Topic
This article has been archived and is no longer maintained.
Published Date: Jun 12, 2019
Updated Date: Dec 30, 2022
This article applies to BIG-IP 11.x. For information about other versions, refer to the following articles:
- K67197865: BIG-IP daemons (14.x)
- K05645522: BIG-IP daemons (13.x)
- K89999342: BIG-IP daemons (12.x)
- K8035: BIG-IP daemons (9.x – 10.x)
The BIG-IP system daemons perform a variety of functions, such as managing load-balanced traffic, configuring and controlling the switch chips, monitoring the health and performance of pool members, and performing high-availability failover actions.
BIG-IP daemons belong to one of two categories: core BIG-IP daemons, which start when you start the BIG-IP system and run it continuously, and non-core daemons, which may not be critical for basic operation. The tasks required to manage core and non-core daemons are different.
Core BIG-IP daemons
Core BIG-IP daemons are essential to system operation. The following table lists the core BIG-IP daemons and indicates the impact to the BIG-IP system operation if the daemon is not running:
| Daemon | Description | Impact if not running | Relevant log files |
|---|---|---|---|
| alertd | The alert daemon monitors system error messages and triggers proper actions, such as sending snmptrap and displaying messages on the panel. | No alerts | /var/log/ltm |
| bcm56xxd | The switch daemon configures and controls the Broadcom 56xx switch chips. | No switch traffic, LEDs not functional, STP and LACP not functional | /var/log/ltm /var/log/bcm56xxd |
| bdosd | The Behavioral DoS daemon (bdosd) is a control plane process that supports the BIG-IP AFM DoS Dynamic Signatures feature in 11.6.0 and later. | No automatic generation of signatures for DoS attack detection and mitigation. | /var/log/bdosd |
| bigd | The bigd monitor daemon provides system health checks. | Monitoring not available | /var/log/ltm |
| big3d | The big3d process is used by BIG-IP GTM and Enterprise Manager to collect statistics from remotely managed BIG-IP LTM devices. This process is also used by BIG-IP GTM for auto-discovery of objects. | No statistic collection or auto-discovery | /var/log/em /var/log/gtm |
| cbrd | The XML content based routing daemon provides document parsing functionality for the XML profile. | Virtual servers cannot parse XML documents | /var/log/cbr/cbrd.log /var/log/ltm |
| cand | The cand process manages the CAN buses for multiple clients (over UDP/SLIP/PPP). It manages utility communication between all cards in the VIPRION chassis, fan trays, and the Annunciator panel. | Loss of function and communication between devices in the CAN bus | /var/log/ltm |
| chmand | The chassis manager daemon implements the following HAL capabilities: platform identification, synchronization with SCCP/AOM, device discovery, chassis sensor monitoring, and chassis configuration (management & serial interfaces). | Cannot perform platform ID, enumerate interfaces, and push/publish platform info to MCPD | /var/log/ltm |
| clusterd | The clusterd process manages blade clustering for VIPRION systems. | Blade clustering does not function | /var/log/ltm |
| crond | The cron daemon executes scheduled commands and scripts. | Cannot execute scheduled commands | /var/log/cron /var/log/daemon.log |
| csyncd | For all platforms, the csyncd process populates the software image table. In addition, on VIPRION systems, the csyncd process replicates portions of the file system between cluster members. | For all platforms, the software image table is not updated and users cannot view or manage the latest software image list using the Configuration utility. In addition, on VIPRION systems, no synchronization amongst cluster members | /var/log/ltm |
| devmgmtd | The device management daemon establishes and maintains device trust group functionality for BIG-IP 11.0.0 – 11.3.0. | Loss of device trust functionality | /var/log/devmgmtd.out /var/log/ltm |
| devmgmtd++ | The device management daemon establishes and maintains device trust group functionality for BIG-IP 11.4.0 and higher. Note:The devmgmtd process is still part of the installed processes for BIG-IP 11.4.0 and higher. However, the devmgmtd++ process is the active daemon for this service. |
Loss of device trust functionality | /var/log/devmgmtd.out /var/log/ltm |
| diskevent | The diskevent daemon monitors additions/removals of disks and major disk errors on multi-disk systems. | No monitoring/logging of major disk errors on multi-disk systems | /var/log/daemon.log |
| eventd | The event daemon provides asynchronous event notification, using iControl messaging. | iControl-based subscription messaging fails | /var/log/ltm |
| fpdd | The front panel display daemon draws screens on the LCD panel and manages LEDs on all platforms. | No front panel access or data | /var/log/ltm |
