The Application Real-Time Monitoring Service (ARMS) agent communicates with multiple backend services to report traces, metrics, profiling data, and configuration updates. To function correctly, the agent must reach these services over the network.
The following sections list the ports, domain names, and IP addresses required by the agent, organized by probe version.
Before you begin
Determine which network path applies to your deployment:
VPC or leased-line connection to Alibaba Cloud: Use internal endpoints. Internal endpoints keep traffic within the Alibaba Cloud backbone network.
On-premises data center or another cloud provider: Use public endpoints. Make sure your application has internet access.
By default, the ARMS agent automatically detects the network status and prioritizes internal endpoints for data reporting. If the internal network is unavailable, the agent uses public endpoints to report data.
Probe version 3.x and later
Required ports
Open the following destination ports on your firewall or security group:
| Port | Service | Purpose |
|---|---|---|
| 80 | Trace and metadata endpoint, metric endpoint, continuous profiling, probe self-monitoring | Reports trace, metric, continuous profiling, and self-monitoring data |
| 8080 | Application Configuration Management (ACM) | Retrieves application configuration |
| 8848 | ACM | Retrieves application configuration |
| 9990 | Trace and metadata endpoint | Reports metadata |
| 9092 | Trace and metadata endpoint | Application diagnostics |
| 9093 | Trace and metadata endpoint | Application security |
Required domain names
Each region exposes five endpoint types. Allow all five for your region:
| Endpoint type | Purpose |
|---|---|
| Trace and metadata endpoint | Reports traces, metadata, diagnostics, and security data |
| Metric endpoint | Reports metric data |
| Continuous profiling service | Uploads profiling data to OSS |
| ACM service | Retrieves agent configuration |
| Probe self-monitoring (log reporting) | Reports agent health logs to SLS |
Click to expand domain names for China regions
Click to expand domain names for international regions
Verify connectivity
Run the following commands from the machine where your application is deployed. Replace the domain names with the endpoints for your region.
The following example tests connectivity in the China (Hangzhou) region:
# Test the trace and metadata endpoint (port 80). HTTP 200 = success.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com/api/checkHealth
# Test the trace and metadata endpoint (port 9990). HTTP 200 = success.
curl -I -w "%{http_code}" http://arms-dc-hz.aliyuncs.com:9990/api/checkHealth
# Test the metric endpoint. HTTP 200 = success.
curl -I -w "%{http_code}" http://cn-hangzhou.arms.aliyuncs.com/health/readinessRequired IP address ranges
VPC or leased-line deployments: Make sure you have connectivity to internal domain names and allow access to the internal CIDR blocks for each service.
On-premises or other cloud deployments: ARMS does not publish CIDR block details for public endpoints. Make sure you have connectivity to the public domain names listed above.
Retrieve ACM DPI engine IP addresses
The ARMS agent connects to the ACM DPI engine to retrieve configuration data. The DPI engine uses static IP addresses that you can query through an HTTP interface.
Query the DPI engine IP addresses for your region:
curl 'acm.aliyun.com:8080/diamond-server/diamond'Add the returned IP addresses to your firewall allowlist.
Verify connectivity to a returned IP address: Replace
<returned-ip>with an IP address from step 1. If no content is returned, the connection failed.curl -X GET "http://<returned-ip>:8080/diamond-server/config.co?dataId=com.ali.art.logicregion.flow.control.icbu&group=art-control-service" -i
Probe version 2.x
Required ports
Open the following destination ports on your firewall or security group:
| Port | Service | Purpose |
|---|---|---|
| 8080 | ACM | Application configuration |
| 8442 | ARMS endpoint | Metadata reporting |
| 8443 | ARMS endpoint | Statistics reporting |
| 8883 | ARMS endpoint | Detailed data reporting |
| 8848 | ARMS endpoint | Microservice-related data reporting |
| 9092 | ARMS endpoint | Application diagnostics |
| 9093 | ARMS endpoint | Application security |
Required domain names
Version 2.x agents connect to two endpoint types per region:
| Endpoint type | Purpose |
|---|---|
| ARMS endpoint | Reports all monitoring data (traces, metrics, diagnostics, security) |
| ACM service | Retrieves agent configuration |
Click to expand domain names for China regions
Click to expand domain names for international regions
Verify connectivity
Run the following telnet commands from the machine where your application is deployed. Replace the domain names with the endpoints for your region.
The following example tests connectivity to internal endpoints in the China (Hangzhou) region:
telnet arms-dc-hz-internal.aliyuncs.com 8442
telnet arms-dc-hz-internal.aliyuncs.com 8443
telnet arms-dc-hz-internal.aliyuncs.com 8883
telnet arms-dc-hz-internal.aliyuncs.com 9092
telnet arms-dc-hz-internal.aliyuncs.com 9093
telnet addr-hz-internal.edas.aliyun.com 8080Required IP address ranges
VPC or leased-line deployments: Make sure you have connectivity to internal domain names and allow access to the internal CIDR blocks for each service.
On-premises or other cloud deployments: ARMS does not publish CIDR block details for public endpoints. Make sure you have connectivity to the public domain names listed above.
Retrieve ACM DPI engine IP addresses
The retrieval process is the same as for probe version 3.x. See Retrieve ACM DPI engine IP addresses in the version 3.x section.