- 6 minutes to read

Release Notes

Prerequisites for the Nodinite Web Services Monitoring Agent

Prepare your environment for seamless monitoring of Web Services and Web Applications with Nodinite. This page outlines all prerequisites for installing and running the Web Services Monitoring Agent, ensuring a smooth and secure deployment.

With Nodinite, you can:

  • Monitor any Web Service, Web Application, WCF, or Web API
  • Deploy agents on-premises or in the cloud, with flexible network options
  • Leverage secure Windows authentication and granular user rights
  • Automate monitoring with minimal firewall and network configuration

This page describes the prerequisites for installing and running the Nodinite Web Services Monitoring Agent.

graph LR subgraph "Web Servers" ro1(fal:fa-list Web Applications) end subgraph "APIs" roCloudAPI(fal:fa-cloud Web Services) end subgraph "Nodinite" roMonitoringService(fal:fa-watch-fitness Monitoring Service) -->roNI(fal:fa-code-commit Web Services Monitoring Agent) roNI --> ro1 roNI --> roCloudAPI end

This diagram shows how the Nodinite Web Services Monitoring Agent connects to web servers and APIs, managed by the Nodinite Monitoring Service.

You can install agent instances on the same network as Nodinite, or deploy them in the cloud/offsite using Service Bus Relaying (see also the external link for additional information 'Azure Relay FAQs').

We recommend that you keep this agent close to the Nodinite Server

Verified Topic
Software Requirements
What Windows User Rights does the Web Services Monitoring agent require?
What Firewall settings are required for the Web Services Monitoring agent?

Software requirements

Product Version/Edition Comment
Windows Server Windows 2025
Windows 2022
Windows 2019
Windows 2016
Windows 2012 R2
Windows 2012
.NET Hosting Bundle .NET 10 Hosting Bundle New 7.0.4 Required for v7.0.4 and later. Download from Microsoft

Versions 7.0.4 and later require .NET 10 Hosting Bundle.
.NET 10 minimum OS: Windows Server 2012 / 2012 R2. Windows Server 2008 R2 is supported only for legacy versions (<=7.0.3) running on .NET Framework.
Versions 6.0 and later require .NET Framework 4.8 or later.
Versions 5.4 and later require .NET Framework 4.6.2 or later.
Versions before 5.4 require .NET Framework 4.5.2 or later.

What Windows User Rights does the Web Services Monitoring agent require?

The Web Services Monitoring Agent installs as a Windows Service—usually on the Nodinite application server—and runs with least possible privileges:

You can fine-tune access rights per Web Service/Web Application. Configure these individually—see the Configuration user guide for details.

What Firewall settings are required for the Web Services Monitoring agent?

Where you install the Nodinite Web Services Monitoring Agent in relation to the Nodinite Monitoring Service and the endpoints you monitor determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection.

graph LR subgraph "Nodinite Core Services Server" roMonitoringService(fa:fa-watch-fitness Monitoring Service) end subgraph "Nodinite Agent Server" roNI(fa:fa-monitor-waveform Web Services Monitoring Agent) end subgraph "Target: Web Servers" ro1(fa:fa-list Web Applications and Web Services) end subgraph "Target: Cloud APIs" roCloudAPI(fa:fa-cloud APIs) end subgraph "Identity Provider (optional)" roIdP(fa:fa-key OAuth2 token endpoint) end subgraph "Forward Proxy (optional)" roProxy(fa:fa-shuffle Proxy) end subgraph "Domain Controller" roDC(fa:fa-id-badge Active Directory) end subgraph "DNS Server" roDNS(fa:fa-signs-post DNS) end subgraph "Azure Service Bus Relay (optional)" roRelay(fa:fa-cloud Relay namespace) end roMonitoringService --> |"Agent site port (v7) / 8000 (v6)"| roNI roNI --> |"80, 443, or endpoint port"| ro1 roNI --> |"443"| roCloudAPI roNI -.-> |"443"| roIdP roNI -.-> |"Proxy port"| roProxy roNI -.-> |"88, 389, 636 (Windows auth)"| roDC roNI --> |"53"| roDNS roMonitoringService -.-> |"443, 5671-5672, 9350-9354"| roRelay roNI -.-> |"443, 5671-5672, 9350-9354"| roRelay

Network diagram: the Monitoring Service calls the agent, and the agent calls each configured endpoint. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical installation), you need no firewall rule between the Monitoring Service and the agent.

