F5 Guardian Unity Partner
Home » Resources » F5 BIG-IP Daemons » F5 BIG-IP Daemons (9.x – 13.0) » F5 BIG-IP Daemons (13.x)

Topic

This article applies to BIG-IP 13.x. For information about other versions, refer to the following articles:

The BIG-IP system daemons perform a variety of functions, such as managing load-balanced traffic, configuring and controlling the switch chips, monitoring the health and performance of pool members, and performing high availability (HA) failover actions.

Description

The following table lists a description for the BIG-IP daemons, the impact to the BIG-IP system operation if the daemon is not running, and any relevant log files:

Daemon Description Impact if not running Relevant log files
alertd The alert daemon monitors system error messages and triggers proper actions, such as sending snmptrap and displaying messages on the panel. No alerts. /var/log/ltm
apm_websso The apm_websso daemon provides support for static credential-based authentication for forward proxy chaining. The forward proxy chaining feature does not function for BIG-IP APM. /var/log/daemon.log
/var/log/apm
autodosd The autodosd daemon is a control plane process which supports the BIG-IP AFM DoS Auto Threshold feature. Thresholds for denial of service (DoS) alert and rate limit are no longer set automatically. /var/log/ltm
avrd The avrd process collects, aggregates, and publishes application performance data for the BIG-IP Analytics module. The Analytics module does not collect, aggregate, and publish application performance data. /var/log/avr/avrd.log
bcm56xxd The switch daemon configures and controls the Broadcom 56xx switch chips. No switch traffic, LEDs not functional, STP and LACP not functional. /var/log/ltm
/var/log/bcm56xxd
bdosd The Behavioral DoS daemon (bdosd) is a control plane process that supports the BIG-IP AFM DoS Dynamic Signatures feature. No automatic generation of signatures for DoS attack detection and mitigation. /var/log/bdosd
bigd The bigd monitor daemon provides system health checks. Monitoring not available. /var/log/ltm
big3d The big3d process is used by BIG-IP GTM and Enterprise Manager to collect statistics from remotely managed BIG-IP LTM devices. This process is also used by BIG-IP GTM for auto-discovery of objects. No statistics collection or auto-discovery of objects. Additionally, BIG-IP DNS GSLB monitoring may be affected. /var/log/em
/var/log/gtm/
cbrd The XML content based routing daemon provides document parsing functionality for the XML profile. Virtual servers cannot parse XML documents. /var/log/cbr/cbrd.log
/var/log/ltm
cand The cand process manages the CAN buses for multiple clients (over UDP/SLIP/PPP). It manages utility communication between all cards in the VIPRION chassis, fan trays, and the Annunciator panel. Loss of function and communication between devices in the CAN bus. /var/log/ltm
chmand The chassis manager daemon implements the following HAL capabilities: platform identification, synchronization with SCCP/AOM, device discovery, chassis sensor monitoring, and chassis configuration (management & serial interfaces). Cannot perform platform ID, enumerate interfaces, and push/publish platform info to MCPD. /var/log/ltm
clusterd The clusterd process manages blade clustering for VIPRION systems. Blade clustering does not function. /var/log/ltm
crond The cron daemon executes scheduled commands and scripts. Cannot execute scheduled commands. /var/log/cron
/var/log/daemon.log
csyncd For all platforms, the csyncd process populates the software image table. On VIPRION systems, it also replicates portions of the file system between cluster members. Software image table is not updated; VIPRION cluster sync fails. /var/log/ltm
DBDaemon DBDaemon is a multi-threaded long-running Java process which is used by bigd to perform SQL monitoring. SQL monitoring does not function. /var/log/DBDaemon-[0-9]*.log
devmgmtd The device management daemon establishes and maintains device trust group functionality. Loss of device trust functionality. /shared/tmp/devmgmtd.out
/var/log/ltm
diskevent The diskevent daemon monitors additions/removals of disks and major disk errors on multi-disk systems. No monitoring/logging of major disk errors. /var/log/daemon.log
dwbld The dwbld daemon supports the AFM IP Intelligence feature and enforces dynamic white/black lists. Enforcement of IP Intelligence white/black lists does not occur. /var/log/dwbl/dwbld.log