| guestagentd | guestagentd runs on a vCMP guest for the purpose of communicating information such as system version, provisioning, high availability status, and TMM-related information to the vCMP host. | vCMP guest information and statistics is not communicated to the vCMP host. | /var/log/ltm |
| hostagentd | hostagentd runs on a vCMP host for the purpose of receiving information, such as system version, provisioning, high availability, and TMM-related information from the vCMP guest. | vCMP guest information and statistics is not received from the vCMP guest. | /var/log/ltm |
| httpd | The http daemon performs HTTP web server functions. | The BIG-IP Configuration utility does not function | /var/log/httpd/httpd_errors |
| istatsd | The istatsd process monitors control/data plane events. | No control/data plane event monitoring | /var/log/ltm |
| lacpd | The link aggregation control daemon creates link aggregation groups (trunks) based on user configuration. It implements IEEE 802.3ad – Link Aggregation Control Protocol (LACP). It also implements the high-availability feature Switchboard Failsafe. | No link aggregation functionality | /var/log/ltm |
| lind | The lind process manages software installation/volume creation tasks. | No software installation functionality | /var/log/ltm |
| logstatd | The logstatd process parses log data for utilities such as the BIG-IP Dashboard. | Loss of some logging data; the Dashboard utility does not function | /var/log/ltm |
| lopd | The lopd process is the lights-out processor (LOP) daemon for the following BIG-IP platforms: VIPRION 2400, 5xx0 (C109), 20×0 (C112), 40×0 (C113), 7xx0 (D110), 100×0/102×0 (D113). | The LOP subsystem does not function | /var/log/ltm |
| mcpd | The master control program daemon is the messenger service that allows two-way communication between userland processes and the Traffic Management Microkernel (TMM). | No traffic management functionality; the system status cannot be retrieved or updated, and the system cannot be re-configured; other daemons are not functional | /var/log/ltm |
| merged | The merged process integrates statistical data at defined intervals. | Statistical data is not available for system utilities/graphs | /var/log/ltm |
| monpd | The monpd process is used in conjunction with the avrd process for reporting/charts. Note: In BIG-IP 11.6.0, the monpd process is enabled by default on vCMP hosts. |
No reporting charts are displayed | /var/log/avr/monpd.log |
| ntlmconnpool | The ntlmconnpool daemon is the plug-in process for the NTLM profile. | NTLM connection pooling does not function as expected | /var/log/ltm |
| overdog | The overdog process monitors the high availability (HA) table for failover action types of restart, restart-all or reboot. When the overdog process receives a signal that one of these failover action types is true, the configured failover action is triggered. This process cannot be managed using the Traffic Management Shell (tmsh). | Failover action types of restart, restart-all or restart does not occur. | /var/log/ltm |
| pfmand | The pfmand process handles link monitoring, link statistics, and media settings for some platforms such as the BIG-IP 2000 and 4000 series. | Link monitoring, link statistics, and media settings lose functionality | /var/log/daemon.log |
| pvad | The packet velocity accelerator daemon runs on systems equipped with the PVA ASIC chip. | The PVA runs in wire mode | /var/log/ltm |
| restjavad | The restjavad daemon provides control-plane access to the BIG-IP using an http REST api. | Limited REST access to the control plane | /var/log/restjavad.[0-9]*.log |
| restnoded | The restnoded daemon provides control-plane access to the BIG-IP using an http REST api. | Limited REST access to the control plane | /var/log/restnoded.[0-9]*.log |
| rmonsnmpd | The RMON snmp daemon provides remote monitoring, alarm, and event functionality. | Partial loss of SNMP functionality | /var/log/daemon.log |
| scriptd | The scriptd process runs application template implementation scripts when an application service is created or updated. | Scripts are not started/stopped as expected | /var/log/ltm /var/tmp/scriptd.out |
| snmpd | The snmp daemon is the master SNMP agent. Without this daemon, no data is exposed by SNMP, including data from the SNMP subagents. The process also exposes common SNMP data. | No SNMP functionality | /var/log/daemon.log /var/log/ltm |
| sod | The switch over (failover) daemon causes the unit to become active or standby, and provides failover capability through a HA table. | No failover capability | /var/log/ltm |
| statsd | The stats daemon collects statistics from the system and records them in the rrd files. | No rrd data recorded for system graphs | /var/log/ltm |
| stpd | The stp daemon implements the IEEE Spanning Tree Protocol (STP) to prevent bridge loops. The protocols include the original STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). | No bridge loop detection | /var/log/ltm /var/log/daemon.log |
