Tableau Services Manager Ports

The processes and services that make up the components of Tableau Services Manager (TSM) and Tableau Server on Linux use various ports to communicate. By default, most these ports are assigned (mapped) dynamically from a predefined range of ports. The port assignments are made for each service or process when it is installed. You can control what ports are used in a variety of ways.

A small subset of processes do not use dynamic port mapping and behave uniquely. For more information, see Ports that are not dynamically mapped, below.

Note: This operation includes steps that you may need to perform using the TSM command line.

Firewall requirements

If you are running a firewall on the computer where you will be installing Tableau Server, then you will need to open the following default ports for Tableau Server traffic. All port numbers, except 443 and 8850, can be changed.

Port TCP/UDP Used by ... TYPE OF INSTALLATION
All

Distributed / High Availability

80 TCP Gateway X  
443 TCP SSL. When Tableau Server is configured for SSL, the application server redirects requests to this port. Do not change this port. X  
8850 TCP Tableau Services Manager. Do not change this port. X  
8060 TCP PostgreSQL database. X  
8061 TCP PostgreSQL backup verification port X  
8000-9000 TCP Range of ports reserved by default for dynamic mapping of Tableau processes   X
27000-27009 TCP Range of ports used by Tableau Server for License service. This range must be open on the node running the License service and accessible from other nodes. By default, the initial node runs the License service. X  

See Configure Local Firewall.

Port assignment

There are two approaches you can use for port assignment or mapping in TSM:

  • Dynamic port assignment. This is the default and requires the least intervention by the administrator.
  • Manual port assignment. This option requires an administrator to individually assign each port.

If you change port assignments and you are running a local firewall, see Local firewall configuration.

Dynamic port assignment

You can control which ports are used by changing the range of ports available to the dynamic assignment process. Doing this leaves dynamic port assignment in place but restricts the ports that can be chosen. With dynamic port assignment in place, you can still choose to assign ports for certain processes manually. This approach enables you to assign specific ports to specific processes, while leaving the others to be mapped dynamically. Using dynamic mapping, with or without some individually assigned ports is the easiest approach, and should satisfy the requirements of most customers. Dynamically assigned ports are preserved if you export your Tableau Server configuration.

By default, ports are assigned for each service or process from available ports between 8000 to 9000. This assignment takes place when services are installed for the first time on a node. After Tableau Server is initialized, you can see which ports are being used by which services or processes by running this command:

tsm topology list-ports

If you have a multi-node cluster, ports on all nodes are listed.

Changing the port range

For organizations that have specific requirements for ports being used, the easiest way to control this is to change the range from which ports are dynamically selected. You need to do this at installation, by specifying a minimum and maximum port for the range in your configuration file.

Note: The minimum allowable size of your port range will depend on your server installation and how many services or processes you are running. As a general best practice you should not restrict the range too tightly because port assignment is done by selecting random ports within the range, and if you do not allow a large enough range, selection may fail to find an available port.

To limit the range from which available ports are chosen to those between 8300 and 8600, your configuration file would include an entry similar to this:

"configKeys": {
"ports.range.min": "8300", "ports.range.max": "8600"
}

Disabling dynamic port assignment

If you need more control of port assignment than you can get through a combination of restricting port range and individually assigning ports, you can disable dynamic port mapping at initial server configuration. Disabling dynamic port mapping requires you to manually assign every port for every process, so we don't recommend this unless you need to control every single port assignment.

If you disable dynamic port mapping, you must configure the port for each process on each node of your installation.

To disable dynamic mapping, your configuration file would include an entry similar to this:

"configKeys": {
"service.port_remapping.enabled": false
}

Important:  When you disable dynamic port assignments, the License service port range is not included. This range (27000-27009) must be open on the node running the License service and accessible from other nodes. By default, the initial node runs the License service.

Manual port assignment

You can disable automatic port assignment entirely and assign a port for each process individually. If you do this, you must assign a port for every process on every node. You can assign ports either in a configuration file, when the processes are first installed, or after installation, using a TSM command. Only ports assigned at process installation are preserved if you export your Tableau Server configuration.

You can specify individual ports for specific processes, whether or not dynamic mapping is enabled. You might do this if you want a process to use a particular port, or if you've disabled dynamic mapping. There are two ways to specify ports for processes: during installation or after installation.

Configuring ports during installation

We recommend configuring port assignment during the installation process as described here. Changing ports after installation is a much more labor-intesive process.