dynconfd The dynconfd process manages DNS resolvers for FQDN-based pool members and nodes. FQDN pool members cannot resolve addresses; monitoring fails. /var/log/ltm
errdefsd The errdefsd daemon logs events from TMM to userland and publishes to HSL. HSL logging over the management interface fails. /var/log/ltm
eventd The eventd daemon provides asynchronous event notification using iControl messaging. iControl-based subscription messaging fails. /var/log/ltm
evrouted The evrouted process handles local control plane events and forwards messages to subscribed processes. Subscribers do not receive event messages. Debug logs: /shared/tmp/evrouted.out (if log.evrouted.level is set to Debug)
fpdd The fpdd daemon manages the LCD display and front panel LEDs. No data or access via the LCD panel. /var/log/ltm
gtmd The gtmd daemon initiates iQuery connections to big3d and handles monitor/path probes. GTM global traffic functions do not operate. /var/log/gtm
guestagentd Runs inside a vCMP guest; relays guest status and metrics to vCMP host. Host receives no information from the vCMP guest. /var/log/ltm
hostagentd Runs on the vCMP host to receive messages from guest instances. Host does not receive version, HA, or provisioning info from guests. /var/log/ltm
httpd Provides web server functions for the BIG-IP Configuration utility. GUI access fails. /var/log/httpd/httpd_errors
hwpd Assists with hardware acceleration for DNS/ePVA on specific blades. Hardware acceleration (ePVA/DNS) fails. /var/log/ltm
/shared/tmp/hwpd.out
icrd_child Maps iControl REST requests to tmsh commands. RESTful command access is lost. /var/log/icrd
iprepd Handles IP reputation feeds from third parties (e.g., BrightCloud). IP reputation database will not be updated. /var/log/iprepd/iprepd.log
ipsd Handles signature learning, blob compilation, and IPS updates. IPS updates, learning, and signatures will not function. /var/log/ipsd.out (if protocol inspection logging is enabled)
keymgmtd Provides management of CA-bundle and certificate store. SSL operations requiring CA-bundle access may fail. /var/log/ltm
lacpd Implements Link Aggregation Control Protocol (IEEE 802.3ad). Trunks are non-functional; Switchboard Failsafe may not engage. /var/log/ltm
lind Handles volume creation and software installations. Installation of new software fails. /var/log/ltm
lldpd Manages LLDP advertisements and neighbor data (hardware only). LLDP attributes are not sent/received. /var/log/ltm
logstatd Parses logs for visualization tools like the Dashboard. Dashboard may show incomplete or missing data. /var/log/ltm
lopd Manages the Lights Out Processor for specific VIPRION models. LOP functionality is lost (e.g., power management). /var/log/ltm
mcpd The master control program daemon enables communication between userland and TMM. All core functionality is lost; other daemons fail to operate. /var/log/ltm
merged Processes and stores statistical data. Statistics unavailable in graphs or utilities. /var/log/ltm
monpd Works with avrd for reporting/chart generation. No charts or reporting for analytics data. /var/log/avr/monpd.log
named Provides BIND DNS service. Local DNS services are unavailable. /var/log/messages
/var/log/daemon.log
neurond The neurond process manages communication with the Neuron Network Search Processor chip on supported platforms. Neuron-based flow acceleration is not available. /var/log/ltm
/var/log/neurond
ntlmconnpool Handles NTLM connection pooling. NTLM connection pooling does not function as expected. /var/log/ltm
ntpd Manages time synchronization using NTP. System time is not updated. /var/log/ltm
/var/log/daemon.log
oauth Provides OAuth 2.0 client, resource server, and authorization server functions within APM. OAuth functionality fails. /var/log/apm
/var/log/daemon.log
overdog Monitors high availability table for actions like restart, restart-all, or reboot. These HA actions are not triggered. /var/log/ltm
ovsdb-server Enables communication with OVSDB controllers for VXLAN tunnel config. Cannot be managed via OVSDB protocol. /var/log/openvswitch/ovsdb-server.log
/var/tmp/vxland.out
/var/log/vxland.log
pfmand Handles link monitoring, statistics, and media settings for 2000/4000 platforms. No link monitoring or statistics. /var/log/daemon.log
pgadmind Starts PostgreSQL server process for AFM Inline Rule Editor and config database. Firewall rule editor may not function. /var/log/ltm
