The processes and services that make up the components of Tableau Services Manager (TSM) and Tableau Server
A small subset of processes do not use dynamic port mapping and behave uniquely. For more information, see Ports that are not dynamically mapped, below.
Note: This operation includes steps that you may need to perform using the TSM command line.
If you are running a firewall on the computer where you will be installing Tableau Server, then you will need to open the following default ports for Tableau Server traffic. All port numbers, except 443, can be changed.
|Port||TCP/UDP||Used by...||TYPE OF INSTALLATION|
Distributed / High Availability
|443||TCP||SSL. When Tableau Server is configured for SSL, the application server redirects requests to this port. Do not change this port.||X|
|8850||TCP||Tableau Services Manager.||X|
|8061||TCP||PostgreSQL backup verification port||X|
|8000-9000||TCP||Range of ports reserved by default for dynamic mapping of Tableau processes||X|
|27000-27009||TCP||Range of ports used by Tableau Server for Licence service. This range must be open on the node running the Licence service and accessible from other nodes. By default, the initial node runs the Licence service.||X|
There are two approaches you can use for port assignment or mapping in TSM:
- Dynamic port assignment. This is the default and requires the least intervention by the administrator.
- Manual port assignment. This option requires an administrator to individually assign each port.
If you change port assignments and you are running a local firewall, see Local firewall configuration.
Dynamic port assignment
You can control which ports are used by changing the range of ports available to the dynamic assignment process. Doing this leaves dynamic port assignment in place but restricts the ports that can be chosen. With dynamic port assignment in place, you can still choose to assign ports for certain processes manually. This approach enables you to assign specific ports to specific processes, while leaving the others to be mapped dynamically. Using dynamic mapping, with or without some individually assigned ports is the easiest approach, and should satisfy the requirements of most customers. Dynamically assigned ports are preserved if you export your Tableau Server configuration.
By default, ports are assigned for each service or process from available ports between 8000 to 9000. This assignment takes place when services are installed for the first time on a node. After Tableau Server is initialised, you can see which ports are being used by which services or processes by running this command:
tsm topology list-ports
If you have a multi-node cluster, ports on all nodes are listed.
Changing the port range
For organisations that have specific requirements for ports being used, the easiest way to control this is to change the range from which ports are dynamically selected. You need to do this at installation, by specifying a minimum and maximum port for the range in your configuration file.
Note: The minimum allowable size of your port range will depend on your server installation and how many services or processes you are running. As a general best practice you should not restrict the range too tightly because port assignment is done by selecting random ports within the range, and if you do not allow a large enough range, selection may fail to find an available port.
To limit the range from which available ports are chosen to those between 8300 and 8600, your configuration file would include an entry similar to this:
"ports.range.min": "8300", "ports.range.max": "8600"
Blocking specific ports within the range
Beginning with version 2021.1.0, you can specify certain ports that are within the dynamically assigned range but should not be used by Tableau. This is useful if you have other software on your Tableau Server computers that rely on ports within the range Tableau is using.
To specify ports within the range that should not be used by TSM and Tableau Server, use the
ports.blocklist configuration key:
tsm configuration set -k ports.blocklist -v <port>[,<port>,<port>]
tsm configuration set -k ports.blocklist -v 8000,8088, 8090
Disabling dynamic port assignment
If you need more control of port assignment than you can get through a combination of restricting port range and individually assigning ports, you can disable dynamic port mapping at initial server configuration. Disabling dynamic port mapping requires you to manually assign every port for every process, so we don't recommend this unless you need to control every single port assignment.
If you disable dynamic port mapping, you must configure the port for each process on each node of your installation.
To disable dynamic mapping, your configuration file would include an entry similar to this:
Important: When you disable dynamic port assignments, the Licence service port range is not included. This range (27000-27009) must be open on the node running the Licence service and accessible from other nodes. By default, the initial node runs the Licence service.
Manual port assignment
You can disable automatic port assignment entirely and assign a port for each process individually. If you do this, you must assign a port for every process on every node. You can assign ports either in a configuration file, when the processes are first installed, or after installation, using a TSM command. Only ports assigned at process installation are preserved if you export your Tableau Server configuration.
You can specify individual ports for specific processes, whether or not dynamic mapping is enabled. You might do this if you want a process to use a particular port, or if you've disabled dynamic mapping. There are two ways to specify ports for processes: during installation or after installation.
Configuring ports during installation
We recommend configuring port assignment during the installation process as described here. Changing ports after installation is a much more labor-intesive process.
