Connecting Striim Cloud on Azure to data services behind Striim Forwarding Agent
Note
This topic applies only to Striim Cloud on Azure (Enterprise and Mission Critical).
If you run a Striim Forwarding Agent on-premises to push data to Striim Cloud, you can also secure its connection via Private Link Service. In this case the agent initiates the connection (egress from your network), so no inbound firewall rules are needed. Private Link enforces a one-way connection from your agent to Striim Cloud.
For more information on the Striim Forwarding Agent, see the Using the Forwarding Agent and Striim Forwarding Agent installation and configuration topics.
Prerequisites
Before proceeding with the setup, ensure the following requirements are met:
An Azure subscription with a VNet (at least two subnets) in the same region as your Striim Cloud service.
Java 17 installed on the agent VM (required for Striim Cloud 5.4.0.2 and later)
The Striim cluster
sysuser password received through emailYour Azure subscription ID (needed during Private Link Service creation).
A Site-to-Site VPN or ExpressRoute between your network and the Azure VNet.
The agent must be able to reach the Azure VNet on TCP ports 30000, 30002, 30003, 30005, 30006, and 30010.
Admin rights to create resources in the Azure subscription.
Your Striim Cloud instance running in the same region as the Azure VNet.
Setting up Azure Private Link for the Striim forwarding agent
Performing these steps ensures that your Striim forwarding agent securely connects to Striim Cloud over Azure Private Link, eliminating exposure to the public internet while maintaining a private, secure, and scalable connection.
Provision Private Link access from the Striim Cloud console
You can provision the Private Link Service for your service directly from the Striim Cloud console. No support ticket is required.
Log in to your Striim Cloud account and open the service you want to connect the agent to.
Navigate to the Secure Connection tab, then select the Service Attachments tab.
Click Create Service Attachment and enter your Azure Subscription ID. Connection requests originating from this subscription are whitelisted for automatic approval.
Example Azure Subscription ID:
123456h9-78a2-9012-3bca-45bcde67fgh8
Allow a few minutes for the Private Link Service to be provisioned. When provisioning is complete, the service attachment and its connection details are displayed in the Service Attachments tab, and an email notification containing the connection details, including the Private Link Service (PLS) alias, is sent to you.
Example PLS alias:
identifier-1234-psc.5abc56d7-defg-8h90-1a23-4abcdefghij567h8.eastus2.azure.privatelinkservice
Create a private endpoint in Azure
Log in to the Azure Portal.
Search for "Private Endpoints" and choose Create.
Configure the basic settings:
Subscription: Choose the subscription associated with the site-to-site VPN vNet. This must be the subscription you provided when creating the service attachment.
Resource Group: Select an existing resource group or create a new one.
Name: Assign a meaningful name to the private endpoint.
Network Interface Name: Leave as default.
Region: Select the region matching the site-to-site VPN vNet.
Click Next: Resource.
Configure the resource settings
Connection Method: Select "Connect to an Azure resource by resource ID or alias".
Enter PLS Alias: Use the PLS alias from the service attachment details in the Striim Cloud console or the email notification.
Request Message: Optionally, add a note identifying the connection. Because your subscription is whitelisted, the request is approved automatically and no manual review is required.
Click Next: Virtual Network.
Configure the virtual network settings:
Virtual Network: Choose the vNet configured for this setup.
Subnet: Select a subnet within the vNet.
Private IP Configuration: Leave as default (dynamic allocation).
Click Next: DNS.
Configure the DNS settings:
Leave as default (no DNS settings are required for this setup).
Click Next: Tags (optional: add tags for resource management).
Click Next: Review + Create.
Click Create to deploy the private endpoint.
Verify that the connection is established. The endpoint connection request is accepted automatically by Striim. In the Striim Cloud console, check the Endpoint Connections table on the Service Attachments tab. When the endpoint shows an Accepted status, the service is ready for agent connectivity.
Retrieve the private IP address for the Striim forwarding agent
Once the private endpoint is successfully created, perform the following steps:
Navigate to the Private Endpoints section in Azure.
Select the newly created private endpoint.
Under Settings, choose DNS Configuration.
