- 10 minutes to read

Release Notes

Prerequisites for the Microsoft BizTalk Server Monitoring Agent

This page details the prerequisites for installing and running the Nodinite Microsoft BizTalk Server Monitoring Agent to Monitor BizTalk Server Applications.

graph LR subgraph "Nodinite Instance" roMonitoringService(fal:fa-watch-fitness Monitoring Service) end subgraph "BizTalk Group - PROD" roMonitoringService --> roNI roNI(fal:fa-monitor-waveform BizTalk Server Monitoring Agent) --> roBT(fal:fa-server Any BizTalk node ) end subgraph "BizTalk SQL Instances" roNI --> roBTMgmtDB(fal:fa-database BizTalkMgmtDb) roNI --> roBTmsgboxDB(fal:fa-database BizTalkMsgboxDb) roNI --> roBTDTADb(fal:fa-database BizTalkDTADb) end subgraph "Nodinite SQL Instance" roNI-.-> roDBMonitoringDatabase(fal:fa-database Monitoring database) end subgraph "BizTalk Group - Test" roMonitoringService -.-> roNIT roBTT(fal:fa-server Any BizTalk node ) roNIT(fal:fa-monitor-waveform BizTalk Server Monitoring Agent) --> roBTT end

High-level architecture for deploying the Nodinite BizTalk Server Monitoring Agent.

Install the Agent on the same network as the BizTalk Server group you want to monitor. Nodinite can be installed anywhere—including the cloud or offsite—using Service Bus Relaying to securely connect to the Nodinite Microsoft BizTalk Server Monitoring Agent.

We recommend installing the Agent close to the BizTalk Server group (ideally on a BizTalk processing node) to unlock all features and maximize performance.

Verified Topic
Software Requirements
What Windows User Rights does the BizTalk Server Monitoring Agent require?
What Firewall settings are required for the Microsoft BizTalk Server Monitoring Agent?
What SQL user rights does the Microsoft BizTalk Server Monitoring Agent require?

Software requirements

Product Version/Edition Comment
Windows Server Windows 2025
Windows 2022
Windows 2019
Windows 2016
Windows 2012 R2
Windows 2012
Windows 2008 R2		 Should be the same as the Windows version that BizTalk is installed on
.NET Framework .NET Framework 3.5.1 or later This is actually a prerequisite on the BizTalk Administrative Tools; The Agent makes use of the ExplorerOM.dll
.NET Framework .NET Framework 4.8 or laterNew 6.1 NOTE: Different versions of BizTalk have varying requirements
BizTalk Server Client Tools (free) Use a version equal to or higher than the target BizTalk Environment
SQL Server SQL Server 2008 or later Required for hosting the Nodinite BizTalk Monitoring database
SQL Server Binaries 1. DACFramework.msi Download SQL Server DACPAC binaries
Optionally SQL SSMS Latest SSMS

Versions <= 6.0 make use of the .NET Framework 4.5.2 or later.

Nodinite requires DACPAC SQL Binaries from Microsoft and is used to install and update databases. You can (and should) install a higher version (latest) than your SQL Server since Microsoft provides backwards compatibility. The other way around is not supported. No licensing cost is associated with installing and running the Microsoft DACPAC binaries.

Use the latest SSMS version to ensure you have a valid version of the required SQL Server binaries and it's only one installer (although more extensive)

If you experience issues installing or updating the Nodinite databases, the problem is almost always with an incompatible client version. Simply update either the SSMS tool or the DACFramework.msi to the latest available version.

If you cannot install the SQLPackage.exe on the BizTalk Application server, you can always manually update the Nodinite BizTalk Server Monitoring database directly on the SQL Server Instance.

Which versions of Microsoft BizTalk Server are supported?

Nodinite Microsoft BizTalk Server Monitoring Agent has support for the following Microsoft BizTalk Server versions (all editions, also regarding CU, SP, HotFix)

Product/Version Comment Enterprise Standard Developer
BizTalk Server 2020 ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2016
  • .NET 4.8 requires CU7 or later
  • .NET 4.7.2 requires CU2 or later
 ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2013 R2 .NET 4.5.2 requires CU2 or later ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2013 ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2010
  • .NET 4.5.2 Requires CU7 or later to run locally*
 ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2009 * ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2006 R2 * ✅ Yes ✅ Yes ✅ Yes
BizTalk Server 2006 * ✅ Yes ✅ Yes ✅ Yes

* .NET Framework 4.8New 6.1 or later and an appropriate version of the BizTalk Server Administration console must be installed on the server where the Nodinite Microsoft BizTalk Server Monitoring Agent is run.

What Windows User Rights does the BizTalk Server Monitoring Agent require?

The Agent usually runs as a Windows Service on one or more BizTalk Server application servers.

Fail-over cluster support exists for high availability.

