- 9 minutes to read

Prerequisites for the Nodinite Log API

Understanding the Log API Architecture

The Nodinite Log API is a web application that receives Log Events from integration platforms and writes them to SQL Server databases. Before installing, understand how the components work together and what infrastructure you need.

Why These Prerequisites Matter

  • IIS hosting - The Log API runs as its own web site in Internet Information Services (IIS) and needs the IIS features and the .NET Hosting Bundle for Nodinite v7
  • MSDTC coordination - SQL Server distributed transactions use the Microsoft Distributed Transaction Coordinator (DTC) to keep data consistent across databases
  • Service account security - Unlike the Web Client, the Log API uses Anonymous Authentication to accept Log Events from external systems, but it accesses SQL Server as a Windows service account with specific SQL permissions
  • Firewall planning - Log Events arrive over HTTPS from integration platforms, and the Log API queries SQL Server using Windows authentication and DTC
  • High availability support - The Log API supports Always On Availability Groups (AOAG) and linked servers for enterprise deployments

The Log API is a web application hosted in IIS. You install and maintain it as part of the Nodinite Core Services package; its port, service account, and TLS certificate are set in the Nodinite Portal.

graph LR subgraph "Integration Platform" roLogSink[fal:fa-bolt Integration Flow Application] end subgraph "App Server" roLogSink2[fal:fa-bolt Custom Logging Solution ] end subgraph "Web Server" roLogAPI(fal:fa-cloud-arrow-down LogAPI) end subgraph "SQL Server" roSQL1(fal:fa-database Configuration Database) --- roSQL2(fal:fa-database Active Log Database) roLogSink --> | HTTPS | roLogAPI roLogAPI --> | SQL, DTC, DNS, RPC | roSQL1 roLogSink2 --> | HTTPS | roLogAPI end

Diagram: Log API architecture showing data flow from integration platforms to web server and SQL databases. Integration systems send Log Events over HTTPS to the Log API, which writes to the Configuration and Log Databases using SQL, DTC, DNS, and RPC protocols.

Verified Topic
IIS
MSDTC
Windows rights
Database rights
Firewall

Use the checklist above to verify that you have performed all steps required to get Nodinite a flying start.

IIS

The Log API is an IIS-hosted web application. In Nodinite v7 it runs on .NET 10 and ASP.NET Core, as its own IIS web site on the port you set in the Portal.

Key IIS Requirements

  • IIS Windows Features for Nodinite 7 - see IIS Windows Features
  • .NET 10 Hosting Bundle - includes the ASP.NET Core Module V2 that hosts the Log API in IIS
  • Anonymous Authentication - the Log API accepts Log Events without Windows credentials; the CLI sets this for you

IIS Windows Features - Complete feature list and installation guide
IIS Authentication settings - The supported authentication settings, if someone has changed them in IIS

Microsoft Distributed Transaction Coordinator (DTC)

The Log API takes part in SQL Server operations, and Nodinite uses the Windows Service Microsoft Distributed Transaction Coordinator (DTC) to coordinate transactions that span multiple resource managers. On Windows Server, configure the DTC Windows Service as documented; otherwise, Nodinite does not work correctly. See also the Nodinite Prerequisites.

What Windows rights does the Log API require?

The Nodinite Log API runs in an IIS application pool with a named service account. Unlike the Web Client and Web API, the Log API uses Anonymous Authentication (not Windows Authentication) because it accepts Log Events from various systems and applications. You choose the account in the Portal, under Step 4: Servers › Core platform services (or Same account for all Services, with defaults from Step 2: Auth › Service Account Defaults); the CLI configures the application pool with it.

Service Account Requirements

  • The service account must have Logon as a Service rights
  • If the service account is not a local administrator, it must be a member of the IIS_IUSRS group
  • The service account must have Read rights on the %windows%\system32\inetsrv\config folder (for redirection.config access)
  • A gMSA works as well, and needs no password

Important

If the service account is not assigned the sysadmin role, add it to the LogServiceUsers System Parameter. The Logging Service then grants the account the roles in LogAccessRoles on each new Log Database it creates, so the Log API can keep writing after a database split.

