- 8 minutes to read

Why do Nodinite use port 8000?

The Monitoring Service reaches every Monitoring Agent over one inbound TCP port. Which port that is depends on how the agent was installed: an agent installed by the Nodinite v7 package runs as an IIS web site on the port you set in the Nodinite Portal, and an agent installed with an MSI as a Windows Service listens on TCP port 8000 by default. Use the MSI only on servers that don't host the Nodinite Core Services; on the Core Services server, install agents with the package. This page explains both cases, the URL ACL reservations that Windows Service agents need, and how to troubleshoot them.

✅ Know which port each agent uses before you open the firewall
✅ Minimal open ports: one inbound port per agent
✅ URL ACL commands for agents that run as Windows Services
✅ Service Bus Relaying when no inbound port is possible

Fewer ports, less administration, more secure

Understanding Which Port an Agent Uses

flowchart TB Q{"fa:fa-circle-question How was the agent installed?"} Q -->|"v7 install package from the Portal"| IIS["fa:fa-globe IIS web site
port set in the Portal Agents step"] Q -->|"MSI on a remote server"| WS["fa:fa-gear Windows Service
TCP 8000 by default"] Q -->|"Different network, no inbound port"| SBR["fa:fa-cloud Service Bus Relaying
outbound only"] IIS --> NOACL["fa:fa-check No URL ACL needed"] WS --> ACL["fa:fa-key URL ACL needed unless
the account is a local administrator"] style Q fill:#2678BD,color:#fff style IIS fill:#93d16d style WS fill:#FFD525 style SBR fill:#9E59BB,color:#fff style NOACL fill:#93d16d style ACL fill:#FFD525

Diagram: an agent from the v7 install package is an IIS web site on the port set in the Agents step (green); an agent installed with an MSI as a Windows Service listens on port 8000 and needs a URL ACL reservation (yellow); Service Bus Relaying (purple) replaces the inbound port for agents on another network. The Monitoring Service reaches each agent at the Service URL on the agent's Connection tab.

Installation method Hosting Port URL ACL reservation
v7 install package (Portal → CLI) IIS web site, one per agent The port set per agent in the Agents step; check the Allocated ports summary ❌ Not needed
MSI on a remote server, for example a BizTalk Server Monitoring Agent or Windows Server Monitoring Agent on its own node; see each agent's Install page Windows Service 8000 by default ✅ Needed when the service account isn't a local administrator
Either, on another network Agent listens on Azure Service Bus Relay No inbound port ❌ Not needed

The firewall rules for every hop, between the Monitoring Service, the agents, the Web API, and SQL Server, live in the Monitoring Service prerequisites; the ports between an agent and the system it monitors are on that agent's Prerequisites page. This page is the reference for port 8000 and URL ACLs.

Stay Secure with Limited Ports

Nodinite Monitoring Agents need only one inbound TCP port for Nodinite traffic. The Monitoring Service opens the connection (outbound) to monitor the state of Resources and to perform manual or auto-healing Remote Actions. Depending on the agent, more ports may be needed towards the monitored system (see the agent's prerequisites).

  • Fewer open TCP ports mean fewer attack vectors and greater security
  • Less hassle and reduced administration for IT teams
  • Competing solutions often require many more open ports (e.g., RDP, VPN, dynamic RPC)

Connectivity Options

Navigate to Administration, then manage Monitoring Agents in the Nodinite Web Client. On the Connection tab of a selected agent, you set the address the Monitoring Service uses to reach the agent.

Monitoring Agent Connection tab with the Service URL field, the Service Bus Relay Hybrid Connection URL format, and the Polling Interval (7.10)
The Service URL holds the agent address, including the port the agent listens on.

The Service URL is set individually for each agent; learn more about configuring the Monitoring Agent Connection tab. If the agent runs on a different network (customer, partner, cloud), use Service Bus Relaying instead of an inbound port; see also the Azure Relay FAQ.

graph LR subgraph "Nodinite Core Services Server" ro(fa:fa-watch-fitness Monitoring Service) wa(fa:fa-cloud-sun Web API) end subgraph "Nodinite Agent Server A" ro1(fa:fa-monitor-waveform Monitoring Agent - IIS) end subgraph "Nodinite Agent Server B" ro2(fa:fa-monitor-waveform Monitoring Agent - Windows Service) end ro -->|"Portal agent port"| ro1 ro -->|"8000"| ro2 wa -->|"Portal agent port"| ro1 wa -->|"8000"| ro2 style ro fill:#93d16d style wa fill:#93d16d style ro1 fill:#2678BD,color:#fff style ro2 fill:#FFD525

Diagram: the Monitoring Service and the Web API (green; the Web API for Remote Actions, metrics, Remote Configuration, and diagnostics) call an IIS-hosted agent (blue) on the port set in the Portal and a Windows Service agent (yellow) on port 8000. No rule is needed when the agent runs on the Core Services Server.