Service Account Requirements

The service account must be a member of the following Active Directory groups:

  • BizTalk Server Administrators - The Windows Service Account running the BizTalk Server Monitoring Agent must belong to the Windows Group used with the BizTalk Server Administrators (most Remote Actions require this level).
  • SSO Administrators - The Windows Service Account running the BizTalk Server Monitoring Agent must belong to the Windows Group used with the SSO Administrator role (some details and remote actions require this level)
  • Local Administrators -The Windows Service Account running the BizTalk Server Monitoring Agent must be a local administrator on all BizTalk Server nodes to read performance counters and allow the Start/Stop of Host Instances (which are actually Windows Services)

What Firewall settings are required for the Microsoft BizTalk Server Monitoring Agent?

Where you install the Nodinite Microsoft BizTalk Server Monitoring Agent in relation to the Nodinite Monitoring Service, the BizTalk Server nodes, and the SQL Server instances determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection.

graph LR subgraph "Nodinite Core Services Server" roMonitoringService(fa:fa-watch-fitness Monitoring Service) end subgraph "Nodinite Agent Server" roNI(fa:fa-monitor-waveform BizTalk Server Monitoring Agent) end subgraph "Target: BizTalk Server nodes" roBT(fa:fa-server Any BizTalk node) end subgraph "Target: BizTalk SQL Server" roBTMgmtDB(fa:fa-database BizTalkMgmtDb) roBTmsgboxDB(fa:fa-database BizTalkMsgBoxDb) roBTDTADb(fa:fa-database BizTalkDTADb) end subgraph "SQL Server (Nodinite databases)" roDBMonitoringDatabase(fa:fa-database BizTalk Monitoring database) end subgraph "Domain Controller" roDC(fa:fa-building Active Directory) end subgraph "DNS Server" roDNS(fa:fa-signs-post DNS) end subgraph "Azure Service Bus Relay (optional)" roRelay(fa:fa-cloud Relay namespace) end roMonitoringService --> |"Agent site port (v7) / 8000 (v6)"| roNI roNI --> |"135, 445, RPC 50000-50200 (WMI)"| roBT roNI --> |"1433, 135 + RPC (MSDTC)"| roBTMgmtDB roNI --> |"1433, 135 + RPC (MSDTC)"| roBTmsgboxDB roNI --> |"1433, 135 + RPC (MSDTC)"| roBTDTADb roNI -.-> |"1433 (extended metrics, clustering)"| roDBMonitoringDatabase roNI --> |"88, 389, 636, 445"| roDC roNI --> |"53"| roDNS roMonitoringService -.-> |"443, 5671-5672, 9350-9354"| roRelay roNI -.-> |"443, 5671-5672, 9350-9354"| roRelay

Network diagram: the Monitoring Service calls the agent; the agent uses WMI/RPC against every BizTalk node and SQL against every BizTalk database and, optionally, its own Monitoring database. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical v7 installation), you need no firewall rule between the Monitoring Service and the agent. When the agent runs on a BizTalk node, the WMI/RPC hop to that node is local.

Between the Monitoring Service and the BizTalk Server Monitoring Agent

The Monitoring Service opens every connection; the agent never calls it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step).

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Core Services Server Agent Server TCP (HTTPS/HTTP) Agent site port Poll the agent, send configuration, run Remote Actions v7. No fixed default; use the port set in the Portal. Only when the agent is on a remote server
Inbound Core Services Server Agent Server TCP 8000 Same, for Windows Service agents ⚠️ v6 and earlier only (legacy MSI installer on remote servers)

Option: Service Bus Relaying (cloud or hybrid)

Use Service Bus Relayed connections when Nodinite and the agent are on different networks. Both sides connect outbound to the Azure Relay namespace, so neither server needs an inbound rule. Nodinite uses the same principle as the on-premises data gateway; see 'Adjust communication settings for the on-premises data gateway' and the 'Azure Relay FAQs'.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 443 HTTPS All versions
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 5671, 5672 Secure AMQP All versions
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 9350 - 9354 Net.TCP All versions
Outbound Core Services Server Azure Relay (*.servicebus.windows.net) TCP 443, 5671, 5672, 9350 - 9354 Monitoring Service side of the relay Same ports as the Agent Server

Between the BizTalk Server Monitoring Agent and the BizTalk Server nodes

Required for monitoring BizTalk Server nodes, reading performance counters, and starting or stopping Host Instances. The agent uses WMI, which is highly configurable in Windows, so the ports in use may differ from this table.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Target (BizTalk Server) TCP 135 RPC Endpoint Mapper Required for WMI and DCOM; shared by many Windows services
Outbound Agent Server Target (BizTalk Server) TCP 445 SMB / RPC over Named Pipes Windows Performance Counters and remote registry
Outbound Agent Server Target (BizTalk Server) TCP 50000–50200 WMI / RPC dynamic ports Depends on the RPC policy of the target; the Windows default range is 49152–65535. See 'Configure RPC dynamic port allocation'
Inbound Target (BizTalk Server) Agent Server TCP Same as outbound Response traffic Automatically allowed by stateful firewall inspection

Note

Some documents online state 5000–5020, which is a typo. BizTalk is aggressive on TCP port usage, and you may need to allow more dynamic ports depending on your configuration.