To configure ports during installation, create a json file that specifies your port configuration. This process is similar to defining a non-default port range, but instead you specify a particular port for a specific service or process. If you are going to assign specific ports, this approach is the most robust way to do so because the port mapping is preserved if you export the server configuration and topology settings using the
tsm settings export command.
To define ports at installation, add information to your configuration file to specify the node (
workerN), process (
servicename) and instance ID (
instanceid), port type (
porttype), and the port to be used. The format looks like this:
workerNis an optional parameter and identifies the node for which the remapping applies. Node numbers start with zero (0).
We recommend you do not include this parameter unless you need to map different ports for the same service on different nodes. If you leave this parameter off, you can map a service port on the initial node, or map the same service port on multiple nodes.
servicenameis the name of the process or service that will use the port.
instanceidis the instance of the process. If you are going to be configuring multiple instances of a process on one node, you would need to increment this value for each instance. Start the instanceid at zero (0) and increment it by one (1) for each instance of the process. For services that only install a single instance on any given node, this must be left off.
porttypeIf setting the primay port, do not include this option.
portis the port the process or service should use.
For example, to set the port for the first instance of the file store process on the initial node to 8500, you would include a configuration file entry similar to this:
The example above does not include the optional workerN parameter, so sets the port on all nodes in the cluster. It also leaves off the porttype option because it is setting the primary filestore port.
Important: When specifying port changes with a configuration file, you must include the
--force-keys parameter with the
tsm settings import command.
Configuring ports after installation
If you need to change ports after you have installed Tableau Server, use the
tsm topology set-ports command. This approach allows you to specify a port for a specific process after that process has been installed. You are restricted by these limits:
- You must set ports individually, on each node.
- After you set an individual port, you must run
- The port assignments are not preserved if you need to import a Tableau Server configuration using
tsm settings import.
- Port names use a different syntax for tsm commands than the syntax that is required for configKeys. The table at the end of this topic provides a syntax reference.
For example, to set second instance of the file store on the initial node to use port 8500:
tsm topology set-ports --node-name node1 --port-name filestore --port-value 8500 --instance 2
The following example shows how to use shorthand commands to set the JMX ports:
tsm topology set-ports -n node1 --port-name vizqlserver:jmx.rmi -pv 9403 -i 1
tsm topology set-ports -n node1 --port-name vizqlserver:jmx -pv 9404 -i 2
Note: Port entries are not validated when you enter them. Therefore, if you use a port that is already assigned, or if you mistype the syntax for a command, Tableau will not give an error until you restart. After restarting, you may see a generic error, The reconfigure async job failed.
If you add an incorrect portname:type with a valid port, you cannot delete the incorrect entry. To update the port, you must reassign an unused port to that value to free up the port again.
Ports that are not dynamically mapped
The Tableau Server repository uses two ports that are not dynamically mapped. These each have a default port that you can override using the
tsm configuration set command and a process-specific parameter.
|Port names||Port (default)||Description|
|pgsql.port||8060||Port for the Tableau Repository (PostgreSQL database).|
To override this port:
|pgsql.verify_restore.port||8061||Port for verifying the integrity of a repository backup.|
to override this port:
Because these ports do not use the dynamic port mapping system, they do not show up in the output of the
tsm topology list-ports command. To see the value of these you need to use the
tsm configuration get -k <config.value> command. For example:
tsm configuration get -k pgsql.port
Controlling port remapping with initialise-tsm
Port assignments are made when services are installed. This means that in order to manually map ports for the TSM-specific processes, you need to assign the ports when you run the initialise-tsm script. The script includes options to specify ports for individual TSM services, as well as options for defining the minimum and maximum of the port range used with dynamic mapping, and you can disable dynamic mapping.
The table below lists the options for ports when running the initialise-tsm script.
|-i||<port>||Sets the Coordination Service client port.|
|-e||<port>||Sets the Coordination Service peer port.|
|-m||<port>||Sets the Coordination Service leader port.|
|-n||<port>||Sets the TSM agent file transfer port.|
|-o||<port>||Sets the TSM Controller port.|
|-l||<min-port>||Sets the bottom of the port range used for dynamically mapping ports.|
|-r||<max-port>||Sets the top of the port range used for dynamically mapping ports.|
|--disable-port-remapping||Disables dynamic port mapping. If you do this you must assign ports for every service or process used by TSM and Tableau Server. For more information, see Manual port assignment above.|
Dynamically mapped ports
This table lists the processes or services that use dynamically mapped ports.
