103211.817 Starting Zabbix Server. Zabbix 8.0.0 (revision c81e276e505).
 17649:20261105:103211.857 current database version (mandatory/optional): 07050209/07050209
 17649:20261105:103211.862 starting automatic database upgrade
 17649:20261105:103212.112 completed 100% of database upgrade
 17649:20261105:103212.533 database upgrade fully completed
 17838:20261105:103217.268 Starting Zabbix Server. Zabbix 8.0.0 (revision c81e276e505).
 17838:20261105:103217.321 current database version (mandatory/optional): 08000000/08000000

Upgrading the RC’s zabbix-release package on its own does not get you there. On the lab box apt install zabbix-release moved it to 2:8.0-0.3 and the candidate stayed on rc3, because that package still only lists unstable. Run the same source fix on agent hosts too, since they picked up the RC agent from the same place. Coming from 7.0 LTS instead of an RC is a bigger job with its own checks, covered in the Zabbix 7.0 to 8.0 upgrade guide.

Troubleshooting

All three of these came up on the lab boxes while writing this page.

Candidate: 2:8.0.0~rc3-1+ubuntu26.04

You installed the release package and apt offers an RC. The latest_8.0 release package (1:8.0-0.4) and the higher-epoch 2:8.0-0.3 that apt upgrades it to both enable unstable and no stable source, so the RC is the newest thing apt can see. Add zabbix-stable.sources and disable unstable as shown in the repo section, run apt update, and the candidate becomes 2:8.0.0-1. If you already installed the RC, follow the GA move above.

No permissions to call “host.get”

The token is valid but the user’s role has Access to API switched off, which is the 8.0 default for every role except Super admin on a new install. The full response was {"code":-32500,"message":"Application error.","data":"No permissions to call \"host.get\"."}. Tick Enabled under Access to API on that role. If the role uses an Allow list, make sure the method is on it, because an empty allow list now blocks everything.

grep: /etc/zabbix/zabbix_agent2.conf: Permission denied

The 8.0 agent package installs its config as -rw-r----- root zabbix, so a plain grep or cat as your login user fails. That’s on purpose, since the file can hold plugin passwords. Read it with sudo, and do not loosen the mode to make the error go away.

Zabbix 8.0 on Ubuntu 26.04: quick reference

What	Where or command
GA package source	/etc/apt/sources.list.d/zabbix-stable.sources (8.0/stable/ubuntu)
Server config	/etc/zabbix/zabbix_server.conf
Agent 2 config	/etc/zabbix/zabbix_agent2.conf (0640, read with sudo)
Nginx site	/etc/zabbix/nginx.conf, linked from /etc/nginx/conf.d/zabbix.conf
Frontend DB settings	/etc/zabbix/web/zabbix.conf.php
Schema scripts	/usr/share/zabbix/sql-scripts/postgresql/
Server log	/var/log/zabbix/zabbix_server.log
Ports	443 frontend, 10051 server, 10050 agent, 5432 PostgreSQL (localhost)
API access per role	Users > User roles > role > Access to API > Enabled
TLS verify for templates and webhooks	{$HTTP.TLS.VERIFY}: full, peer or none
Restart the stack	sudo systemctl restart zabbix-server zabbix-agent2 nginx php8.5-fpm

Next step: graphs from more than Zabbix, if you want them. Grafana on Ubuntu 26.04 reads Zabbix through its data source plugin, and that’s exactly the kind of service account that needs Access to API switched on. If you’re staying on 7.0 for now, the Zabbix 7.0 LTS install on Ubuntu stays supported, and on 24.04 the Zabbix 8.0 on Ubuntu 24.04 guide covers the same release.