ping_access_agent Allows APM to act as a Policy Enforcement Point (PEP) in PingAccess deployments. PEP function fails. /var/log/apm
pkcs11d Interface to network-connected HSMs like Thales or SafeNet. SSL profiles using HSM-stored certs will fail. /var/log/ltm
racoon Handles IKE for IPsec (indirectly managed via tmipsecd). IPsec tunnels do not function. /var/log/racoon.log
restjavad REST API daemon that provides control-plane access. Control-plane REST access is unavailable. /var/log/restjavad.[0-9]*.log
restnoded Supports REST control-plane access using Node.js extensions. Limited REST API access. /var/log/restnoded.[0-9]*.log
rmonsnmpd Provides SNMP RMON monitoring, alarms, and event tracking. Partial SNMP functionality is lost. /var/log/daemon.log
scriptd Runs app template implementation scripts when app services are created or updated. Scripts will not execute properly. /var/log/ltm
/var/tmp/scriptd.out
sflow_agent SNMP subagent that provides sFlow data for polling. No sFlow data via SNMP. /var/log/sflow_agent.log
snmpd Master SNMP agent, coordinating all SNMP operations. SNMP monitoring is disabled. /var/log/daemon.log
/var/log/ltm
sod Manages active/standby failover states. No failover functionality. /var/log/ltm
sshd Provides SSH access to the command-line interface. No SSH access available. /var/log/daemon.log
statsd Collects system statistics and writes to RRD files. No graphing or system statistics collected. /var/log/ltm
stpd Implements Spanning Tree Protocol (STP), including RSTP and MSTP. No loop prevention in L2 bridging. /var/log/ltm
/var/log/daemon.log
syscalld Manages various system call interfaces. System call functionality is impaired. /var/log/ltm
syslog-ng Logs system events using the syslog-ng utility. System logging fails. /var/log/messages
/var/log/daemon.log
tamd Manages traffic authorization for remote authentication/authorization. Remote auth fails. /var/log/ltm
/var/log/secure
tmipsecd Subscribes to IPsec-related config events and manages the racoon process indirectly. No IPsec configuration updates received. /var/log/tmipsecd
tmm The Traffic Management Microkernel handles all traffic processing. BIG-IP cannot process traffic if tmm is down. /var/log/tmm
/var/log/ltm
tmrouted Synchronizes the kernel routing table with the TMM routing table. Routing table updates and route advertisements do not occur. /var/log/ltm
tomcat Apache Tomcat web server daemon supporting GUI and REST endpoints. The Configuration Utility GUI becomes inaccessible. /var/log/tomcat/catalina.out
vcmpd Manages creation, provisioning, and networking of vCMP guests. vCMP guests cannot be created or managed. /var/log/ltm
/var/log/vcmp
vxland Manages IGMP and OVSDB-controlled VXLAN configurations. VXLAN traffic becomes impaired. /var/tmp/vxland.out
/var/log/vxland.log
websso Performs SSO functionality for APM through TMM plugin. SSO does not function. /var/log/daemon.log
zrd ZoneRunner daemon for BIG-IP GTM. ZoneRunner fails to function. /var/log/gtm
zxfrd Handles zone transfers and writes DNS Express zone data. DNS Express does not function. /var/log/ltm

Recommendations

You can stop, start, restart, or view the status of a daemon, using the TMOS Shell (tmsh), bigstart command, or the Configuration utility.

Using tmsh

To stop, start, restart, or view the status of a daemon using tmsh, use the following command syntax:

tmsh stop /sys service
tmsh start /sys service
tmsh restart /sys service
tmsh show /sys service

For example, to restart the named daemon, you would type the following command:

tmsh restart /sys service named

Using the bigstart command

To stop, start, restart, or view the status of a daemon using the bigstart command, use the following command syntax:

bigstart stop
bigstart start
bigstart restart
bigstart status

For example, to display the status of the named daemon, you would type the following command:

bigstart status named

Using the Configuration utility

You can use the Configuration utility to stop, start, restart, or view the status of some system services. To do so, perform the following procedure:

  1. Log in to the Configuration utility.
  2. Navigate to System > Services.
  3. In the Service column, locate the name of the service you want to start, stop, or restart.
  4. Select the check box next to the desired service name.
  5. Click the desired Start, Stop, or Restart button.
  6. To confirm the action, click OK.

Supplemental Information