Between the BizTalk Server Monitoring Agent and the BizTalk SQL Server

Required for the BizTalk databases: BizTalkMgmtDb, BizTalkDTADb, and every BizTalkMsgBoxDb. For performance, the agent queries these databases directly instead of using the 'ExplorerOM.dll' binary. The databases may be spread over several SQL Server instances; allow the Agent Server to reach each one. See SQL Server Connection Strings and SQL Server Firewall Configuration for Always On Availability Groups (AOAG) and connectivity tests.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Target (BizTalk SQL Server) TCP 1433 SQL Server default instance Default port; can be changed in SQL Server Configuration Manager
Outbound Agent Server Target (BizTalk SQL Server) TCP 49152–65535 SQL Server named instances Named instances use a dynamic port by default; set a static port and open only that one
Outbound Agent Server Target (BizTalk SQL Server) UDP 1434 SQL Server Browser Resolves the port of a named instance; not needed when the connection string names the port
Outbound Agent Server Target (BizTalk SQL Server) TCP 135 MSDTC / RPC Endpoint Mapper Distributed transactions and remote procedure calls
Outbound Agent Server Target (BizTalk SQL Server) TCP RPC dynamic range (for example 50000–50200) MSDTC dynamic ports Same RPC range as configured for the BizTalk nodes
Inbound Target (BizTalk SQL Server) Agent Server TCP Same as outbound Response traffic Automatically allowed by stateful firewall inspection

Between the BizTalk Server Monitoring Agent and the Nodinite Monitoring database

Required only when you use extended metrics and statistics or cluster the agent (see Configuration). The agent then connects to the SQL Server instance hosting its BizTalk Monitoring database; Monitoring Agent Databases has the details.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server SQL Server (Nodinite databases) TCP 1433 SQL Server default instance Named instances use their own port, plus UDP 1434 for SQL Server Browser

Between the BizTalk Server Monitoring Agent and the Domain Controller

Required for Kerberos authentication and Active Directory queries; the agent account is a domain account in the BizTalk Server Administrators and SSO Administrators groups. Review 'Microsoft Kerberos'.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Domain Controller TCP/UDP 88 Kerberos authentication Required for domain authentication
Outbound Agent Server Domain Controller TCP/UDP 389 LDAP Standard LDAP queries
Outbound Agent Server Domain Controller TCP 636 LDAPS (Secure LDAP) Required for LDAPS authentication or querying certificates from AD
Outbound Agent Server Domain Controller TCP 445 SMB Used if Group Policy or file-based certificate access is needed
Inbound Domain Controller Agent Server TCP/UDP Same as outbound Response to Kerberos / LDAP Usually allowed by stateful firewall inspection

Between the servers and DNS

Review 'DNS works on TCP and UDP'.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server DNS Server TCP/UDP 53 Name resolution Resolve the BizTalk nodes, the SQL Server instances, the Domain Controller, and (with relaying) *.servicebus.windows.net. A local hosts file can replace DNS
Outbound Core Services Server DNS Server TCP/UDP 53 Name resolution Resolve the Agent Server

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. The inbound response rules above are for reference and troubleshooting.

What SQL user rights does the Microsoft BizTalk Server Monitoring Agent require?

The service account running the BizTalk Server Monitoring Agent must have the following rights assigned:

Note

db_ddladmin is required for the service account to have proper rights to read statistics. Performance may be degraded Without this permission, especially for remote servers (linked servers). Read more about linked server performance killers. Contact our support if you have any questions about this.

BizTalkMGMTDb

  • DataReader
  • DataWriter (Changes to BizTalk artifacts can be performed using Remote Actions)
  • db_ddladmin (see note)

BizTalkDTADb

  • DataReader
  • DataWriter (for BizTalk Health check related operations/actions)
  • db_ddladmin (see note)
  • BTS_OPERATORS (should be inherited by the membership with BizTalk Server Administrators)

BizTalkMSGBoxDb

  • DataReader
  • DataWriter (for BizTalk Health check related operations/actions)
  • db_ddladmin (see note)
  • BTS_OPERATORS (should be inherited by the membership with BizTalk Server Administrators)

Nodinite BizTalk Monitoring database

If you have multiple Monitoring Agents installed, there is one database per instance. Repeat as necessary.

  • db_owner (required to apply DACPAC updates)

Frequently asked questions

Additional solutions to common problems for the Nodinite Microsoft BizTalk Server Monitoring Agent FAQ exist in the Troubleshooting user guide.

Next Steps

Add or manage a Monitoring Agent Configuration
Install BizTalk Monitoring Agent

Monitoring
Administration