| syscalld | The syscall daemon manages system call functions. | Loss of system call functions | /var/log/ltm |
| tamd | The traffic authorization daemon authorizes traffic. | No remote authentication/authorization functionality | /var/log/ltm /var/log/secure |
| tmipsecd | The tmipsecd process subscribes to notifications from IPsec-related configuration objects. | No IPsec-related notifications | /var/log/tmipsecd |
| tmm | The Traffic Management Microkernel (TMM) is the process running on the BIG-IP host O/S that performs all of the local / global traffic management for the system. | Loss of all traffic management functionality for the system | /var/log/tmm /var/log/ltm |
| tmrouted | The routing table management daemon updates the TMM routing table based on the kernel routing table. | TMM cannot learn or advertise routes | /var/log/ltm |
| tomcat | The tomcat daemon provides web server functions for the BIG-IP web utility. Tomcat is an open-source implementation of Java Servlet and JavaServer Pages technologies developed under the Jakarta project at the Apache Software Foundation. | The BIG-IP Configuration utility does not function | /var/log/tomcat/catalina.out |
| vcmpd | The vcmpd process performs most of the work to create and manage guests, as well as configure the virtual network. | The BIG-IP system is not able to manage or run vCMP guests. | /var/log/ltm /var/log/vcmp |
| syslog-ng | The syslog-ng process performs system logging based on the syslog-ng utility. | Unable to generate system logs | /var/log/messages /var/log/daemon.log |
| zxfrd | The zxfrd process manages zone transfers and writes to the zone database files. | The DNS Express feature does not function as expected | /var/log/ltm |
| md / avrd | The md process collects, aggregates, and publishes application performance data for the BIG-IP Analytics module. The md process was renamed to avrd process in BIG-IP 11.3.0. | The Analytics module does not collect, aggregate, and publish application performance data | /var/log/avr/md.log /var/log/avr/avrd.log |
| evrouted | The evrouted process handles all events on the local control plane and directs the messages to the appropriate subscribed process. The evrouted process was introduced in BIG-IP 11.3.0. | Processes that subscribe to the evrouted process does not receive any information | No relevant log files Note: When the log.evrouted.level database key is configured with Debug, the evrouted process logs debug messages to the /shared/tmp/evrouted.out file. |
Starting and stopping core BIG-IP daemons using bigstart
You can use the command line to manage most core daemons on the BIG-IP system. To stop, start, restart, or view the status of a core daemon, use the bigstart command.
For example, to view the status of the bcm56xxd process, type the following command:
bigstart status bcm56xxd
For information about using the bigstart utility, see the bigstart main page.
Starting and stopping core BIG-IP daemons using the tmsh utility
- Log in to the tmsh utility by entering the following command:
tmsh - To restart the requested daemon, use the following command syntax:
restart /sys service <service name>
For example:
restart /sys service bcm56xxd
Non-core daemons
Non-core daemons may not be essential to system operation. Some non-core daemons are used by a feature that requires an add-on license. The following table lists non-core BIG-IP daemons:
| Daemon | Description | Impact if not running | Relevant log files |
|---|---|---|---|
| DBDaemon | DBDaemon is a multi-threaded long-running java process which is used by bigd to perform SQL monitoring. | SQL monitoring does not function | /var/log/DBDaemon-[0-9]*.log |
| dpid | The Deep Packet Inspection daemon (dpid) collects classification statistics for the AVR and PEM applications. | Traffic classification statistics won’t be available | /var/log/pem/dpid.log |
| dwbld | The dynamic white/black daemon (dwbld) is a Control Plane daemon that supports the AFM IP intelligence feature. | Enforcement of dwbl does not happen | /var/log/dwbl/dwbld.log |
| gtmd | The gtmd process initiates iQuery connections to big3d, processes monitor and path probe requests, forwards response information to TMM, as needed. | Global traffic functionality impaired | /var/log/gtm |
| icrd | The iControl Rest daemon (icrd) is used for mapping tmsh commands to/from REST API requests. | No command access for iControl using REST | logs to /var/log/icrd |
| iprepd | The iprepd daemon is responsible for interaction with 3rd parties (Webroot/BrightCloud), to bring IP Intelligence functionality to the BIG-IP system. This daemon connects to the BrightCloud server, downloads the IP reputation database, and shares it with the Data plane of different modules, like LTM, ASM, AFM, etc. This database contains a list of IP addresses and their threat codes. | The IP reputation database is not updated | /var/log/iprepd/iprepd.log |
