Prerequisites for the File and FTP Monitoring Agent

Prepare your environment for seamless, secure file-based integration monitoring with Nodinite. This page details all prerequisites for installing and running the File and FTP Monitoring Agent, including software, user rights, firewall, and network configuration.

✅ Clear software and OS requirements
✅ Step-by-step user rights and firewall setup
✅ PowerShell scripts for fast configuration
✅ Network and security best practices

This page describes the prerequisites to successfully install and run the Nodinite File Monitoring Agent to achieve MFT Monitoring.

This diagram shows how the Nodinite File and FTP Monitoring Agent connects to various file-based resources across your environment.

Instances of this agent can be installed on-premise using TCP/IP for local network access and/or in the cloud/off-site using Service Bus Relaying (see also the external link for additional information 'Azure Relay FAQs').

We recommend that you keep this agent close to the Nodinite Core Services. This documentation covers local network setup (usually on the Nodinite application server)

Software Requirements

Versions 6.0 and later make use of the .NET Framework 4.8 or later.
Versions 5.4 and subsequently make use of the .NET Framework 4.6.2 or later.
Versions before 5.4 make use of the .NET Framework 4.5.2 or later.

 Install-WindowsFeature RSAT-DFS-Mgmt-Con

What Windows User Rights does the File and FTP Monitoring agent require?

The agent is installed as a Windows Service usually on the Nodinite application server. Virtual machines are supported.

• Local named account or domain account (preferred).
• Access and run-time rights.
  • Follow the 'How to set logon as a Windows service right' user guide for detailed instructions.

For each Folder being monitored you may need to provide alternate credentials, review the Configuration user guide for additional details.

least privileges (basic usage)

• Read permission to the folder where to check for files (and all its child folders if the 'Include child folders' option is checked)
• Folders (SMB)
• Folders (NFS)
• FTP
• SFTP

What Firewall settings are required for the File and FTP Monitoring agent?

Where you install the Nodinite File Monitoring Agent in relation to the Nodinite Monitoring Service and your file servers determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection.

Network diagram: the Monitoring Service calls the agent, and the agent connects to each file server you monitor. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical installation), you need no firewall rule between the Monitoring Service and the agent. The exact ports to the file servers depend on your policies and server configuration.

Between the Monitoring Service and the File and FTP Monitoring Agent

The Monitoring Service opens every connection; the agent never calls it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step).

Option: Service Bus Relaying (cloud or hybrid)

Use Service Bus Relayed connections when Nodinite and the agent are on different networks. Both sides connect outbound to the Azure Relay namespace, so neither server needs an inbound rule. Nodinite uses the same principle as the on-premises data gateway; see 'Adjust communication settings for the on-premises data gateway' and the 'Azure Relay FAQs'.

Between the File and FTP Monitoring Agent and SMB file shares

Required for Folders (SMB) on Windows file shares, Samba, and DFS.

Tip

DFS Shares: Distributed File System (DFS) shares use the same SMB ports. Allow connectivity to every DFS namespace server and folder target.

Between the File and FTP Monitoring Agent and FTP / FTPS servers

Required for FTP monitoring. Use Passive Mode where you can: the agent then opens both the control and the data connections (outbound only).

Between the File and FTP Monitoring Agent and SFTP servers

Required for SFTP monitoring. SFTP runs inside one SSH connection, so it needs a single port.

Tip

SSH Key Authentication: When you use SSH keys, add the agent's public key to the SFTP server's ~/.ssh/authorized_keys file for the monitoring user account.

Between the File and FTP Monitoring Agent and NFS servers

Required for Folders (NFS) on Linux/UNIX or Windows Server for NFS.

Tip

NFS Dynamic Ports: mountd, statd, and lockd often get dynamic ports from the RPC Portmapper (port 111). Configure your NFS server to use static ports for these services to keep firewall rules simple, or use NFS v4 (port 2049 only).

NFS PowerShell Script Example

# Open required firewall ports for NFS
$ports = @(111, 2049)
foreach ($port in $ports) {
    New-NetFirewallRule -DisplayName "Allow NFS Port $port" -Direction Inbound -Action Allow -Protocol TCP -LocalPort $port -Profile Any -Verbose
    New-NetFirewallRule -DisplayName "Allow NFS Port $port (UDP)" -Direction Inbound -Action Allow -Protocol UDP -LocalPort $port -Profile Any -Verbose
}
# Set static ports for NFS services to avoid dynamic assignment

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc" -Name "InternetPorts" -Value 2049 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc" -Name "InternetAvailable" -Value 1 -Type DWord

# Restart NFS and RPC services
Restart-Service -Name "RpcEptMapper"
Restart-Service -Name "NfsService"

Write-Host "NFS Ports have been configured and firewall rules applied."

Run netstat -ano | findstr :2049 on the NFS server to check that NFS is listening, and Test-NetConnection -ComputerName <NFS_SERVER> -Port 2049 on the Agent Server to verify connectivity.

Between the File and FTP Monitoring Agent and the Domain Controller

Required when the agent's service account, or the alternate credentials of a monitored folder, is a domain account (SMB and DFS shares).

Between the servers and DNS

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. The inbound response rules above are for reference and troubleshooting.

Next Steps

Add or manage Monitoring Agent
Install File Monitoring Agent

Related Topics

Monitoring
Administration