The Application Real-Time Monitoring Service (ARMS) agent requires connectivity to the ARMS server to function correctly. This topic describes the ports, domain names, and IP addresses that must be accessible for Application Monitoring.
Probes of versions 3.x and later
Required destination ports
To use ARMS Application Monitoring, you must ensure that the following destination ports are accessible to the agent.
Port | Description |
8080 | Provided by the Application Configuration Management (ACM) service for application configuration. |
8848 | Provided by the ACM service for application configuration. |
9990 | Provided by the trace and metadata endpoint for metadata reporting. |
80 | Provided by the trace and metadata endpoint, metric endpoint, continuous profiling service, and probe self-monitoring service. Used to report trace, metric, continuous profiling, and probe self-monitoring data. |
9092 | Provided by the trace and metadata endpoint for application diagnostics. |
9093 | Provided by the trace and metadata endpoint for application security. |
Required domain names
To use ARMS Application Monitoring, you must allow access to the ARMS endpoints and Application Configuration Management (ACM) domain names. The following table lists the ARMS endpoints and ACM domain names for each region. If your application is deployed in an Alibaba Cloud Virtual Private Cloud (VPC), including in scenarios where a leased line connects to an Alibaba Cloud VPC, use the ARMS internal endpoints and internal ACM domain names. If your application is deployed in an on-premises data center or on another cloud, use the ARMS public endpoints and public ACM domain names.
Click to view ARMS and ACM service network domain names for each region
You can use the Curl command to test the network connectivity between the destination host and the ARMS endpoint and ACM service. For example, to test the connectivity in the China (Hangzhou) region, log on to the machine where your application is deployed and run the following commands:
# Test the trace and metadata endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com/api/checkHealth
# Test the metadata endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com:9990/api/checkHealth
# Test the metric endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://cn-hangzhou.arms.aliyuncs.com/health/readinessSome regions do not provide an internal ACM service. In these regions, you must use the public ACM domain name, which requires your application to have Internet access.
By default, the ARMS agent automatically detects the network status and prioritizes internal endpoints for data reporting. If the internal network is unavailable, the agent uses public endpoints to report data.
Required IP address ranges
If your application is deployed in an Alibaba Cloud VPC, including in scenarios where a leased line connects to an Alibaba Cloud VPC, you must ensure connectivity to the internal domain names and allow access to the internal CIDR blocks for each service. If your application is deployed in an on-premises data center or on another cloud, ARMS does not provide the CIDR block details for public endpoints. In this case, you must ensure connectivity to the public domain names.
Required ACM DPI engine IP addresses
The ARMS agent needs to connect to the ACM DPI engine to obtain configuration information. The IP addresses of the ACM DPI engine are static and can be retrieved by accessing the HTTP interface that is provided by ACM. To retrieve the IP addresses, query them based on the ACM domain name of the corresponding region.
curl 'acm.aliyun.com:8080/diamond-server/diamond'You must configure your firewall to allow the ACM DPI engine IP addresses that are returned by the curl command. You can run the following command to verify the connectivity.
curl -X GET "http://139.196.XX.XX:8080/diamond-server/config.co?dataId=com.ali.art.logicregion.flow.control.icbu&group=art-control-service" -iIf no content is returned, the access failed.
Probe version 2.x
Required destination ports
To use ARMS Application Monitoring, you must ensure that the following destination ports are accessible to the agent.
Port | Description |
8080 | Provided by the ACM service for application configuration. |
8442 | Provided by the ARMS endpoint for metadata reporting. |
8443 | Provided by the ARMS endpoint for statistics reporting. |
8883 | Provided by the ARMS endpoint for detailed data reporting. |
8848 | Provided by the ARMS endpoint for microservice-related data reporting. |
9092 | Provided by the ARMS endpoint for application diagnostics. |
9093 | Provided by the ARMS endpoint for application security. |
Required domain names
To use ARMS Application Monitoring, you must allow access to the ARMS endpoints and ACM domain names. The following table lists the ARMS endpoints and ACM domain names for each region. If your application is deployed in an Alibaba Cloud VPC, including in scenarios where a leased line connects to an Alibaba Cloud VPC, use the ARMS internal endpoints and internal ACM domain names. If your application is deployed in an on-premises data center or on another cloud, use the ARMS public endpoints and public ACM domain names.
Click to view ARMS and ACM network domain names for each region
You can use the Telnet command to test the network connectivity between the destination host and the ARMS endpoint and ACM service. For example, to test the connectivity in the China (Hangzhou) region, log on to the machine where your application is deployed and run the following commands:
telnet arms-dc-hz-internal.aliyuncs.com 8442
telnet arms-dc-hz-internal.aliyuncs.com 8443
telnet arms-dc-hz-internal.aliyuncs.com 8883
telnet arms-dc-hz-internal.aliyuncs.com 9092
telnet arms-dc-hz-internal.aliyuncs.com 9093
telnet addr-hz-internal.edas.aliyun.com 8080Some regions do not provide an internal ACM service. In these regions, you must use the public ACM domain name, which requires your application to have Internet access.
Required IP address ranges
If your application is deployed in an Alibaba Cloud VPC, including in scenarios where a leased line connects to an Alibaba Cloud VPC, you must ensure connectivity to the internal domain names and allow access to the internal CIDR blocks for each service. If your application is deployed in an on-premises data center or on another cloud, ARMS does not provide the CIDR block details for public endpoints. In this case, you must ensure connectivity to the public domain names.
Required ACM DPI engine IP addresses
The ARMS agent needs to connect to the ACM DPI engine to obtain configuration information. The IP addresses of the ACM DPI engine are static and can be retrieved by accessing the HTTP interface that is provided by ACM. To retrieve the IP addresses, query them based on the ACM domain name of the corresponding region.
curl 'acm.aliyun.com:8080/diamond-server/diamond'You must configure your firewall to allow the ACM DPI engine IP addresses that are returned by the curl command. You can run the following command to verify the connectivity.
curl -X GET "http://139.196.XX.XX:8080/diamond-server/config.co?dataId=com.ali.art.logicregion.flow.control.icbu&group=art-control-service" -iIf no content is returned, the access failed.
References
For more information about networking issues, see Networking.