This page is an overview of F5® BIG-IP® AFM™ daemons. For information about other versions, refer to the following pages:
- F5 BIG-IP Daemons (13.x)
- F5 BIG-IP Daemons (12.x)
- F5 BIG-IP Daemons (11.x)
- F5 BIG-IP Daemons (9.x – 10.x)
For information about daemons from other modules, refer to the following pages.
The BIG-IQ® system daemons perform a variety of functions, such as managing BIG-IQ ADC, Cloud, Device and Security resources and role-based access control. These resources can be located on BIG-IP devices in a private local network, a public third-party cloud service, or a combination of both.
The following table lists the core BIG-IQ services, and indicates the impact to the BIG-IQ system operation if the service is not running:
| Daemon | Description | Impact if not running | Relevant log files |
| postgres | Introduced in BIG-IQ 7.1.0, the postgres daemon runs the PostgreSQL relational database and replaces tokumx for storage of the BIG-IQ configuration database. | All BIG-IQ functionality stops. tmsh stops functioning. | /var/log/postgres/postgres<datestamp>.log |
| cman | Cluster management manages cluster quorum and cluster membership. CMAN tracks cluster quorum by monitoring the count of cluster nodes. Introduced in BIG-IQ 7.0.0. | The auto failover HA will be in a broken state. | /var/log/corosync.log |
| pacemaker | A resource manager that can start and stop resources when Auto Failover HA is configured. Introduced in BIG-IQ 7.0.0. | The auto failover HA will be in a broken state. | /var/log/ha_corosync_manage.log /var/log/corosync.log /var/log/pacemaker.log |
| corosync | A messaging component that is responsible for communication between BIG-IQ nodes in a cluster when Auto Failover HA is configured. Introduced in BIG-IQ 7.0.0. | The auto failover HA will be in a broken state. | /var/log/ha_corosync_manage.log /var/log/corosync.log |
| grafana | Provides DoS event dashboard visualizations. Introduced in BIG-IQ 6.0.0. | No DoS event dashboard visualizations | /var/log/grafana/current |
| gunicorn | Provides Web Server Gateway Interface for bigiq_orchestrator scripts. Introduced in BIG-IQ 6.0.0, | Loss of virtual machine deployment functionality | /var/log/orchestrator.log /var/log/gunicorn.out |
| rethinkdb | AppIQ database. Introduced in BIG-IQ 6.0.0. Deprecated from BIG-IQ 7.0.0 | Loss of AppIQ functionality | /var/log/rethinkdb/rethinkdb.log |
| bigiqsnmpd | SNMP subagent that supports snmpgets on certain BIG-IQ attributes. | Partial loss of SNMP functionality | /var/log/daemon.log |
| elasticsearch | This daemon optimizes BIG-IQ’s ability to process event and status messages sent from logging node clusters. Introduced in BIG-IQ 5.0.0. | BIG-IQ does not show recent events or status messages. | /var/log/elasticsearch/eslognode.log |
| guiserver | HTTP web server component that assists the Configuration utility with certain tasks. Provides websocket support (for Configuration utility notifications) and several other low-level services for the Configuration utility. | Partial loss of Configuration utility functionality | /var/log/guiserver.out |
| icrd | The iControl Rest daemon (icrd) is used for mapping tmsh commands to/from REST API requests. | No command access for iControl using REST. | /var/log/icrd |
| restjavad | The core function of the BIG-IQ system is provided by way of restjavad, which implements all of the REST APIs. | All BIG-IQ functionality stops. | /var/log/restjavad.0.log /var/log/restjavad-audit.0.log /var/log/ltm |
| searchd | Elasticsearch instance that stores copies of documents from tokumx for full-text search queries. Introduced in BIG-IQ 5.2.0. | Loss of full-text search functionality | /var/log/searchd/eslognode_deprecation.log /var/log/searchd/eslognode_index_indexing_slowlog.log /var/log/searchd/eslognode_index_search_slowlog.log /var/log/searchd/eslognode.log |
| tokumond | This daemon indexes and optimizes the BIG-IQ system’s database. Introduced in BIG-IQ 5.0.0. | Database queries may return improper results. | /var/log/tokumond |
