K89999342: BIG-IP Daemons (12.x)

Topic

This article applies to BIG-IP 12.x. For information about other versions, refer to the following articles:

The BIG-IP system daemons perform a variety of functions, such as managing load-balanced traffic, configuring and controlling the switch chips, monitoring the health and performance of pool members, and performing high availability (HA) failover actions.

Description

The following table lists a description for the BIG-IP daemons, the impact to the BIG-IP system operation if the daemon is not running, and any relevant log files.

Daemon	Description	Impact if not running	Relevant log files
alertd	The alert daemon monitors system error messages and triggers proper actions, such as sending snmptrap and displaying messages on the panel.	No alerts	/var/log/ltm
autodosd	The autodosd process is a control plane process which supports the BIG-IP AFM DoS Auto Threshold feature.	Thresholds for denial of service (DoS) alert and rate limit are no longer set automatically.	/var/log/ltm
avrd	The avrd process collects, aggregates, and publishes application performance data for the BIG-IP Analytics module.	The BIG-IP Analytics module does not collect, aggregate, and publish application performance data	/var/log/avr/avrd.log
bcm56xxd	The switch daemon configures and controls the Broadcom 56xx switch chips.	No switch traffic, LEDs not functional, STP and LACP not functional	/var/log/ltm /var/log/bcm56xxd
bdosd	The Behavioral DoS daemon (bdosd) is a control plane process that supports the BIG-IP AFM DoS Dynamic Signatures feature.	No automatic generation of signatures for DoS attack detection and mitigation.	/var/log/bdosd
bigd	The bigd monitor daemon provides system health checks.	Monitoring not available	/var/log/ltm
big3d	The big3d process is used by BIG-IP GTM and Enterprise Manager to collect statistics from remotely managed BIG-IP LTM devices. This process is also used by BIG-IP GTM for auto-discovery of objects.	No statistics collection or auto-discovery of objects	/var/log/em /var/log/gtm
cbrd	The XML content based routing daemon provides document parsing functionality for the XML profile.	Virtual servers cannot parse XML documents	/var/log/cbr/cbrd.log /var/log/ltm
cand	The cand process manages the CAN buses for multiple clients (over UDP/SLIP/PPP). It manages utility communication between all cards in the VIPRION chassis, fan trays, and the Annunciator panel.	Loss of function and communication between devices in the CAN bus	/var/log/ltm
chmand	The chassis manager daemon implements the following HAL capabilities: platform identification, synchronization with SCCP/AOM, device discovery, chassis sensor monitoring, and chassis configuration (management & serial interfaces).	Cannot perform platform ID, enumerate interfaces, and push/publish platform info to MCPD	/var/log/ltm
clusterd	The clusterd process manages blade clustering for VIPRION systems.	Blade clustering does not function	/var/log/ltm
crond	The cron daemon executes scheduled commands and scripts.	Cannot execute scheduled commands	/var/log/cron /var/log/daemon.log
csyncd	For all platforms, the csyncd process populates the software image table. Additionally, on VIPRION systems, the csyncd process replicates portions of the file system between cluster members.	For all platforms, the software image table is not updated, and users cannot view or manage the latest software image list using the Configuration utility. Additionally, on VIPRION systems, no synchronization among cluster members	/var/log/ltm
DBDaemon	DBDaemon is a multi-threaded long-running Java process which is used by the bigd process to perform SQL monitoring.	SQL monitoring does not function	*/var/log/DBDaemon-[0-9].log**
devmgmtd devmgmtd++	The device management daemon establishes and maintains device trust group functionality.Note: Beginning in BIG-IP 11.4.0 the devmgmtd++ daemon became the active daemon for this service. However, the devmgmtd daemon is still part of the installed daemons.	Loss of device trust functionality	/var/log/devmgmtd.out /var/log/ltm
diskevent	The diskevent daemon monitors additions/removals of disks and major disk errors on multi-disk systems.Note: Beginning in BIG-IP 12.1.0, the diskevent daemon is no longer used for disk monitoring. However, the Linux init script (/etc/init.d/mdmonitor) is used instead of diskevent daemon.	No monitoring/logging of major disk errors on multi-disk systems	/var/log/daemon.log