To configure ports during installation, create a json file that specifies your port configuration. This process is similar to defining a non-default port range, but instead you specify a particular port for a specific service or process. If you are going to assign specific ports, this approach is the most robust way to do so because the port mapping is preserved if you export the server configuration and topology settings using the tsm settings export command.

To define ports at installation, add information to your configuration file to specify the node (workerN), process (servicename) and instance ID (instanceid), port type (porttype), and the port to be used. The format looks like this:

workerN.{servicename}_{instanceid}.{porttype}.port:X

Where:

  • workerN is an optional parameter and identifies the node for which the remapping applies. Node numbers start with zero (0).
    We recommend you do not include this parameter unless you need to map different ports for the same service on different nodes. If you leave this parameter off, you can map a service port on the initial node, or map the same service port on multiple nodes.
  • servicename is the name of the process or service that will use the port.
  • instanceid is the instance of the process. If you are going to be configuring multiple instances of a process on one node, you would need to increment this value for each instance. Start the instanceid at zero (0) and increment it by one (1) for each instance of the process. For services that only install a single instance on any given node, this must be left off.
  • porttype If setting the primay port, do not include this option.
  • port is the port the process or service should use.

For example, to set the port for the first instance of the file store process on the initial node to 8500, you would include a configuration file entry similar to this:

"configKeys": {
"filestore_0.port: "8500"
}

The example above does not include the optional workerN parameter, so sets the port on all nodes in the cluster. It also leaves off the porttype option because it is setting the primary filestore port.

Important: When specifying port changes with a configuration file, you must include the --force-keys parameter with the tsm settings import command.

Configuring ports after installation

If you need to change ports after you have installed Tableau Server, use the tsm topology set-ports command. This approach allows you to specify a port for a specific process after that process has been installed. You are restricted by these limits:

  • You must set ports individually, on each node.
  • After you set an individual port, you must run tsm restart.
  • The port assignments are not preserved if you need to import a Tableau Server configuration using tsm settings import.
  • Port names use a different syntax for tsm commands than the syntax that is required for configKeys. The table at the end of this topic provides a syntax reference.

For example, to set second instance of the file store on the initial node to use port 8500:

tsm topology set-ports --node-name node1 --port-name filestore --port-value 8500 --instance 2

The following example shows how to use shorthand commands to set the JMX ports:

tsm topology set-ports -n node1 --port-name vizqlserver:jmx.rmi -pv 9403 -i 1

tsm topology set-ports -n node1 --port-name vizqlserver:jmx -pv 9404 -i 2

Note: Port entries are not validated when you enter them. Therefore, if you use a port that is already assigned, or if you mistype the syntax for a command, Tableau will not give an error until you restart. After restarting, you may see a generic error, The reconfigure async job failed.

If you add an incorrect portname:type with a valid port, you cannot delete the incorrect entry. To update the port, you must reassign an unused port to that value to free up the port again.

Ports that are not dynamically mapped

The Tableau Server repository uses two ports that are not dynamically mapped. These each have a default port that you can override using the tsm configuration set command and a process-specific parameter.

Port names Port (default) Description
pgsql.port 8060 Port for the Tableau Repository (PostgreSQL database).

To override this port:

tsm configuration set -k pgsql.port <port>

pgsql.verify_restore.port 8061 Port for verifying the integrity of a repository backup.

to override this port:

tsm configuration set -k pgsql.verify_restore.port <port>

Because these ports do not use the dynamic port mapping system, they do not show up in the output of the tsm topology list-ports command. To see the value of these you need to use the tsm configuration get -k <config.value> command. For example:

tsm configuration get -k pgsql.port

Controlling port remapping with initialize-tsm

Port assignments are made when services are installed. This means that in order to manually map ports for the TSM-specific processes, you need to assign the ports when you run the initialize-tsm script. The script includes options to specify ports for individual TSM services, as well as options for defining the minimum and maximum of the port range used with dynamic mapping, and you can disable dynamic mapping.

The table below lists the options for ports when running the initialize-tsm script.

Table: initialize-tsm script port options
Script option Parameter Description
-i <port> Sets the Coordination Service client port.
-e <port> Sets the Coordination Service peer port.
-m <port> Sets the Coordination Service leader port.
-n <port> Sets the TSM agent file transfer port.
-o <port> Sets the TSM Controller port.
-l <min-port> Sets the bottom of the port range used for dynamically mapping ports.
-r <max-port> Sets the top of the port range used for dynamically mapping ports.
--disable-port-remapping   Disables dynamic port mapping. If you do this you must assign ports for every service or process used by TSM and Tableau Server. For more information, see Manual port assignment above.