Locate the Private IP Address assigned to the private endpoint.
Use this Private IP Address in the Striim Forwarding Agent configuration.
Configure the Agent VM for a new installation
Complete the following tasks on the agent VM to install the Striim Agent, configure it to connect to your Striim cluster, and set up the keystore. Perform the steps in the order shown.
Verify Java version
The agent requires Java 17 for Striim versions 5.4.0.2 and later.
java -version
Install Java 17 if it is not already present.
Download and install the agent
Download the Striim Agent package matching your service version (e.g., Striim_Agent_<striim-version>.tgz).
tar -xvzf Striim_Agent_<striim-version>.tgz sudo mkdir -p /opt/striim sudo cp -r Agent /opt/striim/ sudo chown -R root:root /opt/striim sudo chmod +x /opt/striim/Agent/bin/*.sh
Update /etc/hosts
Add the following entries to /etc/hosts, replacing <endpoint-IP> with the private endpoint IP address from the Striim email.
<endpoint-IP> striim-node-0.striim-subdomain.default.svc.cluster.local <endpoint-IP> stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local
Note
For Striim Cloud Mission Critical also add:
<endpoint-IP> striim-node-1.striim-subdomain.default.svc.cluster.local
Configure agent.conf
Edit /opt/striim/Agent/conf/agent.conf with the following content:
###################### ## Basic fields for agent ###################### striim.cluster.clusterName=Striim striim.cluster.hazelcast.discovery.enabled=false striim.cluster.deploymentGroups=Agents striim.cluster.https.enabled=true striim.node.servernode.address=striim-node-0.striim-subdomain.default.svc.cluster.local striim.node.httpPort=30002 striim.node.httpsPort=30003 striim.node.hazelcast.port=30000 striim.hazelcast.client.smartrouting=false #Additional ports to be opened (required for 5.4.0.6 and later) striim.cluster.stream.proxy.address=tcp://stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local:30005 striim.cluster.stream.proxy.heartbeat.address=tcp://stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local:30006 # Memory settings — adjust based on VM size MEM_MIN=256m MEM_MAX=1024m
Note
For Striim Cloud Mission Critical also add:
<endpoint-IP> striim-node-(n).striim-subdomain.default.svc.cluster.local
If you have multiple nodes, add an entry for each node. For example, for two nodes you would add:
<endpoint-IP> striim-node-0.striim-subdomain.default.svc.cluster.local <endpoint-IP> striim-node-1.striim-subdomain.default.svc.cluster.local
Set up the keystore
Run the keystore setup utility and enter the Striim sys user password when prompted:
cd /opt/striim/Agent/bin sudo ./aksConfig.sh sudo chown striim /opt/striim/Agent/conf/aks.jks sudo chown striim /opt/striim/Agent/conf/aksKey.pwd
Validate Network Connectivity
Before starting the agent, verify that your VM can reach the private endpoint on all required ports:
telnet <endpoint-IP> 30000 # Hazelcast — must succeed for agent to connect telnet <endpoint-IP> 30002 # HTTP telnet <endpoint-IP> 30003 # HTTPS telnet <endpoint-IP> 30005 telnet <endpoint-IP> 30006 telnet <endpoint-IP> 30010
On Windows, use Test-NetConnection -ComputerName <endpoint-IP> -Port <port> instead.
Start the Agent
For the first run, start the agent manually so you can see live output:
cd /opt/striim/Agent/bin sudo ./agent.sh
A successful start looks like:
Striim Agent: Version 5.4.0.6 (...) Connecting to cluster Striim.......connected
Verify in the Striim UI
In the Striim UI, go to and confirm:
The agent appears as connected.
CPU and memory metrics are visible for the agent VM.
Upgrading an existing Agent to the latest Striim Cloud versions
Follow these steps if your Striim service has been upgraded to 5.4.2 and you need to update an existing agent.
Differences between older and latest Striim Cloud versions
Item | Before 5.4.0.6 | After 5.4.0.6 |
|---|---|---|
Agent binary | Old version | Must match 5.4.0.6 |
| Two lines added | |
| One entry (striim-node-0) | Two entries (striim-node-0 + stream-proxy) |
Ports to open | 30000, 30002, 30003, 30010–30509 | 30000, 30002, 30003, 30005, 30006, 30010 |
Stop the existing Agent
On the agent VM:
cd /opt/striim/Agent/bin sudo ./stopAgent.sh
Confirm the agent process has stopped before continuing.