dpid	The Deep Packet Inspection daemon (dpid) collects classification statistics for the BIG-IP AVR and PEM applications.	Traffic classification statistics are not available	/var/log/pem/dpid.log
dwbld	The dynamic white/black daemon (dwbld) is a Control Plane daemon that supports the BIG-IP AFM IP intelligence feature.	Enforcement of dwbl does not happen	/var/log/dwbl/dwbld.log
errdefsd	Logging daemon that moves logs out of TMM into a userland application and moves logs to logging publishers.	Required for using HSL over management interface	/var/log/ltm
eventd	The event daemon provides asynchronous event notification, using iControl messaging.	iControl-based subscription messaging fails	/var/log/ltm
evrouted	The evrouted process handles all events on the local control plane and directs the messages to the appropriate subscribed process.	Processes that subscribe to the evrouted process does not receive any information	When the log.evrouted.level database key is configured with Debug, debug messages are logged to the /shared/tmp/evrouted.out file.
fpdd	The front panel display daemon draws screens on the LCD panel and manages LEDs on all platforms.	No front panel access or data	/var/log/ltm
gtmd	The gtmd process initiates iQuery connections to big3d, processes monitor and path probe requests, forwards response information to TMM, as needed.	Global traffic functionality is not performed.	/var/log/gtm
guestagentd	guestagentd runs on a vCMP guest for the purpose of communicating information such as system version, provisioning, high availability status, and TMM-related information to the vCMP host.	vCMP guest information and statistics will not be communicated to the vCMP host.	/var/log/ltm
hostagentd	hostagentd runs on a vCMP host for the purpose of receiving information, such as system version, provisioning, high availability, and TMM-related information from the vCMP guest.	vCMP guest information and statistics will not be received from the vCMP guest.	/var/log/ltm
httpd	The http daemon performs HTTP web server functions.	The BIG-IP Configuration utility does not function	/var/log/httpd/httpd_errors
hwpd	The hwpd process assists ePVA/DNS hardware acceleration functions (only present on A112/B2250 blades)	ePVA/DNS hardware Acceleration will not function	/shared/tmp/hwpd.out
icrd_child	The iControl Rest Child daemon (icrd_child) is used for mapping tmsh commands to/from REST API requests.	No command access for iControl using REST	/var/log/icrd
iprepd	The iprepd daemon is responsible for interaction with 3rd parties (Webroot/BrightCloud), to bring IP Intelligence functionality to the BIG-IP system. This daemon connects to the BrightCloud server, downloads the IP reputation database, and shares it with the Data plane of different modules, like LTM, ASM, AFM, etc. This database contains a list of IP addresses and their threat codes.	The IP reputation database will not be updated	/var/log/iprepd/iprepd.log
istatsd	The istatsd process monitors control/data plane events.	No control/data plane event monitoring	/var/log/ltm
lacpd	The link aggregation control daemon creates link aggregation groups (trunks) based on user configuration. It implements IEEE 802.3ad – Link Aggregation Control Protocol (LACP). It also implements the high-availability feature Switchboard Failsafe.	No link aggregation functionality	/var/log/ltm
lind	The lind process manages software installation/volume creation tasks.	No software installation functionality	/var/log/ltm
lldpd	The lldpd process interacts with bcm56xxd to receive and send LLDP PDUs. lldpd collects BIG-IP local information from mcpd and sends out the LLDP PDU per EEE 802.1ab specification on LLDP TX-enabled ports. When lldpd receives LLDP PDU on an LLDP RX-enabled port, lldpd saves or modifies the neighbor information as statistics. lldpd checks to see if bcm56xxd is running, so this daemon only runs on hardware platforms, not virtual editions.	LLDP attributes will not be advertised	/var/log/ltm
logstatd	The logstatd process parses log data for utilities such as the BIG-IP Dashboard.	Loss of some logging data; the Dashboard utility does not function	/var/log/ltm
lopd	The lopd process is the lights-out processor (LOP) daemon for the following BIG-IP platforms: VIPRION 2400, 5xx0 (C109), 20×0 (C112), 40×0 (C113), 7xx0 (D110), 100×0/102×0 (D113).	The LOP subsystem does not function	/var/log/ltm
