Prerequisites for the Pickup LogEvents Service Logging Agent

Get ready for a seamless, high-performance logging experience with the Nodinite Pickup Log Events Service Logging Agent. This page provides everything you need to prepare your environment for secure, reliable, and scalable integration—whether on-premises or in the cloud.

On this page, you will learn how to:

• ✅ Ensure your environment meets all software and platform requirements
• ✅ Configure user rights and firewall settings for secure operation
• ✅ Optimize for high-performance, on-premises or cloud deployments
• ✅ Apply best practices for integrating with message brokers, databases, and file systems

The diagram above illustrates the supported logging options and how the Pickup LogEvents Service Logging Agent integrates With Nodinite, message brokers, file systems, and databases.

You can install this agent on-premises using TCP/IP for local network access or in the cloud/off-site using Service Bus Relaying. As long as the Log API is accessible on the configured port, you can deploy flexibly. For high-performance installations, install the agent close to the database (ideally on the same network as Nodinite).

We recommend installing this agent near the Nodinite Core Services. This documentation covers local network setup (usually on the Nodinite server).

Software Requirements

Versions 7.0.4 and later require .NET 10 Hosting Bundle. .NET 10 minimum OS: Windows Server 2012 / 2012 R2.

Platform Requirements

Versions 6.0 - 7.0.3 require .NET Framework 4.8 or later.
Versions 5.4 and later require .NET Framework 4.6.2 or later.
Versions before 5.4 require .NET Framework 4.5.2 or later.

Message Queue Systems (Software Requirements)

Azure Services

Database Systems (Software Requirements)

Source System User Rights

The Pickup Service requires specific permissions on each source system. Configure credentials and permissions according to your source type:

Message Queue Systems (User Rights)

ActiveMQ - Basic authentication with Admin rights (ActiveMQ security)

AMQP - Basic authentication with Admin rights

Anypoint MQ - Basic auth or Connected Apps with Admin rights (AnypointMQ security)

MSMQ - Integrated Windows security: Peek, Read, Delete permissions

Azure Cloud Services

Azure Service Bus - Either SAS token connection string with Manage + Listen claims OR App Registration with Service Bus Data Receiver + Sender roles

Azure Event Hub - Either SAS token connection string with Manage + Listen claims OR App Registration with Azure Event Hubs Data Receiver + Sender roles; Storage account requires connection string or App Registration with Blob Data Reader/Contributor role

Azure Blob Storage - Either storage account connection string or SAS tokens with blob read/write permissions OR App Registration with Storage Blob Data Reader/Contributor role

File Systems

File Shares - Integrated Windows security: Read, Write, Delete permissions on SMB shares

Database Systems (User Rights)

PostgreSQL - Database user with SELECT, INSERT, UPDATE, DELETE on log event tables

SQL Server - Database user with:

• public - logon rights
• db_datareader - read access
• db_datawriter - write access
• db_ddladmin - better performance (optional)

Tip

For connection string examples and authentication options, see the comprehensive SQL Connection Strings guide.

For detailed configuration including connection strings and authentication examples, see the specific Configuration guides for each source type.

Supported Versions

Cloud technologies evolve rapidly. Nodinite always supports currently supported Microsoft API versions. Update Nodinite and the Pickup Log Events Service Logging Agent as needed.

What Windows User Rights does the Pickup LogEvents Service Logging Agent require?

The agent is installed as a Windows Service, usually on the Nodinite application server. Virtual machines are supported.

Service Account Options

^{New 7.0.4}

Group Managed Service Account (gMSA) - Recommended for automated password management.

• No password expiration or manual rotation
• Enhanced security with automatic 240-character passwords
• Simplified management across multiple servers
• See Configure Group Managed Service Accounts (gMSA) for setup instructions

Traditional Account - Local named account or domain account (preferred).

• Requires manual password management
• Follow the 'How to set logon as a Windows service right' user guide for detailed instructions

What Nodinite SQL user rights does the Pickup LogEvents Service Logging Agent require?

If you are bypassing the Log API for performance reasons (the only valid reason), then the account running the Nodinite Pickup Log Events Service Logging Agent must have the following rights assigned:

Important

db_ddladmin is required for the service account to have proper rights to read statistics. Without this permission, performance may be degraded, especially for remote servers (linked servers). Read more in Microsoft's documentation.

Configuration Database Permissions

The Configuration Database requires:

• db_datareader
• db_datawriter
• db_ddladmin
• Execute rights on all existing and future stored procedures:

GRANT EXECUTE TO [Domain\user]

Replace [Domain\user] with the Windows account used for the Nodinite Pickup Log Events Service Logging Agent.

Tip

For detailed connection string configuration including Windows Authentication, SQL Authentication, and encryption settings, see SQL Connection Strings.

Log Database Permissions

All Log Databases (can be multiple) require:

• db_datareader
• db_datawriter
• db_ddladmin

Firewall Requirements

Where you install the Nodinite Pickup Log Events Service Logging Agent in relation to the Nodinite Core Services and your log sources determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection. The agent only ever pulls from the sources, so each source needs one outbound rule from the Agent Server.

Network diagram: the Monitoring Service manages the agent, the agent pulls Log Events from each configured source and posts them to the Log API (or, for high performance, writes directly to the Nodinite databases). Open only the source hops you use. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical installation), you need no firewall rule between the Monitoring Service or the Log API and the agent. Modern firewalls are stateful and allow response traffic for established outbound connections automatically.

Between the Monitoring Service and the Pickup Service

From Nodinite v7, the agent is a Monitoring Agent with Remote Configuration: the Monitoring Service opens every connection to it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step). Earlier versions use a local settings.json file and need no rule for this hop.

Option: Service Bus Relaying (cloud or hybrid)

Use Service Bus Relayed connections when Nodinite and the agent are on different networks. Both sides connect outbound to the Azure Relay namespace, so neither server needs an inbound rule; see the 'Azure Relay FAQs'. The agent still needs its own route to the Log API.

Between the Pickup Service and the Log API

Required in every installation, except for sources where you bypass the Log API (see the next hop).

Performance Tip: When the Pickup Service and Log API are on the same server, use HTTP for better performance.

Between the Pickup Service and the Nodinite databases

Required only when you bypass the Log API for performance (see Nodinite SQL user rights). See also SQL Server Firewall Configuration.

Between the Pickup Service and message brokers

Between the Pickup Service and Azure

Outbound only; allow the hostnames below, or the Pickup Server's public IP in the Azure resource firewall (see Configure Azure Storage firewalls).

Between the Pickup Service and Anypoint MQ

Between the Pickup Service and source databases

Between the Pickup Service and file shares

Between the Pickup Service and the Domain Controller

Required for Windows authentication: SMB shares, MSMQ, and SQL Server with Integrated Security, or a domain/gMSA service account.

RPC Dynamic Ports: MSMQ and other RPC-based traffic use dynamic port allocation. Review Configure RPC dynamic port allocation.

Between the servers and DNS

Tip

For detailed troubleshooting, see SQL Server Firewall Configuration and Azure Event Hubs Troubleshooting.

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. Add inbound rules only where stateful inspection is disabled or restricted.

Frequently Asked Questions

Find additional solutions to common problems and the FAQ for the Nodinite Pickup Log Events Service Logging Agent in the Troubleshooting user guide.

Make sure to subscribe to our Release Notes.

Next Steps

• Install the Pickup LogEvents Service Logging Agent

Related Topics

• Administration