Tableau Services Manager Ports

The processes and services that make up the components of Tableau Services Manager (TSM) and Tableau Server on Windows use various ports to communicate. By default, most these ports are assigned (mapped) dynamically from a predefined range of ports. The port assignments are made for each service or process when it is installed. You can control what ports are used in a variety of ways.

A small subset of processes do not use dynamic port mapping and behave uniquely. For more information, see Ports that are not dynamically mapped, below.

Note: This operation includes steps that you may need to perform using the TSM command line. To use the TSM CLI, you need administrator access to the command line on one of the nodes in your installation and TSM administrator credentials to run TSM commands.

Firewall requirements

If you are running a firewall on the computer where you will be installing Tableau Server, then you will need to open the following default ports for Tableau Server traffic. All port numbers, except 443, can be changed.


Distributed / High Availability

443TCPSSL. When Tableau Server is configured for SSL, the application server redirects requests to this port. Do not change this port.X 
8850TCPTableau Services Manager.X 
8060TCPPostgreSQL database.X 
8061TCPPostgreSQL backup verification portX 
8000-9000TCPRange of ports reserved by default for dynamic mapping of Tableau processes X
27000-27009TCPRange of ports used by Tableau Server for Licence service. This range must be open on the node running the Licence service and accessible from other nodes. By default, the initial node runs the Licence service.X 

Port assignment

There are two approaches you can use for port assignment or mapping in TSM:

  • Dynamic port assignment. This is the default and requires the least intervention by the administrator.
  • Manual port assignment. This option requires an administrator to individually assign each port.

If you change port assignments and you are running a local firewall, see Local firewall configuration.

Dynamic port assignment

You can control which ports are used by changing the range of ports available to the dynamic assignment process. Doing this leaves dynamic port assignment in place but restricts the ports that can be chosen. With dynamic port assignment in place, you can still choose to assign ports for certain processes manually. This approach enables you to assign specific ports to specific processes, while leaving the others to be mapped dynamically. Using dynamic mapping, with or without some individually assigned ports is the easiest approach, and should satisfy the requirements of most customers. Dynamically assigned ports are preserved if you export your Tableau Server configuration.

By default, ports are assigned for each service or process from available ports between 8000 to 9000. This assignment takes place when services are installed for the first time on a node. After Tableau Server is initialised, you can see which ports are being used by which services or processes by running this command:

tsm topology list-ports

If you have a multi-node cluster, ports on all nodes are listed.

Changing the port range

For organisations that have specific requirements for ports being used, the easiest way to control this is to change the range from which ports are dynamically selected. You need to do this at installation, by specifying a minimum and maximum port for the range in your configuration file.

Note: The minimum allowable size of your port range will depend on your server installation and how many services or processes you are running. As a general best practice you should not restrict the range too tightly because port assignment is done by selecting random ports within the range, and if you do not allow a large enough range, selection may fail to find an available port.

To limit the range from which available ports are chosen to those between 8300 and 8600, your configuration file would include an entry similar to this:

"configKeys": {
"ports.range.min": "8300", "ports.range.max": "8600"

Blocking specific ports within the range

Beginning with version 2021.1.0, you can specify certain ports that are within the dynamically assigned range but should not be used by Tableau. This is useful if you have other software on your Tableau Server computers that rely on ports within the range Tableau is using.

To specify ports within the range that should not be used by TSM and Tableau Server, use the ports.blocklist configuration key:

tsm configuration set -k ports.blocklist -v <port>[,<port>,<port>]

For example:

tsm configuration set -k ports.blocklist -v 8000,8088, 8090

Disabling dynamic port assignment

If you need more control of port assignment than you can get through a combination of restricting port range and individually assigning ports, you can disable dynamic port mapping at initial server configuration. Disabling dynamic port mapping requires you to manually assign every port for every process, so we don't recommend this unless you need to control every single port assignment.

If you disable dynamic port mapping, you must configure the port for each process on each node of your installation.

To disable dynamic mapping, your configuration file would include an entry similar to this:

"configKeys": {
"service.port_remapping.enabled": false

Important: When you disable dynamic port assignments, the Licence service port range is not included. This range (27000-27009) must be open on the node running the Licence service and accessible from other nodes. By default, the initial node runs the Licence service.