| tokumx | This daemon starts and stops the BIG-IQ system configuration database. Introduced in BIG-IQ 5.0.0. Deprecated from BIG-IQ 7.1.0 as a daemon; used for upgrades only. | All BIG-IQ functionality stops. | /var/log/tokumx |
| webd | This daemon performs HTTP web server functions. This daemon replaces nginx starting from BIG-IQ 4.4.0. | The BIG-IQ user interface will not be accessible. | /var/log/webd.out /var/log/webd_errors.log /var/log/webd/access.log /var/log/webd/errors.log |
| nginx | This daemon performs HTTP web server functions. This daemon replaces httpd in BIG-IQ version 4.3.0. This daemon is deprecated and replaced with webd starting from BIG-IQ 4.4.0. | The BIG-IQ user interface will not be accessible. | /var/log/nginx.out /var/log/nginx_errors.log /var/log/nginx/access.log /var/log/nginx/errors.log |
| httpd | This daemon performs HTTP web server functions. This is only applicable to BIG-IQ versions 4.0.0 through 4.2.0. This daemon is deprecated and replaced with nginx in BIG-IQ 4.3.0. | The BIG-IQ user interface will not be accessible. | /var/log/httpd/httpd_errors |
| msgbusd | msgbusd is only applicable for BIG-IQ 4.0.0, and is responsible for implementing some of the REST APIs. | The restjavad process is dependent on the msgbusd process, so all BIG-IQ functionality stops. | /var/log/msgbusd |
The following table lists general system services, and indicates the impact to the BIG-IQ system operation if the service is not running:
| Daemon | Description | Impact if not running | Relevant log files |
| alertd | The alert daemon monitors system error messages and triggers proper actions, such as sending snmptrap and displaying messages on the panel. | No alerts | /var/log/ltm |
| bcm56xxd | The switch daemon configures and controls the Broadcom 56xx switch chips.
Note: This daemon runs only on BIG-IQ hardware platforms. |
No switch traffic, LEDs not functional, STP and LACP not functional | /var/log/ltm /var/log/bcm56xxd |
| big3d | The big3d process is used by BIG-IP GTM and Enterprise Manager to collect statistics from remotely managed BIG-IP LTM devices. This process is also used by BIG-IP GTM for auto-discovery of objects. This daemon is only available on BIG-IQ 4.0.0 through 5.1.0; and it is not used by the BIG-IQ system. | No alerts | /var/log/em /var/log/gtm |
| chmand | The chassis manager daemon implements the following HAL capabilities: platform identification, synchronization with SCCP/AOM, device discovery, chassis sensor monitoring, and chassis configuration (management & serial interfaces). | Cannot perform platform ID, enumerate interfaces, and push/publish platform info to MCPD | /var/log/ltm |
| csyncd | For all platforms, the csyncd process populates the software image table. In addition, on VIPRION systems, the csyncd process replicates portions of the file system between cluster members. | For all platforms, the software image table is not updated and users cannot view or manage the latest software image list using the Configuration utility. In addition, on VIPRION systems, no synchronization amongst cluster members | /var/log/ltm |
| diskevent | The diskevent daemon monitors additions/removals of disks and major disk errors on multi-disk systems. | No monitoring/logging of major disk errors on multi-disk systems | /var/log/daemon.log |
| evrouted | The evrouted process handles all events on the local control plane and directs the messages to the appropriate subscribed process. | Processes that subscribe to the evrouted process will not receive any information | When the log.evrouted.level database key is configured with Debug, debug messages are logged to the /shared/tmp/evrouted.out file. |
| fpdd | The front panel display daemon draws screens on the LCD panel and manages LEDs.
Note: This daemon runs only on BIG-IQ hardware platforms. |
No front panel access or data | /var/log/ltm |
| lacpd | The link aggregation control daemon creates link aggregation groups (trunks) based on user configuration. It implements IEEE 802.3ad – Link Aggregation Control Protocol (LACP). It also implements the high availability (HA) feature Switchboard Failsafe.
