Endpoints and ports
Collectors, SDKs and browsers connect out to Tracix over HTTPS on TCP 443. Nothing on this page needs an inbound firewall rule except the listeners your own collectors run for devices on your network.
Read the hostnames
Your workspace's address is its name when it was created followed by an eight-character ID, such as production-a7k3p2q9.app.tracix.io. The hostnames collectors and SDKs use carry the ID alone. On this page and across the docs, <workspace> stands for that ID: the workspace above has its collector endpoint at agents-a7k3p2q9.app.tracix.io. An older workspace whose address has no ID suffix uses its whole name in both places.
Copy exact values from your workspace
The collector install command on the Collectors page, the Gateway endpoints card under Applications › APM & Traces › Setup, and Applications › Real User Monitoring › Setup show the exact hostnames for your workspace.
Hostnames Tracix serves
All of these listen on TCP 443 with TLS. Don't add port 4317 or 4318 to a Tracix hostname: those ports exist only inside your workspace.
| Hostname | Who connects | What for |
|---|---|---|
cloud.tracix.io | Browsers | The Tracix Cloud console: sign-in, your organization, workspaces, users and billing |
<name>-<workspace>.app.tracix.io, or a custom domain you added | Browsers, scripts and CI | Your workspace's app, and the endpoints that accept API keys |
agents-<workspace>.app.tracix.io | Tracix Collectors | Enrollment, policy configuration, heartbeats and live updates |
ch-<workspace>.app.tracix.io | Tracix Collectors | The telemetry collectors write to your workspace's database, in workspaces with a Tracix-managed database |
otlp-<workspace>.app.tracix.io | OpenTelemetry SDKs, agents and collectors | OTLP over gRPC |
otlp-http-<workspace>.app.tracix.io | OpenTelemetry SDKs, agents and collectors | OTLP over HTTP (http/protobuf) |
rum-<workspace>.app.tracix.io | Browsers and mobile apps | Real user monitoring data over OTLP/HTTP |
charts.tracix.io | Installers, collectors and Helm | Installers, release bundles and their checksums, managed updates and the Helm chart repository |
public.ecr.aws | Docker and Kubernetes hosts | The collector container image |
What each client needs
Tracix Collector
A collector needs outbound HTTPS to these hosts, directly or through an HTTP proxy:
| Host | Used for |
|---|---|
charts.tracix.io | Downloading the installer and the release at install, and new releases during managed updates |
agents-<workspace>.app.tracix.io | HTTPS requests to /v1/enroll, /v1/config and /v1/heartbeat, and a WebSocket at /v1/ws that pushes configuration changes. When the WebSocket can't connect, the collector polls over HTTPS instead |
ch-<workspace>.app.tracix.io | Writing telemetry, with an insert-only credential that comes with the collector's configuration |
public.ecr.aws | Pulling the collector image, for Docker and Kubernetes installs only |
It also connects to whatever its policy monitors, such as devices it polls over SNMP or cloud APIs. To route collector traffic through a proxy, see Ports, proxies and firewalls.
OpenTelemetry SDKs and agents
Applications send OTLP to your workspace with an ingest key (apm_…) from Applications › APM & Traces › Setup in the x-tracix-ingest-key header. See API keys and ingest keys.
| Protocol | Endpoint |
|---|---|
| OTLP over gRPC | https://otlp-<workspace>.app.tracix.io |
| OTLP over HTTP | https://otlp-http-<workspace>.app.tracix.io, with the standard paths /v1/traces, /v1/metrics and /v1/logs |
The gRPC and HTTP endpoints are separate hosts. Set the protocol explicitly: an SDK that defaults to gRPC gets HTTP 415 from the HTTP host.
export OTEL_EXPORTER_OTLP_ENDPOINT=https://otlp-http-<workspace>.app.tracix.io
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_HEADERS="x-tracix-ingest-key=<ingest key>"See OTLP endpoint and ingest keys for headers, protocols and examples.
Browsers and mobile apps
Real user monitoring sends OTLP/HTTP to https://rum-<workspace>.app.tracix.io with a public RUM app key from Applications › Real User Monitoring › Setup in the x-tracix-app-key header. Browser app keys only work from the web origins the app allows. Mobile apps send the same header.
People, scripts and CI
People sign in at cloud.tracix.io and open the workspace at its address. Scripts and CI pipelines call the workspace address with an API key; see Authenticate with API keys.
Ports a collector listens on
These listeners run on your collector, inside your network, when its policy includes the integration. Point devices at the collector's address.
| Listener | Default port | Transport | Notes |
|---|---|---|---|
| Syslog (RFC 5424 or RFC 3164) | 514 | UDP or TCP | Set the transport and address in the integration |
| NetFlow v5 and v9, IPFIX | 2055 | UDP | |
| sFlow | 6343 | UDP | |
| SNMP traps and informs | 162 | UDP | Part of the SNMP integration, on by default |
| OTLP from local applications | 4317 for gRPC, 4318 for HTTP | TCP | With the OTLP integration |
| Health check | 13133 | TCP | Host installs bind it to 127.0.0.1 only |
Ports below 1024, such as 514 and 162, need permission to open, and Tracix gives a collector a listener below 1024 only when it can open it. The Kubernetes chart's default profile, for example, can't: set the integration to a port of 1024 or above, such as 1162 for traps, and point devices at it. Ports below 1024 covers each platform, and the SNMP, flows and syslog guides cover each listener.
On Windows, the installer adds a firewall rule that lets devices reach the collector's listeners. On other hosts, open the ports in the host firewall and in any cloud security group.
Ports a collector connects to on your network
| Target | Port | Transport | When |
|---|---|---|---|
| Devices polled over SNMP | 161 | UDP | With SNMP monitoring; the integration can set another port |
Restrict source networks
The allowlist covers every workspace hostname
In the Tracix Cloud console, a workspace's Access tab has a source IP allowlist. Empty, it lets connections in from any network. Once you add networks, every hostname of that workspace on this page, from the app to OTLP and RUM, accepts connections only from them, and authentication still applies. Add every network your people, collectors and applications connect from, and keep in mind that RUM data comes from your users' browsers.
Test a connection
Tracix endpoints don't answer ping. Test TCP 443 instead:
curl -sv https://agents-<workspace>.app.tracix.ioTest-NetConnection agents-<workspace>.app.tracix.io -Port 443