Manual port assignment

You can disable automatic port assignment entirely and assign a port for each process individually. If you do this, you must assign a port for every process on every node. You can assign ports either in a configuration file, when the processes are first installed, or after installation, using a TSM command. Only ports assigned at process installation are preserved if you export your Tableau Server configuration.

You can specify individual ports for specific processes, whether or not dynamic mapping is enabled. You might do this if you want a process to use a particular port, or if you've disabled dynamic mapping. There are two ways to specify ports for processes: during installation or after installation.

Configuring ports during installation

We recommend configuring port assignment during the installation process as described here. Changing ports after installation is a much more labor-intesive process.

To configure ports during installation, create a json file that specifies your port configuration. This process is similar to defining a non-default port range, but instead you specify a particular port for a specific service or process. If you are going to assign specific ports, this approach is the most robust way to do so because the port mapping is preserved if you export the server configuration and topology settings using the tsm settings export command.

To define ports at installation, add information to your configuration file to specify the node (workerN), process (servicename) and instance ID (instanceid), port type (porttype), and the port to be used. The format looks like this:



  • workerN is an optional parameter and identifies the node for which the remapping applies. Node numbers start with zero (0).
    We recommend you do not include this parameter unless you need to map different ports for the same service on different nodes. If you leave this parameter off, you can map a service port on the initial node, or map the same service port on multiple nodes.
  • servicename is the name of the process or service that will use the port.
  • instanceid is the instance of the process. If you are going to be configuring multiple instances of a process on one node, you would need to increment this value for each instance. Start the instanceid at zero (0) and increment it by one (1) for each instance of the process. For services that only install a single instance on any given node, this must be left off.
  • porttype If setting the primay port, do not include this option.
  • port is the port the process or service should use.

For example, to set the port for the first instance of the file store process on the initial node to 8500, you would include a configuration file entry similar to this:

"configKeys": {
"filestore_0.port: "8500"

The example above does not include the optional workerN parameter, so sets the port on all nodes in the cluster. It also leaves off the porttype option because it is setting the primary filestore port.

Important: When specifying port changes with a configuration file, you must include the --force-keys parameter with the tsm settings import command.

Configuring ports after installation

If you need to change ports after you have installed Tableau Server, use the tsm topology set-ports command. This approach allows you to specify a port for a specific process after that process has been installed. You are restricted by these limits:

  • You must set ports individually, on each node.
  • After you set an individual port, you must run tsm restart.
  • The port assignments are not preserved if you need to import a Tableau Server configuration using tsm settings import.
  • Port names use a different syntax for tsm commands than the syntax that is required for configKeys. The table at the end of this topic provides a syntax reference.

For example, to set second instance of the file store on the initial node to use port 8500:

tsm topology set-ports --node-name node1 --port-name filestore --port-value 8500 --instance 2

The following example shows how to use shorthand commands to set the JMX ports:

tsm topology set-ports -n node1 --port-name vizqlserver:jmx.rmi -pv 9403 -i 1

tsm topology set-ports -n node1 --port-name vizqlserver:jmx -pv 9404 -i 2

Note: Port entries are not validated when you enter them. Therefore, if you use a port that is already assigned, or if you mistype the syntax for a command, Tableau will not give an error until you restart. After restarting, you may see a generic error, The reconfigure async job failed.

If you add an incorrect portname:type with a valid port, you cannot delete the incorrect entry. To update the port, you must reassign an unused port to that value to free up the port again.

Ports that are not dynamically mapped

The Tableau Server repository uses two ports that are not dynamically mapped. These each have a default port that you can override using the tsm configuration set command and a process-specific parameter.

Port namesPort (default)Description
pgsql.port8060Port for the Tableau Repository (PostgreSQL database).

To override this port:

tsm configuration set -k pgsql.port -v <port>

pgsql.verify_restore.port8061Port for verifying the integrity of a repository backup.

to override this port:

tsm configuration set -k pgsql.verify_restore.port -v <port>

Because these ports do not use the dynamic port mapping system, they do not show up in the output of the tsm topology list-ports command. To see the value of these you need to use the tsm configuration get -k <config.value> command. For example:

tsm configuration get -k pgsql.port

Dynamically mapped ports

This table lists the processes or services that use dynamically mapped ports.