For the full rationale and fallback model when sysadmin is denied by policy, see SQL Server Sysadmin Requirements.

How It Works

The Log API application pool runs with the named Windows service account identity, and all calls to SQL Server are made as this identity. This gives secure, authenticated database access while external systems send Log Events without Windows credentials. The Log API finds the SQL Server through the SqlServer System Parameter in the Configuration Database.

IIS_IUSRS Group Membership - How to configure service accounts for least-privilege deployments

Tip

Troubleshooting permissions: If you encounter "Cannot read configuration file due to insufficient permissions" errors, ensure the service account has Read rights on %windows%\system32\inetsrv\config. See the IISConfigurationFile troubleshooting guide.

What SQL Rights does the Log API require?

For performance reasons, the Log API accesses the databases directly using the Windows Service Account configured for the Log API and must have the following SQL rights assigned:

Master

Grant VIEW SERVER STATE rights.

GRANT VIEW SERVER STATE TO [Domain\user]

Replace [Domain\user] with the Windows account being used for the Log API

If applicable, repeat the grant on all nodes part of an AOAG environment.

Nodinite Databases

Database Permission Description Microsoft Docs Link
Configuration Database db_datareader Grants read access to all tables and views db_datareader
Configuration Database db_datawriter Grants write access to all tables and views db_datawriter
Configuration Database db_ddladmin Allows running DDL statements (e.g., create/alter/drop objects) db_ddladmin
Configuration Database sysadmin/db_owner Required for certain administrative tasks (e.g., shrinking databases) sysadmin, db_owner
NodiniteLog_* db_datareader Grants read access to all tables and views db_datareader
NodiniteLog_* db_datawriter Grants write access to all tables and views db_datawriter
NodiniteLog_* db_ddladmin Allows running DDL statements (e.g., create/alter/drop objects) db_ddladmin
NodiniteLog_* sysadmin/db_owner Required for certain administrative tasks (e.g., shrinking databases) sysadmin, db_owner

This table lists the minimum SQL Server permissions required for the Nodinite Log API's Configuration Database and Log Databases. Ensure these grants are set for uninterrupted operation, maintenance, and automation.

Grant Execute rights on all existing and future stored procedures for the account used by the Log API:

GRANT EXECUTE TO [Domain\user]

Replace [Domain\user] with the Windows account being used for the Log API.

Important

db_ddladmin is required for the service account to have proper rights to read statistics. Without this permission, performance may be degraded, especially true for remote servers (linked servers). Read more in this article about linked server performance. Contact our support if you have any questions about this.

Tip

Review the following System Parameters: LogServiceUsers and LogAccessRoles

What Firewall settings are required for the Log API

The Log API accepts Log Events from systems outside Nodinite (integration platforms, custom applications, and the Pickup Service), so it is the Core Service whose port is most often opened to other networks. It writes to SQL Server and uses the domain controller for DNS and Kerberos; with OAuth 2.0 turned on, it also validates tokens from Microsoft Entra ID. The diagram shows each host, with the port on the arrow, drawn from the side that opens the connection.

graph LR subgraph "Log Event senders" roSender["fa:fa-bolt Integration platforms, applications, Pickup Service"] end subgraph "Nodinite Core Services Server" roLogAPI["fa:fa-cloud-arrow-down Log API - IIS"] end subgraph "SQL Server" roConfig["fa:fa-database Configuration Database"] roLogDB["fa:fa-database Active Log Database"] end subgraph "Domain Controller" roDC["fa:fa-server DNS, Kerberos, LDAP"] end subgraph "Microsoft Entra ID - OAuth only" roEntra["fab:fa-microsoft login.microsoftonline.com"] end roSender -->|"HTTPS, Log API port"| roLogAPI roLogAPI -->|"TCP 1433, MSDTC 135 + RPC"| roConfig roLogAPI -->|"TCP 1433, MSDTC 135 + RPC"| roLogDB roLogAPI -->|"53, 88, 389"| roDC roSender -.->|"HTTPS 443, get token"| roEntra roLogAPI -.->|"HTTPS 443, signing keys"| roEntra

Diagram: senders post Log Events to the Log API on its Portal port; the Log API writes to SQL Server and uses the domain controller. Dotted arrows apply only when OAuth 2.0 is turned on for the Log API.