Note: This daemon runs only on BIG-IQ hardware platforms. |
No link aggregation functionality | /var/log/ltm |
| lind | The lind process manages software installation/volume creation tasks. | No software installation functionality | /var/log/ltm |
| lldpd | The lldpd process interacts with bcm56xxd to receive and send LLDP PDUs. lldpd collects BIG-IP local information from mcpd and sends out the LLDP PDU per EEE 802.1ab specification on LLDP TX-enabled ports. When lldpd receives LLDP PDU on an LLDP RX-enabled port, lldpd saves or modifies the neighbor information as statistics. lldpd checks to see if bcm56xxd is running.
Note: This daemon runs only on BIG-IQ hardware platforms. |
LLDP attributes will not be advertised | /var/log/ltm |
| mcpd | The master control program daemon is the messenger service that allows two-way communication between userland processes and the Traffic Management Microkernel (TMM). | No traffic management functionality; the system status cannot be retrieved or updated, and the system cannot be re-configured; other daemons will not be functional | /var/log/ltm |
| named | The named process is the DNS server daemon. | No BIND functionality | /var/log/messages /var/log/daemon.log |
| restnoded | The restnoded daemon provides control-plane access to BIG-IQ using an HTTP REST API. | Limited REST access to the control plane | /var/log/restnoded.[0-9]*.log |
| rmonsnmpd | The RMON snmp daemon provides remote monitoring, alarm, and event functionality. | Partial loss of SNMP functionality | /var/log/daemon.log |
| snmpd | The snmp daemon is the master SNMP agent. Without this daemon, no data is exposed by SNMP, including data from the SNMP subagents. The process also exposes common SNMP data. | No SNMP functionality | /var/log/daemon.log /var/log/ltm |
| stpd | The stp daemon implements the IEEE Spanning Tree Protocol (STP) to prevent bridge loops. The protocols include the original STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). | No bridge loop detection | /var/log/ltm /var/log/daemon.log |
| syscalld | The syscall daemon manages system call functions. | Loss of system call functions | /var/log/ltm |
| tmm | The traffic management microkernel is the process running on the BIG-IP host O/S that performs all of the base network traffic management for the BIG-IQ system. | Loss of all traffic management functionality for the system | /var/log/tmm /var/log/ltm |
Managing BIG-IQ Daemons
You can use the command line to manage BIG-IQ system services using either the bigstart command or the Traffic Management Shell (tmsh).
Managing BIG-IQ services using the Traffic Management Shell (tmsh)
- To restart all or multiple BIG-IQ services, type one of the following tmsh commands:Important: Stopping or restarting core BIG-IQ services will disrupt the functionality of the BIG-IQ system. If you have configured HA, this will cause a failover event.
- To restart all services, type the following command:tmsh restart /sys service all
- To restart multiple services, use the following syntax:tmsh restart /sys service For example:tmsh restart /sys service restjavad icrd
- To stop, start, restart, or view the status of a BIG-IQ service, use the following command syntax:tmsh /sys service In the previous syntax, note the following:
- refers to the action for the service, such as stop, start, restart, show, or list
- is the name of the BIG-IQ service
For example, to view the status of the webd daemon, type the following command:
tmsh show /sys service webd
Managing BIG-IQ services using the bigstart command
- To restart all or multiple BIG-IQ services, type one of the following bigstart commands:Important: Stopping or restarting core BIG-IQ services will disrupt the functionality of the BIG-IQ system. If you have configured high availability, this will cause a failover event.
- To restart all services, type the following command:bigstart restart
- To restart multiple services, use the following syntaxbigstart restart For example:bigstart restart restjavad icrd
- To stop, start, restart, or view the status of a BIG-IQ service, use the following command syntax:bigstart In the previous syntax, note the following:
- refers to the action for bigstart, such as stop, start, restart, or status
- is the name of the BIG-IQ service
For example, to view the status of the webd daemon, type the following command:
bigstart status webd