Dynamically mapped ports

This table lists the processes or services that use dynamically mapped ports.

Port names: syntax for json file (configKeys) Port names: syntax for tsm CLI  Description
appzookeeper_0.client.port appzookeeper:client Coordination Service client port.
appzookeeper_0.peer.port appzookeeper:peer Coordination Service peer port.
appzookeeper_0.leader.port appzookeeper:leader Coordination Service leader port.
backgrounder_0.port backgrounder Backgrounder primary port.
backgrounder_0.debug.port backgrounder:debug Backgrounder debug port.
backgrounder_0.jmx.port backgrounder:jmx Backgrounder jmx port. 
backgrounder_0.jmx.rmi.port backgrounder:jmx.rmi Backgrounder jmx rmi port.
backgrounder_0.recommendations.trainer.port backgrounder:recommendations.trainer Backgrounder recommendations port.
backuprestore.port backuprestore Backup/Restore service port.
cacheserver_0.port cacheserver Cache server port.
clustercontroller.status.port clustercontroller:status Cluster Controller status port.
clustercontroller.storage.port clustercontroller:storage Cluster Controller storate port.
databasemaintenance.port databasemaintenance Database Maintenance port.
dataserver_0.port dataserver Data server primary port.
dataserver_0.debug.port dataserver:debug Data server debug port.
dataserver_0.jmx.port dataserver:jmx Data server jmx port.
dataserver_0.jmx.rmi.port dataserver:jmx.rmi Data server jmx rmi port.
filestore.port filestore File store primary port.
filestore.status.port filestore:status File Store status port.
gateway.port gateway Gateway port. This defaults to 80, and if that is not available, to 8080. If that is not available, it tries 8000. That sequence is followed whether or not dynamic port assignment is enabled or not. If none of those ports are available and dynamic mapping is enabled, it takes an available port within the defined range. The gateway port must be the same on all nodes in a multi-node cluster, so if port 80 is selected on the initial node this is the port that will be used on all nodes and if it is unavailable on one of the other nodes, gateway port selection will fail.
hyper.port hyper Data engine primary port.
hyper.connection.port hyper:connection Data engine connection port.
licenseservice.vendor_daemon.port licenseservice:vendor_daemon License service vendor daemon port. Used for licensing-related communications between nodes in a multi-node installation.
samlservice.port samlservice SAML service port.
searchserver.port searchserver Search server primary port.
searchserver.debug.port searchserver:debug Search server debug port.
searchserver.jmx.port searchserver:jmx Search server jmx port.
searchserver.jmx.rmi.port searchserver:jmx:rmi Search server jmx rmi port.
searchserver.startup.port searchserver:startup Search server startup port.
siteimportexport.port siteimportexport Site Import/Export port.
tabadmincontroller.port tabadmincontroller TSM Controller port.
tabadminagent.columbo.port tabadminagent:columbo Administration Agent service discovery port
tabadminagent.filetransfer.port tabadminagent:filetransfer TSM Agent file transfer port.
vizportal_0.authentication.port vizportal:authentication Application server authentication port.
vizportal_0.authorization.port vizportal:authorization Application server authorization port.
vizportal_0.maintenance.port vizportal:.maintenance Application server maintenance port.
vizportal_0.microservice.extensions.port vizportal:.microservice:extensions Application server extensions port.
vizportal_0.monolith_grpc.port vizporta:monolith_grpc Application server GRPC port.
vizportal_0.publishing.port vizportal:publishing Application server publishing port.
vizportal_0.recommendations.port vizportal:recommendations Application server recommendations port.
vizportal_0.port vizportal Application server primary port.
vizportal_0.debug.port vizportal:debug Application server debug port.
vizportal_0.jmx.port vizportal:jmx Application server jmx port.
vizportal_0.jmx.rmi.port vizportal:jmx.rmi Application server jmx rmi port.
vizqlserver_0.port vizqlserver VizQL server primary port.
vizqlserver_0.debug.port vizqlserver:debug VizQL server debug port.
vizqlserver_0.jmx.port vizqlserver:jmx VizQL server jmx port.
vizqlserver_0.jmx.rmi.port vizqlserver:jmx.rmi VizQL server jmx rmi port.

 

Thanks for your feedback! There was an error submitting your feedback. Try again or send us a message.