| lldpd | The lldpd process interacts with bcm56xxd to receive and send LLDP PDUs. lldpd collects BIG-IP local information from mcpd and sends out the LLDP PDU per EEE 802.1ab specification on LLDP TX-enabled ports. When lldpd receives LLDP PDU on an LLDP RX-enabled port, lldpd saves or modifies the neighbor information as statistics. lldpd checks to see if bcm56xxd is running, so this daemon only runs on hardware platforms, not virtual editions. | LLDP attributes is not advertised | /var/log/ltm |
| named | The named process is the DNS server daemon. | No BIND functionality | /var/log/messages /var/log/daemon.log |
| ntpd | The ntp daemon sets and maintains the system time. | System time is not updated | /var/log/ltm /var/log/daemon.log |
| pkcs11d | The pkcs11d process acts as an interface between the BIG-IP daemons/utility that need to access the third-party network- connected HSMs (like Thales and Safenet). | SSL connections cannot be established on a virtual server that is associated with an SSL profile that references the affected certificate/key pair stored on the Thales HSM. | /var/log/pkcs11d.debug |
| racoon | The racoon daemon is an open source user-space daemon running on the Linux system. This daemon handles Internet Key Exchange (IKE) for IPsec. | IPsec tunnels does not function | /var/log/racoon.log |
| radvd | The radv daemon is the router advertisement service for IPv6. It listens to router solicitations, and answers with router advertisements. Note: ravd only exists on BIG-IP 11.0.0 |
No router advertisements for IPv6 | /var/log/daemon.log |
| sflow_agent | The sflow_agent is an SNMP subagent that handles polling and SNMP accessibility. | The sflow data is not available by way of SNMP | /var/log/sflow_agent.log |
| sshd | The ssh daemon provides remote access to the BIG-IP system command line interface. | No SSH command line access | /var/log/daemon.log |
| vxland | The vxland daemon manages multicast sockets and routing for IGMP protocol activity. | VXLAN traffic is impaired | /var/log/ltm /var/log/tmm |
| zrd | The zrd process is the ZoneRunner daemon. This daemon is active only on systems running the BIG-IP GTM module. | ZoneRunner does not function | /var/log/gtm |
| websso | The websso daemon is a TMM plug-in that performs single-sign-on (SSO) functionality for Web access through the BIG-IP APM system. | SSO does not function for APM | /var/log/daemon.log |
Starting and stopping non-core daemons using the Configuration utility
Use the Configuration utility to manage secondary BIG-IP daemons. The Configuration utility lists the name of each daemon and its current status.
To stop, start, restart, or view the status of a secondary daemon, perform the following procedure:
- Log in to the Configuration utility.
- Go to System > Services.
- For Service column, locate the name of the service you want to start, stop, or restart.
- Select the Service Select check box.
- Select Start, Stop, or Restart.
Starting and stopping non-core BIG-IP daemons using bigstart
You can use the command line to manage most core daemons on the BIG-IP system. To stop, start, restart, or view the status of a core daemon, use the bigstart command.
For example, to view the status of the named process, type the following command:
bigstart status named
For information about using the bigstart utility, see the bigstart main page.
Starting and stopping noncore BIG-IP daemons using the tmsh utility
- Log in to the tmsh utility by entering the following command:
tmsh - To restart the requested daemon, use the following command syntax:
restart /sys service <service name>For example:
restart /sys service named
Related Content
- K14387: Overview of BIG-IP AFM daemons
- K14441: Overview of BIG-IP WebAccelerator daemons (11.x)
- K12976: Overview of BIG-IP WebAccelerator daemons (9.x – 10.x)
- K14020: BIG-IP ASM daemons (11.x – 15.x)
- K10227: BIG-IP ASM daemons (9.x – 10.x)
- K14736: BIG-IQ daemons
- K4080: Adding and removing services included in the ‘bigstart’ process
- K9231: Overview of BIG-IP daemon heartbeat failover
- K15263: BIG-IP APM daemons (11.x)
AI Recommended Content
- Operations Guide – K84205182: Guide contents | BIG-IP update and upgrade guide
- Support Solution – K33244506: Changing user password from GUI after it expires returns error ”Authentication failed: Password expired. Update password via /mgmt/shared/authz/users”
- Security Advisory – K000161377: NGINX ngx_http_rewrite_module vulnerability CVE-2026-9256
- Operations Guide – K99014642: Choose a BIG-IP update or upgrade version | BIG-IP update and upgrade guide
F5 support engineers who work directly with customers write Support Solution and Knowledge articles, which give you immediate access to mitigation, workaround, or troubleshooting suggestions.
