If your host has a firewall or your Elastic Compute Service (ECS) instance uses a security group, add the IP addresses and ports of CloudMonitor servers to the outbound whitelist. This allows the CloudMonitor agent to send heartbeat and monitoring data to the CloudMonitor backend.
Prerequisites
Run the CloudMonitor agent under an administrator account:
Linux: Log in as the
rootuser.Windows: Log in as the
Administratoruser.
Running under an administrator account carries security risks. Follow your organization's security policies before proceeding.
Network requirements summary
All whitelist rules in this document are outbound rules. The following table lists all firewall rules required for the CloudMonitor agent.
|
Data type |
Network |
Endpoint |
Example |
Ports |
Purpose |
Resolution method |
|
Heartbeat |
Any |
|
— |
|
Agent liveness check |
|
|
Monitoring |
VPC |
|
|
|
Upload monitoring data via VPC |
|
|
Monitoring |
Internet |
|
|
|
Upload monitoring data via Internet |
|
|
Metadata |
VPC only |
|
— |
|
Retrieve instance metadata (region ID, etc.) |
CIDR block (no resolution needed) |
Procedure
Step 1: Allow heartbeat traffic
The CloudMonitor agent sends heartbeat data to cms-cloudmonitor.aliyun.com on ports 8080 and 3128.
Resolve the server IP addresses by running one of the following commands on your host:
nslookup cms-cloudmonitor.aliyun.comor
ping cms-cloudmonitor.aliyun.comAdd the resolved IP addresses and ports 8080 and 3128 to the outbound whitelist of your firewall.
Step 2: Allow monitoring data traffic
The CloudMonitor agent reports monitoring data on ports 80 and 443. The endpoint depends on whether your host reports data over a virtual private cloud (VPC) or over the Internet.
Report data over a VPC
If your host reports data through a VPC, the endpoint follows this pattern:
metrichub-<regionid>.aliyun.comReplace <regionid> with the region ID of your Alibaba Cloud host. To find the region ID, run:
curl http://100.100.100.200/latest/meta-data/region-idResolve the endpoint IP addresses:
nslookup metrichub-<regionid>.aliyun.comAdd the resolved IP addresses and ports 80 and 443 to the outbound whitelist of your firewall.
Also add CIDR block 100.100.0.0/16 with port range 0-65535 to the outbound whitelist. This CIDR block is used to retrieve instance metadata such as the region ID.
Report data over the Internet
If your host reports data over the Internet, the endpoint follows this pattern:
metrichub-cms-<regionid>.aliyuncs.comWhen reporting over the Internet, set <regionid> to one of the following values: cn-hangzhou, cn-shanghai, cn-beijing, or cn-shenzhen.
Resolve the endpoint IP addresses:
nslookup metrichub-cms-<regionid>.aliyuncs.comAdd the resolved IP addresses and ports 80 and 443 to the outbound whitelist of your firewall.
Non-Alibaba Cloud hosts
If your host is not provided by Alibaba Cloud, use port 443 to report monitoring data and heartbeats over the Internet.