If your host has a firewall or your Elastic Compute Service (ECS) instance uses a security group, you must add the IP addresses and ports of CloudMonitor servers to the outbound whitelist. This allows the CloudMonitor agent on your host to send heartbeat and monitoring data to the CloudMonitor backend.
Prerequisites
You must manage the CloudMonitor agent with an administrator account:
Linux: Log in as the
rootuser.Windows: Log in as the
Administratoruser.
Running under an administrator account carries inherent risks to system stability and data security. Exercise caution and follow your organization's security policies.
Network requirements summary
The following table lists all firewall rules required for the CloudMonitor agent:
| Data type | Network | Endpoint | Ports | Resolution method |
|---|---|---|---|---|
| Heartbeat | Any | cms-cloudmonitor.aliyun.com | 8080, 3128 | nslookup or ping |
| Monitoring | VPC | metrichub-<regionid>.aliyun.com | 80, 443 | nslookup |
| Monitoring | Internet | metrichub-cms-<regionid>.aliyuncs.com | 80, 443 | nslookup |
| Metadata | VPC only | 100.100.0.0/16 | 0-65535 | CIDR block (no resolution needed) |
Procedure
Step 1: Allow heartbeat traffic
The CloudMonitor agent sends heartbeat data to cms-cloudmonitor.aliyun.com on ports 8080 and 3128.
Resolve the server IP addresses by running either of the following commands on your host:
nslookup cms-cloudmonitor.aliyun.comor
ping cms-cloudmonitor.aliyun.comAdd the resolved IP addresses and ports 8080 and 3128 to the outbound whitelist of your firewall.
Step 2: Allow monitoring data traffic
The CloudMonitor agent reports monitoring data on ports 80 and 443. The endpoint depends on whether your host reports data over a virtual private cloud (VPC) or over the Internet.
Report data over a VPC
If your host reports data through a VPC, the endpoint follows this pattern:
metrichub-<regionid>.aliyun.comReplace <regionid> with the region ID of your Alibaba Cloud host. To find the region ID, run:
curl http://100.100.100.200/latest/meta-data/region-idThen resolve the endpoint IP addresses:
nslookup metrichub-<regionid>.aliyun.comAdd the resolved IP addresses and ports 80 and 443 to the outbound whitelist of your firewall.
You must also add CIDR block 100.100.0.0/16 with port range 0-65535 to the outbound whitelist. This CIDR block is used to retrieve instance-related information such as the region ID.
Report data over the Internet
If your host reports data over the Internet, the endpoint follows this pattern:
metrichub-cms-<regionid>.aliyuncs.comWhen reporting over the Internet, set <regionid> to one of the following values: cn-hangzhou, cn-shanghai, cn-beijing, or cn-shenzhen.
Resolve the endpoint IP addresses:
nslookup metrichub-cms-<regionid>.aliyuncs.comAdd the resolved IP addresses and ports 80 and 443 to the outbound whitelist of your firewall.
Non-Alibaba Cloud hosts
If your host is not provided by Alibaba Cloud, you can use port 443 to report data over the Internet and to monitor the heartbeats of the CloudMonitor agent.