mcpd	The master control program daemon is the messenger service that allows two-way communication between userland processes and the Traffic Management Microkernel (TMM).	No traffic management functionality; the system status cannot be retrieved or updated, and the system cannot be re-configured; other daemons will not be functional	/var/log/ltm
merged	The merged process integrates statistical data at defined intervals.	Statistical data is not available for system utilities/graphs	/var/log/ltm
monpd	The monpd process is used in conjunction with the avrd process for reporting/charts.	No reporting charts are displayed	/var/log/avr/monpd.log
named	The named process is the DNS server daemon.	No BIND functionality	/var/log/messages /var/log/daemon.log
ntlmconnpool	The ntlmconnpool daemon is the plug-in process for the NTLM profile.	NTLM connection pooling does not function as expected	/var/log/ltm
ntpd	The ntp daemon sets and maintains the system time.	System time is not updated	/var/log/ltm /var/log/daemon.log
overdog	The overdog process monitors the high availability table for failover action types of restart, restart-all or reboot. When the overdog process receives a signal that one of these failover action types is true, the configured failover action is triggered. This process cannot be managed using the Traffic Management Shell (tmsh).	Failover action types of restart, restart-all or reboot will not occur.	/var/log/ltm
ovsdb-server	The ovsdb-server daemon communicates with OVSDB-capable controllers to receive VXLAN tunner endpoint configuration information.	BIG-IP cannot be managed via the OVSDB protocol	/var/log/openvswitch/ovsdb-server.log /var/tmp/vxland.out
pfmand	The pfmand process handles link monitoring, link statistics, and media settings for some platforms such as the BIG-IP 2000 and 4000 series.	Link monitoring, link statistics, and media settings lose functionality	/var/log/daemon.log
pgadmind	Starts up PostgreSQL server process and monitors it. pgadmind is primarily used for AFM in-line rule editor but it is also used for system configuration.	If the Inline Rule Editor is enabled, and the PostgreSQL server process is not running due to the pgadmind daemon being stopped, firewall rules cannot be viewed or edited either using the Inline Rule Editor page or the default firewall rule editor UI.	/var/log/ltm
pkcs11d	The pkcs11d process acts as an interface between the BIG-IP daemons/utility that need to access the third-party network- connected HSMs (like Thales and Safenet).	SSL connections cannot be established on a virtual server that is associated with an SSL profile that references the affected certificate/key pair stored on the Thales HSM.	/var/log/pkcs11d.debug
pvad	The packet velocity accelerator daemon runs on systems equipped with the PVA ASIC chip.	The PVA runs in wire mode	/var/log/ltm
racoon	The racoon daemon is an open source user-space daemon running on the Linux system. This daemon handles Internet Key Exchange (IKE) for IPsec.Note: Beginning in BIG-IP 12.0.0, to manage (such as start, stop or restart) the racoon service, you must perform the action on the tmipsecd service. Process dependencies will apply the action to the racoon service. For more information, refer to K33404337: The tmsh and bigstart utilities can no longer be used to individually manage the racoon process.	IPsec tunnels will not function	/var/log/racoon.log
restjavad	The restjavad daemon provides control-plane access to the BIG-IP using an http REST api.	Limited REST access to the control plane	*/var/log/restjavad.[0-9].log**
restnoded	The restnoded daemon provides control-plane access to the BIG-IP using an http REST api.	Limited REST access to the control plane	*/var/log/restnoded.[0-9].log**
rmonsnmpd	The RMON snmp daemon provides remote monitoring, alarm, and event functionality.	Partial loss of SNMP functionality	/var/log/daemon.log
scriptd	The scriptd process runs application template implementation scripts when an application service is created or updated.	Scripts are not started/stopped as expected	/var/log/ltm /var/tmp/scriptd.out
sflow_agent	The sflow_agent is an SNMP subagent that handles polling and SNMP accessibility.	The sflow data will not be available by way of SNMP	/var/log/sflow_agent.log