Port names: syntax for json file (configKeys)Port names: syntax for tsm CLI Description
activemqserver.portactivemqserver:primaryActiveMQ Service service port.
activemqserver.openwire.portactivemqserver:openwireActiveMQ Service openwire port.
appzookeeper_0.client.portappzookeeper:clientCoordination Service client port.
appzookeeper_0.peer.portappzookeeper:peerCoordination Service peer port.
appzookeeper_0.leader.portappzookeeper:leaderCoordination Service leader port.
backgrounder_0.portbackgrounderBackgrounder primary port.
backgrounder_0.debug.portbackgrounder:debugBackgrounder debug port.
backgrounder_0.jmx.portbackgrounder:jmxBackgrounder jmx port. 
backgrounder_0.jmx.rmi.portbackgrounder:jmx.rmiBackgrounder jmx rmi port.
backgrounder_0.recommendations.trainer.portbackgrounder:recommendations.trainerBackgrounder recommendations port.
backuprestore.portbackuprestoreBackup/Restore service port.
cacheserver_0.portcacheserverCache server port.
clustercontroller.status.portclustercontroller:statusCluster Controller status port. Controller storate port.
databasemaintenance.portdatabasemaintenanceDatabase Maintenance port.
dataserver_0.portdataserverData server primary port.
dataserver_0.debug.portdataserver:debugData server debug port.
dataserver_0.jmx.portdataserver:jmxData server jmx port.
dataserver_0.jmx.rmi.portdataserver:jmx.rmiData server jmx rmi port.
filestore.portfilestoreFile store primary port.
filestore.status.portfilestore:statusFile Store status port.
gateway.portgatewayGateway port. This defaults to 80, and if that is not available, to 8080. If that is not available, it tries 8000. That sequence is followed whether or not dynamic port assignment is enabled or not. If none of those ports are available and dynamic mapping is enabled, it takes an available port within the defined range. The gateway port must be the same on all nodes in a multi-node cluster, so if port 80 is selected on the initial node this is the port that will be used on all nodes and if it is unavailable on one of the other nodes, gateway port selection will fail.
hyper.porthyperData engine primary port.
hyper.connection.porthyper:connectionData engine connection port.
indexandsearchserver.portindexandsearchserverIndex and Search server primary port.
indexandsearchserver.transport.portindexandsearchserver:transportIndex and Search server transport port.
licenseservice.vendor_daemon.portlicenseservice:vendor_daemonLicence service vendor daemon port. Used for licensing-related communications between nodes in a multi-node installation.
samlservice.portsamlserviceSAML service port.
siteimportexport.portsiteimportexportSite Import/Export port.
tabadmincontroller.porttabadmincontrollerTSM Controller port.
tabadminagent.columbo.porttabadminagent:columboAdministration Agent service discovery port
tabadminagent.filetransfer.porttabadminagent:filetransferTSM Agent file transfer port.
vizportal_0.authentication.portvizportal:authenticationApplication server authentication port.
vizportal_0.authorization.portvizportal:authorizationApplication server authorization port.
vizportal_0.maintenance.portvizportal:.maintenanceApplication server maintenance port.
vizportal_0.microservice.extensions.portvizportal:.microservice:extensionsApplication server extensions port.
vizportal_0.monolith_grpc.portvizporta:monolith_grpcApplication server GRPC port.
vizportal_0.publishing.portvizportal:publishingApplication server publishing port.
vizportal_0.recommendations.portvizportal:recommendationsApplication server recommendations port.
vizportal_0.portvizportalApplication server primary port.
vizportal_0.debug.portvizportal:debugApplication server debug port.
vizportal_0.jmx.portvizportal:jmxApplication server jmx port.
vizportal_0.jmx.rmi.portvizportal:jmx.rmiApplication server jmx rmi port.
vizqlserver_0.portvizqlserverVizQL server primary port.
vizqlserver_0.debug.portvizqlserver:debugVizQL server debug port.
vizqlserver_0.jmx.portvizqlserver:jmxVizQL server jmx port.
vizqlserver_0.jmx.rmi.portvizqlserver:jmx.rmiVizQL server jmx rmi port.


Thanks for your feedback!Your feedback has been successfully submitted. Thank you!