How do I allow the service account to use the configured TCP port?

This section applies only to agents that run as Windows Services. IIS-hosted agents don't need URL ACL reservations.

Service accounts that are not local administrators need permission to use the port from the URL access control list.

Info

Local administrators already have the right to use any TCP port. If your account is a local admin and you still have issues, see the troubleshooting section below.

To display registered URLACLs, run this command from an elevated command prompt:

netsh http show urlacl

To remove a URL ACL:

netsh http delete urlacl url=http://+:8000/Nodinite/

Monitoring Agents URL Access Control List

Important

BREAKING CHANGE: If you run the Logic Apps Logging and Monitoring Agent with any other Nodinite agent as Windows Services, remove the wildcard reservation (netsh http delete urlacl url=http://+:8000/Nodinite/) and add a specific reservation for each agent and account, as in the table below.

Agent Command
Logic Apps Logging and Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/AzureLogicApps/ user=DOMAIN\ServiceAccount
Azure Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Agent/Monitor/Azure/ user=DOMAIN\ServiceAccount
BizTalk Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/BizTalk/ user=DOMAIN\ServiceAccount
Database Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/Database/ user=DOMAIN\ServiceAccount
Dynamics 365 Monitoring Agent (CRM) netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/DynamicsCRM/ user=DOMAIN\ServiceAccount
File Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/FileFolder/ user=DOMAIN\ServiceAccount
IBM DataPower Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/DataPower/ user=DOMAIN\ServiceAccount
IBM MQ Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/IBMMQ/ user=DOMAIN\ServiceAccount
Log File Parser Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/LogFileParser/ user=DOMAIN\ServiceAccount
Message Queuing Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/MessageQueue/ user=DOMAIN\ServiceAccount
Mule ESB Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/Mule/ user=DOMAIN\ServiceAccount
Non-Events Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/NonEvents/ user=DOMAIN\ServiceAccount
RabbitMQ Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/RabbitMQ/ user=DOMAIN\ServiceAccount
Web Services Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/WebServices/ user=DOMAIN\ServiceAccount
Windows Server Monitoring Agent netsh http add urlacl url=http://localhost:8000/Nodinite/Monitor/Agent/WindowsServer/ user=DOMAIN\ServiceAccount

Add the URL ACL on each Windows Server where agents run as Windows Services. For a gMSA service account, include the trailing $ in user=.

What firewall settings do I need?

Open the inbound port each agent listens on, from the Core Services Server to the Agent Server: the Portal port for IIS-hosted agents, and TCP 8000 (inbound) for Windows Service agents. Administrators can change port 8000 for a Windows Service agent, but it is not recommended. The full rule set per hop is in the Monitoring Service prerequisites.

For a Windows Service agent, the port is part of the endpoint address in the agent's configuration file, for example Nodinite.MonitorAgent.BizTalkHost.exe.config for the BizTalk Monitoring Agent:

<services>
  <service behaviourConfiguration="MonitorAgentBehavior" name="IM.MonitorAgent.BizTalk.ServiceApi">
    <endpoint address="http://localhost:8000/Nodinite/Monitor/Agent/BizTalk" binding="webHttpBinding" bindingConfiguration="MonitorAgentBinding" name="MonitorAgentEndPoint" contract="IM.MonitorAgent.BizTalk.Contracts.IBizTalkContract"/>
  </service>
</services>

<services>
  <service behaviourConfiguration="MonitorAgentBehavior" name="IM.MonitorAgent.BizTalk.ServiceApi">
    <endpoint address="http://localhost:8000/IM/Monitor/Agent/BizTalk" binding="webHttpBinding" bindingConfiguration="MonitorAgentBinding" name="MonitorAgentEndPoint" contract="IM.MonitorAgent.BizTalk.Contracts.IBizTalkContract"/>
  </service>
</services>

Note

If you change the port of an agent, update the Service URL on the agent's Connection tab so the Monitoring Service can reach it. When you update from v6, replace your port 8000 firewall rules with the Portal ports; see Updating from v6 to v7.

Troubleshooting

Service cannot start due to port restrictions

Startup problems for Windows Service agents are usually security or firewall related. Agents may also require specific 3rd party libraries to be installed before configuration.

A common issue is that the service account is not a local administrator and has no URL ACL reservation for the port. Add the reservation from the table above.

HTTP could not register URL http://+:8000/IM/Monitor/Agent/Servicename/. your process does not have access rights to this namespace (see https://go.microsoft.com/fwlink/?LinkId=70353 for details).

Exception example from the diagnostics log file.

Agent shows as unavailable

Check that the Service URL on the agent's Connection tab uses the port the agent actually listens on, that the port is open from the Core Services Server, and that the host name resolves (DNS).

Next Steps