Note

Ports are set per environment: on Windows Server, each Core Service is its own IIS web site with its own port, set in the Nodinite Portal under Step 4: Servers › Core platform services and listed in Step 6: Review and Download › Allocated ports. Ports in examples, such as 40002 in https://nodinite.contoso.com:40002/LogAPI/, are examples only. The CLI creates the IIS bindings, not the firewall rules.

Between the Log Event senders and the Log API

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Log Event sender (integration platform, application, Pickup Service) Core Services Server (Log API) TCP (HTTPS) Log API port Post Log Events over REST Set in the Portal; allow only the sender networks you need. See the Hardening guide
Outbound Log Event sender Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 Get a bearer token Only when Enable Authentication is set for the Log API; see Protect the Log API with OAuth 2.0 and Entra ID

Between the Log API and SQL Server

The SQL Server, MSDTC, and domain controller ports are shared by all Nodinite components; their full details live in SQL Server Firewall Configuration.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Log API) SQL Server (Configuration and Log Databases) TCP 1433 Write Log Events, read settings Default instance port; named instances and changed ports: Core Services to SQL Server
Outbound Core Services Server (Log API) SQL Server UDP 1434 SQL Server Browser Only for a named instance without a port in the connection string; see SQL Server Browser Service
Both Core Services Server (Log API) SQL Server TCP 135 + dynamic RPC range MSDTC distributed transactions Configure MSDTC on both servers; see Core Services to SQL Server

Between the Log API and the domain controller and Microsoft Entra ID

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Log API) Domain Controller (DNS server) TCP/UDP 53 DNS name resolution Resolve the SQL Server names; hosts-file entries are a fallback
Outbound Core Services Server (Log API) Domain Controller TCP/UDP 88, 389 Kerberos and LDAP for the service account's SQL Server sign-in See Domain Controller ports
Outbound Core Services Server (Log API) Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 Read the OpenID configuration and token signing keys Only when Enable Authentication is set; through the proxy set in Step 3: Infrastructure if you use one

What to get right

  • No fixed default port: the Log API port is whatever you set in the Portal; senders must use the full base URL, including the port. See Find the base URL.
  • Senders on other networks: open the Log API port only from the sender networks, and use HTTPS with a certificate the senders trust.
  • Versions: Nodinite v7 hosts the Log API on its own Portal port; update sender URLs and firewall rules when you move from an earlier version.
  • DNS (53): senders must resolve the Log API host name, and the Log API must resolve the SQL Server names.

Frequently asked questions

Additional solutions to common problems and the Nodinite Log API FAQ exist in the Troubleshooting user guide.

Can I secure the Log API?

Yes. Set the TLS host name and certificate in the Portal under Step 4: Servers › Core host Configuration, so the Log API is reachable over HTTPS, and review the Hardening guide. To also require an OAuth 2.0 bearer token on every Log Event, check Enable Authentication in Step 2: Auth › Log API; see Protect the Log API with OAuth 2.0 and Entra ID.

Note

Nodinite v6 is no longer supported. To move an existing v6 installation, follow Updating from v6 to v7.

Next Steps

Install Log API
IIS Windows Features
MSDTC

Core Services Package
Log API
Configuration Database
Log Databases
Hardening
SqlServer
LogServiceUsers
LogAccessRoles
IIS Authentication settings
SQL Server Firewall
Troubleshooting
Uninstall Log API
Update Log API