Between the Monitoring Service and the Web Services Monitoring Agent

The Monitoring Service opens every connection; the agent never calls it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step).

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Core Services Server Agent Server TCP (HTTPS/HTTP) Agent site port Poll the agent, send configuration, run Remote Actions v7. No fixed default; use the port set in the Portal. Only when the agent is on a remote server
Inbound Core Services Server Agent Server TCP 8000 Same, for Windows Service agents ⚠️ v6 and earlier only (legacy MSI installer on remote servers)

Option: Service Bus Relaying (cloud or hybrid)

Use Service Bus Relayed connections when Nodinite and the agent are on different networks. Both sides connect outbound to the Azure Relay namespace, so neither server needs an inbound rule. Nodinite uses the same principle as the on-premises data gateway; see 'Adjust communication settings for the on-premises data gateway' and the 'Azure Relay FAQs'.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 443 HTTPS All versions
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 5671, 5672 Secure AMQP All versions
Outbound Agent Server Azure Relay (*.servicebus.windows.net) TCP 9350 - 9354 Net.TCP All versions
Outbound Core Services Server Azure Relay (*.servicebus.windows.net) TCP 443, 5671, 5672, 9350 - 9354 Monitoring Service side of the relay Same ports as the Agent Server

Between the Web Services Monitoring Agent and the monitored endpoints

The agent opens outbound HTTP or HTTPS connections to each Web Service and Web Application in the Configuration. The port is the one in the endpoint URL.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Target (Web Server, Cloud API) TCP (HTTP) 80 Web Service monitoring requests Or the custom port in the endpoint URL
Outbound Agent Server Target (Web Server, Cloud API) TCP (HTTPS) 443 Web Service monitoring requests and certificate evaluation Or the custom port in the endpoint URL
Outbound Agent Server Identity Provider (OAuth2 token endpoint) TCP (HTTPS) 443 Acquire access tokens Only with OAuth2 authentication
Outbound Agent Server Forward Proxy TCP Proxy port Reach the endpoints through a proxy Only when your network routes outbound web traffic through a forward proxy; then allow the proxy, not each endpoint
Inbound Target (Web Server, Cloud API) Agent Server TCP 80, 443, or custom Response traffic Automatically allowed by stateful firewall inspection

Tip

Custom Ports: The actual port(s) depend on your Web Service/Application configuration. You must open whatever TCP port your services use. Common alternatives include 8080 (HTTP alternate), 8443 (HTTPS alternate), or custom ports like 9000, 3000, etc.

Tip

Cloud Services: For cloud-hosted APIs (Azure, AWS, etc.), ensure the Agent Server has outbound internet access on port 443 (HTTPS). No inbound rules are required on the cloud side.

Between the Web Services Monitoring Agent and the Domain Controller

Required only for endpoints that use Windows authentication.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server Domain Controller TCP/UDP 88 Kerberos authentication Required for domain authentication
Outbound Agent Server Domain Controller TCP/UDP 389 LDAP Standard LDAP queries
Outbound Agent Server Domain Controller TCP 636 LDAPS (Secure LDAP) Required for LDAPS authentication
Inbound Domain Controller Agent Server TCP/UDP Same as outbound Response to Kerberos / LDAP Usually allowed by stateful firewall inspection

Between the servers and DNS

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Agent Server DNS Server TCP/UDP 53 Name resolution Resolve the endpoints, the Core Services Server, and (with relaying) *.servicebus.windows.net. A local hosts file can replace DNS for on-premises hosts
Outbound Core Services Server DNS Server TCP/UDP 53 Name resolution Resolve the Agent Server

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. The inbound response rules above are for reference and troubleshooting.

Frequently asked questions

Find solutions to common problems and FAQs for the Nodinite Web Service Monitoring Agent in the Troubleshooting user guide.

Next Steps

Install Web Service Monitoring Agent

Configuration
Add or manage a Monitoring Agent Configuration
Monitoring
Administration