snmpd	The snmp daemon is the master SNMP agent. Without this daemon, no data is exposed by SNMP, including data from the SNMP subagents. The process also exposes common SNMP data.	No SNMP functionality	/var/log/daemon.log /var/log/ltm
sod	The switch over (failover) daemon causes the unit to become active or standby and provides failover capability through a high-availability table.	No failover capability	/var/log/ltm
sshd	The ssh daemon provides remote access to the BIG-IP system command line interface.	No SSH command line access	/var/log/daemon.log
statsd	The stats daemon collects statistics from the system and records them in the rrd files.	No rrd data recorded for system graphs	/var/log/ltm
stpd	The stp daemon implements the IEEE Spanning Tree Protocol (STP) to prevent bridge loops. The protocols include the original STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP).	No bridge loop detection	/var/log/ltm /var/log/daemon.log
syscalld	The syscall daemon manages system call functions.	Loss of system call functions	/var/log/ltm
syslog-ng	The syslog-ng process performs system logging based on the syslog-ng utility.	Unable to generate system logs	/var/log/messages /var/log/daemon.log
tamd	The traffic authorization daemon authorizes traffic.	No remote authentication/authorization functionality	/var/log/ltm /var/log/secure
tmipsecd	The tmipsecd process subscribes to notifications from IPsec-related configuration objects.	No IPsec-related notifications	/var/log/tmipsecd
tmm	The traffic management microkernel is the process running on the BIG-IP host O/S that performs all of the local / global traffic management for the system.	Loss of all traffic management functionality for the system	/var/log/tmm /var/log/ltm
tmrouted	The routing table management daemon updates the TMM routing table based on the kernel routing table.	TMM cannot learn or advertise routes	/var/log/ltm
tomcat	The tomcat daemon provides web server functions for the BIG-IP web utility. Tomcat is an open-source implementation of Java Servlet and JavaServer Pages technologies developed under the Jakarta project at the Apache Software Foundation.	The BIG-IP Configuration utility does not function	/var/log/tomcat/catalina.out
vcmpd	The vcmpd process performs most of the work to create and manage guests, as well as configure the virtual network.	The BIG-IP system will not be able to manage or run vCMP guests.	/var/log/ltm /var/log/vcmp
vxland	The vxland daemon manages multicast sockets and routing for IGMP protocol activity; it also manages OVSDB-controlled VXLAN configurations.	VXLAN traffic is impaired	/var/tmp/vxland.out
zrd	The zrd process is the ZoneRunner daemon. This daemon is active only on systems running the BIG-IP GTM module.	ZoneRunner does not function	/var/log/gtm
zxfrd	The zxfrd process manages zone transfers and writes to the zone database files.	The DNS Express feature does not function as expected	/var/log/ltm

Recommendations

You can stop, start, restart, or view the status of a daemon, using the Traffic Management Shell (tmsh), bigstart command, or the Configuration utility.

Using tmsh

To stop, start, restart, or view the status of a daemon using tmsh, use the following command syntax:

tmsh stop /sys service <service name>
tmsh start /sys service <service name>
tmsh restart /sys service <service name>
tmsh show /sys service <service name>

For example, to restart the named daemon, you would type the following command:

tmsh restart /sys service named

Using the bigstart command

To stop, start, restart, or view the status of a daemon using the bigstart command, use the following command syntax:

bigstart stop <service name>
bigstart start <service name>
bigstart restart <service name>
bigstart status <service name>

For example, to display the status of the named daemon, you would type the following command:

bigstart status named

Using the Configuration utility

You can use the Configuration utility to stop, start, restart, or view the status of some system services. To do so, perform the following procedure:

Log in to the Configuration utility.
Navigate to System > Services.
In the Service column, locate the name of the service you want to start, stop, or restart.
Select the check box next to the service name.
Click Start, Stop, or Restart.
To confirm the action, click OK.

BIG-IP daemons (12.x)