|Port names: syntax for json file (configKeys)||Port names: syntax for tsm CLI||Description|
|appzookeeper_0.client.port||appzookeeper:client||Coordination Service client port.|
|appzookeeper_0.peer.port||appzookeeper:peer||Coordination Service peer port.|
|appzookeeper_0.leader.port||appzookeeper:leader||Coordination Service leader port.|
|backgrounder_0.port||backgrounder||Backgrounder primary port.|
|backgrounder_0.debug.port||backgrounder:debug||Backgrounder debug port.|
|backgrounder_0.jmx.port||backgrounder:jmx||Backgrounder jmx port.|
|backgrounder_0.jmx.rmi.port||backgrounder:jmx.rmi||Backgrounder jmx rmi port.|
|backgrounder_0.recommendations.trainer.port||backgrounder:recommendations.trainer||Backgrounder recommendations port.|
|backuprestore.port||backuprestore||Backup/Restore service port.|
|cacheserver_0.port||cacheserver||Cache server port.|
|clustercontroller.status.port||clustercontroller:status||Cluster Controller status port.|
|clustercontroller.storage.port||clustercontroller:storage||Cluster Controller storate port.|
|databasemaintenance.port||databasemaintenance||Database Maintenance port.|
|dataserver_0.port||dataserver||Data server primary port.|
|dataserver_0.debug.port||dataserver:debug||Data server debug port.|
|dataserver_0.jmx.port||dataserver:jmx||Data server jmx port.|
|dataserver_0.jmx.rmi.port||dataserver:jmx.rmi||Data server jmx rmi port.|
|filestore.port||filestore||File store primary port.|
|filestore.status.port||filestore:status||File Store status port.|
|gateway.port||gateway||Gateway port. This defaults to 80, and if that is not available, to 8080. If that is not available, it tries 8000. That sequence is followed whether or not dynamic port assignment is enabled or not. If none of those ports are available and dynamic mapping is enabled, it takes an available port within the defined range. The gateway port must be the same on all nodes in a multi-node cluster, so if port 80 is selected on the initial node this is the port that will be used on all nodes and if it is unavailable on one of the other nodes, gateway port selection will fail.|
|hyper.port||hyper||Data engine primary port.|
|hyper.connection.port||hyper:connection||Data engine connection port.|
|licenseservice.vendor_daemon.port||licenseservice:vendor_daemon||Licence service vendor daemon port. Used for licensing-related communications between nodes in a multi-node installation.|
|samlservice.port||samlservice||SAML service port.|
|searchserver.port||searchserver||Search server primary port.|
|searchserver.debug.port||searchserver:debug||Search server debug port.|
|searchserver.jmx.port||searchserver:jmx||Search server jmx port.|
|searchserver.jmx.rmi.port||searchserver:jmx:rmi||Search server jmx rmi port.|
|searchserver.startup.port||searchserver:startup||Search server startup port.|
|siteimportexport.port||siteimportexport||Site Import/Export port.|
|tabadmincontroller.port||tabadmincontroller||TSM Controller port.|
|tabadminagent.columbo.port||tabadminagent:columbo||Administration Agent service discovery port|
|tabadminagent.filetransfer.port||tabadminagent:filetransfer||TSM Agent file transfer port.|
|vizportal_0.authentication.port||vizportal:authentication||Application server authentication port.|
|vizportal_0.authorization.port||vizportal:authorization||Application server authorization port.|
|vizportal_0.maintenance.port||vizportal:.maintenance||Application server maintenance port.|
|vizportal_0.microservice.extensions.port||vizportal:.microservice:extensions||Application server extensions port.|
|vizportal_0.monolith_grpc.port||vizporta:monolith_grpc||Application server GRPC port.|
|vizportal_0.publishing.port||vizportal:publishing||Application server publishing port.|
|vizportal_0.recommendations.port||vizportal:recommendations||Application server recommendations port.|
|vizportal_0.port||vizportal||Application server primary port.|
|vizportal_0.debug.port||vizportal:debug||Application server debug port.|
|vizportal_0.jmx.port||vizportal:jmx||Application server jmx port.|
|vizportal_0.jmx.rmi.port||vizportal:jmx.rmi||Application server jmx rmi port.|
|vizqlserver_0.port||vizqlserver||VizQL server primary port.|
|vizqlserver_0.debug.port||vizqlserver:debug||VizQL server debug port.|
|vizqlserver_0.jmx.port||vizqlserver:jmx||VizQL server jmx port.|
|vizqlserver_0.jmx.rmi.port||vizqlserver:jmx.rmi||VizQL server jmx rmi port.|