To ensure that the Application Real-Time Monitoring Service (ARMS) agent can run as expected, you must connect the ARMS agent to the ARMS server. This topic describes the ports, endpoints, and CIDR blocks that must be enabled to use Application Monitoring.
Agent version 3.x and later
Required destination ports
To use Application Real-Time Monitoring Service (ARMS), you must ensure network connectivity to the following destination ports. The agent requires access to these ports to function correctly.
Port | Description |
8080 | Provided by the Application Configuration Management (ACM) service for application configuration. |
8848 | Provided by the ACM service for application configuration. |
9990 | Provided by the call chain and metadata endpoint for metadata reporting. |
80 | Provided by the call chain and metadata endpoint, metric endpoint, continuous profiling service, and agent self-monitoring service. Used to report call chain data, metrics, continuous profiling data, and agent self-monitoring data. |
9092 | Provided by the call chain and metadata endpoint for the application diagnostics feature. |
9093 | Provided by the call chain and metadata endpoint for application security. |
Required domain names
To use ARMS, you must allow access to ARMS endpoints and ACM domain names. You can use the following table to find the correct domain names for your region. If your application is in an Alibaba Cloud Virtual Private Cloud (VPC), use the internal endpoints. This also applies to deployments connected to a VPC through a leased line. If your application is in an on-premises data center or on another cloud, use the public endpoints.
Expand to view ARMS and ACM service domain names by region
The domain name end-side-logs-{region}.{region}.log.aliyuncs.com in the table is the Simple Log Service (SLS) reporting channel for agent self-monitoring logs. After you connect to Application Monitoring, the agent uses this address to report its operational logs to SLS. You must ensure that this domain name is accessible.
You can use the Curl command to test network connectivity between the destination host and the ARMS and ACM endpoints. For example, to test connectivity in the China (Hangzhou) region, log on to the machine where your application is deployed and run the following commands:
#Test the call chain & metadata endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com/api/checkHealth
#Test the metadata endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com:9990/api/checkHealth
#Test the metric endpoint. A return code of 200 indicates a successful connection.
curl -I -w "%{http_code}" http://cn-hangzhou.arms.aliyuncs.com/health/readinessSome regions do not provide an internal ACM service. In these cases, use the public ACM domain name. Your application must be able to access the public network.
By default, the ARMS agent automatically detects the network environment. It prioritizes internal endpoints for data reporting. If the internal network is unreachable, it uses public endpoints.
Required IP CIDR blocks
If your application is deployed in an Alibaba Cloud VPC, which includes scenarios where a leased line connects to a VPC, you must ensure that the internal domain names are reachable and allow access to the internal CIDR blocks for each service. If your application is deployed in an on-premises data center or on another cloud, ARMS does not provide the CIDR block details for public endpoints. In this case, you must ensure that the public domain names are reachable.
Required IP addresses for the ACM engine
The ARMS agent connects to the ACM DPI engine to obtain configuration information. The IP addresses of the ACM DPI engine are static. You can obtain these IP addresses using the ACM domain name for your region to access the ACM HTTP interface.
curl 'acm.aliyun.com:8080/diamond-server/diamond'You must ensure that your firewall allows access to the ACM DPI engine IP addresses that you obtained from the curl command. You can use the following command to verify access.
curl -X GET "http://139.196.XX.XX:8080/diamond-server/config.co?dataId=com.ali.art.logicregion.flow.control.icbu&group=art-control-service" -iIf the query returns no content, the address is not accessible.
Agent V2.x
Required destination ports
To connect to Application Real-Time Monitoring Service (ARMS), you must ensure network connectivity to the following destination ports. This allows the agent to work correctly.
Port | Description |
8080 | Provided by the Application Configuration Management (ACM) service for application configuration. |
8442 | Provided by the ARMS endpoint for reporting metadata. |
8443 | Provided by the ARMS endpoint for reporting statistical data. |
8883 | Provided by the ARMS endpoint for reporting detailed data. |
8848 | Provided by the ARMS endpoint for reporting microservice-related data. |
9092 | Provided by the ARMS endpoint for the application diagnostics feature. |
9093 | Provided by the ARMS endpoint for application security. |
Required domain names
To connect to ARMS, you must allow access to the ARMS and ACM endpoint domain names. The following table lists the ARMS and ACM endpoint domain names for each region. If your application is deployed in an Alibaba Cloud Virtual Private Cloud (VPC), including scenarios where a leased line connects to the VPC, use the internal ARMS endpoint and the internal ACM domain name. If your application is deployed in an on-premises data center or on another cloud platform, use the public ARMS endpoint and the public ACM domain name.
Expand to view ARMS and ACM network domain names for each region
You can use the Telnet command to test the network connectivity between the destination host and the ARMS endpoint and the ACM service. For example, to test network connectivity for the China (Hangzhou) region, log on to the machine where your application is deployed and run the following commands:
telnet arms-dc-hz-internal.aliyuncs.com 8442
telnet arms-dc-hz-internal.aliyuncs.com 8443
telnet arms-dc-hz-internal.aliyuncs.com 8883
telnet arms-dc-hz-internal.aliyuncs.com 9092
telnet arms-dc-hz-internal.aliyuncs.com 9093
telnet addr-hz-internal.edas.aliyun.com 8080Some regions do not provide an internal ACM service. In these cases, use the public ACM domain name. Your application must be able to access the public network.
Required IP CIDR blocks
If your application is deployed in an Alibaba Cloud VPC, including scenarios where a leased line connects to the VPC, you must ensure internal domain name connectivity and allow access to the internal CIDR blocks for each service. If your application is deployed in an on-premises data center or on another cloud platform, ARMS does not provide the CIDR block details for public endpoints. In this case, you must ensure public domain name connectivity.
Required ACM engine IP addresses
The ARMS agent needs to connect to the ACM engine to retrieve configuration information. You can obtain the IP address of the ACM engine using the HTTP API provided by ACM. This IP address is static. First, query the IP address of the ACM engine based on the ACM domain name for your region.
curl 'acm.aliyun.com:8080/diamond-server/diamond'Ensure that your firewall allows the ACM engine IP address that you obtained using the curl command. You can use the following command to verify this.
curl -X GET "http://139.196.XX.XX:8080/diamond-server/config.co?dataId=com.ali.art.logicregion.flow.control.icbu&group=art-control-service" -iIf the query returns no content, the service is inaccessible.
Reference
For more information about the network, see Network.