Download the new Agent binary
Download the Striim Agent package for your version of Striim Cloud (must match the upgraded service version exactly).
Replace the existing installation:
tar -xvzf Striim_Agent_5.4.2.tgz sudo cp -r Agent /opt/striim/ sudo chown -R root:root /opt/striim sudo chmod +x /opt/striim/Agent/bin/*.sh
Important
Keep your existing agent.conf and keystore files (aks.jks, aksKey.pwd) — you will update agent.conf in the next step rather than recreating it from scratch.
Update /etc/hosts
Add the following entries to /etc/hosts, replacing <endpoint-IP> with the PSC endpoint IP address from the Striim email.
<endpoint-IP> striim-node-0.striim-subdomain.default.svc.cluster.local <endpoint-IP> stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local
Note
For Striim Cloud Mission Critical also add:
<endpoint-IP> striim-node-1.striim-subdomain.default.svc.cluster.local
Update agent.conf
Open /opt/striim/Agent/conf/agent.conf and add the two stream proxy lines shown below. Leave all existing settings unchanged.
###################### ## Basic fields for agent ###################### striim.cluster.clusterName=Striim striim.cluster.hazelcast.discovery.enabled=false striim.cluster.deploymentGroups=Agents striim.cluster.https.enabled=true striim.node.servernode.address=striim-node-0.striim-subdomain.default.svc.cluster.local striim.node.httpPort=30002 striim.node.httpsPort=30003 striim.node.hazelcast.port=30000 striim.hazelcast.client.smartrouting=false #Additional ports to be openedm(required for Striim Cloud 5.4.0.6 and later) striim.cluster.stream.proxy.address=tcp://stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local:30005 striim.cluster.stream.proxy.heartbeat.address=tcp://stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local:30006 MEM_MIN=256m MEM_MAX=1024m
Note
For Striim Cloud Mission Critical also add:
<endpoint-IP> striim-node-(n).striim-subdomain.default.svc.cluster.local
If you have multiple nodes, add an entry for each node. For example, for two nodes you would add:
<endpoint-IP> striim-node-0.striim-subdomain.default.svc.cluster.local <endpoint-IP> striim-node-1.striim-subdomain.default.svc.cluster.local<endpoint-IP> striim-node-1.striim-subdomain.default.svc.cluster.local
Validate Connectivity
Confirm the agent VM can reach all required ports (including the two new stream proxy ports):
telnet <endpoint-IP> 30000 telnet <endpoint-IP> 30002 telnet <endpoint-IP> 30003 telnet <endpoint-IP> 30005 # New telnet <endpoint-IP> 30006 # New telnet <endpoint-IP> 30010
If any of ports 30005, 30006, or 30010 are blocked, update your Azure NSG outbound rules to allow them before starting the agent.
Start the Agent
cd /opt/striim/Agent/bin sudo ./agent.sh
Check the console output for a successful connection message. Then verify in the Striim UI under that the agent appears connected and metrics are visible.
Troubleshooting
Agent does not connect after upgrade. When the Agent does not connect after upgrade, verify the following:
Confirm the agent binary version matches the service version.
Confirm
/etc/hostshas both the striim-node-0 and stream-proxy-deployment entries.Confirm
agent.confhas bothstriim.cluster.stream.proxy.addressandstriim.cluster.stream.proxy.heartbeat.address.Test port 30000 — if it fails, the agent cannot connect regardless of other settings.
Test ports 30005 and 30006 — if they fail, connected state may appear but data flows will stop.
Agent connects but applications stop reading data. This almost always means port 30005 or 30006 is blocked. Test outbound connectivity to those ports and update Azure NSG rules if needed.
UnknownHostException: stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local. The stream proxy hostname entry is missing from /etc/hosts. Add the line:
<endpoint-IP> stream-proxy-deployment.stream-proxy-service.default.svc.cluster.local
Then restart the agent.