F5.

COM | DEVCENTRAL | SUPPORT | PARTNERS | CAREERS

R
Knowledge Centers Resources Sign Up | Login | My Support 

AskF5 Home / K13444

K13444: BIG-IP daemons (11.x)  Troubleshooting Wizard

Try our new self-help

troubleshooting wizard
Non-Diagnostic    
Find resolutions

Original Publication Date: Mar 10, 2012 Applies to (see versions):

Updated Date: May 26, 2017
Quick Tasks

Topic Diagnose your system with

iHealth
This article applies to BIG-IP 11.x. For information about other versions, refer to the following articles:
Create service request
K05645522: BIG-IP daemons (13.x)
Manage service requests
K89999342: BIG-IP daemons (12.x)
K8035: BIG-IP daemons (9.x - 10.x) Find serial number

The BIG-IP system daemons perform a variety of functions, such as managing load-balanced traffic, configuring and controlling the switch chips, monitoring Search Bug Tracker
the health and performance of pool members, and performing high-availability failover actions.
New and updated articles
BIG-IP daemons belong to one of two categories: core BIG-IP daemons, which start when you start the BIG-IP system and run it continuously, and non-core
 Subscribe to mailing lists
daemons, which may not be critical for basic operation. The tasks required to manage core and non-core daemons are different.
Contact Support

Core BIG-IP daemons

Core BIG-IP daemons are essential to system operation. The following table lists the core BIG-IP daemons and indicates the impact to the BIG-IP system
operation if the daemon is not running:

Daemon Description Impact if not running Relevant log files

alertd The alert daemon monitors system error messages and triggers No alerts /var/log/ltm
proper actions, such as sending snmptrap and displaying
messages on the panel.

bcm56xxd The switch daemon configures and controls the Broadcom 56xx No switch traffic, LEDs not functional, STP and /var/log/ltm
switch chips. LACP not functional /var/log/bcm56xxd

bdosd The Behavioral DoS daemon (bdosd) is a control plane process No automatic generation of signatures for DoS /var/log/bdosd
that supports the BIG-IP AFM DoS Dynamic Signatures feature in attack detection and mitigation.
11.6.0 and later.

bigd The bigd monitor daemon provides system health checks. Monitoring not available /var/log/ltm

big3d The big3d process is used by BIG-IP GTM and Enterprise Manager No statistic collection or auto-discovery /var/log/em
to collect statistics from remotely managed BIG-IP LTM devices. /var/log/gtm
This process is also used by BIG-IP GTM for auto-discovery of
objects.

cbrd The XML content based routing daemon provides document Virtual servers cannot parse XML documents /var/log/cbr/cbrd.log
parsing functionality for the XML profile. /var/log/ltm

cand The cand process manages the CAN buses for multiple clients Loss of function and communication between /var/log/ltm
(over UDP/SLIP/PPP). It manages utility communication between all devices in the CAN bus
cards in the VIPRION chassis, fan trays, and the Annunciator panel.

chmand The chassis manager daemon implements the following HAL Cannot perform platform ID, enumerate /var/log/ltm
capabilities: platform identification, synchronization with interfaces, and push/publish platform info to
SCCP/AOM, device discovery, chassis sensor monitoring, and MCPD
chassis configuration (management & serial interfaces).

clusterd The clusterd process manages blade clustering for VIPRION Blade clustering does not function /var/log/ltm
systems.

crond The cron daemon executes scheduled commands and scripts. Cannot execute scheduled commands /var/log/cron
/var/log/daemon.log

csyncd For all platforms, the csyncd process populates the software image
table. In addition, on VIPRION systems, the csyncd process
replicates portions of the file system between cluster members.
For all platforms, the software image table is /var/log/ltm
not updated and users cannot view or manage
the latest software image list using the
Configuration utility. In addition, on VIPRION
systems, no synchronization amongst cluster
members

devmgmtd The device management daemon establishes and maintains Loss of device trust functionality /var/log/devmgmtd.out
device trust group functionality for BIG-IP 11.0.0 - 11.3.0. /var/log/ltm

devmgmtd++ The device management daemon establishes and maintains Loss of device trust functionality /var/log/devmgmtd.out
device trust group functionality for BIG-IP 11.4.0 and higher. /var/log/ltm
Note:The devmgmtd daemon is still part of the installed daemons
for BIG-IP 11.4.0 and higher. However, the devmgmtd++ daemon is
the active daemon for this service.

diskevent The diskevent daemon monitors additions/removals of disks and No monitoring/logging of major disk errors on /var/log/daemon.log
major disk errors on multi-disk systems. multi-disk systems

eventd The event daemon provides asynchronous event notification, using iControl-based subscription messaging fails /var/log/ltm
iControl messaging.

fpdd The front panel display daemon draws screens on the LCD panel No front panel access or data /var/log/ltm
and manages LEDs on all platforms.

guestagentd guestagentd runs on a vCMP guest for the purpose of vCMP guest information and statistics will not /var/log/ltm
communicating information such as system version, provisioning, be communicated to the vCMP host.
high availability status, and TMM-related information to the vCMP
host.

hostagentd hostagentd runs on a vCMP host for the purpose of receiving vCMP guest information and statistics will not /var/log/ltm
information, such as system version, provisioning, high availability, be received from the vCMP guest.
and TMM-related information from the vCMP guest.

httpd The http daemon performs HTTP web server functions. The BIG-IP Configuration utility does not /var/log/httpd/httpd_errors
function

istatsd The istatsd process monitors control/data plane events. No control/data plane event monitoring /var/log/ltm

lacpd The link aggregation control daemon creates link aggregation No link aggregation functionality /var/log/ltm
groups (trunks) based on user configuration. It implements IEEE
802.3ad - Link Aggregation Control Protocol (LACP). It also
implements the high-availability feature Switchboard Failsafe.

lind The lind process manages software installation/volume creation No software installation functionality /var/log/ltm
tasks.

logstatd The logstatd process parses log data for utilities such as the BIG-IP Loss of some logging data; the Dashboard /var/log/ltm
Dashboard. utility does not function

lopd The lopd process is the lights-out processor (LOP) daemon for the The LOP subsystem does not function /var/log/ltm
following BIG-IP platforms: VIPRION 2400, 5xx0 (C109), 20x0
(C112), 40x0 (C113), 7xx0 (D110), 100x0/102x0 (D113).

mcpd The master control program daemon is the messenger service No traffic management functionality; the /var/log/ltm
that allows two-way communication between userland processes system status cannot be retrieved or updated,
and the Traffic Management Microkernel (TMM). and the system cannot be re-configured; other
daemons will not be functional

merged The merged process integrates statistical data at defined intervals. Statistical data is not available for system /var/log/ltm
utilities/graphs

monpd The monpd process is used in conjunction with the avrd process No reporting charts are displayed /var/log/avr/monpd.log
for reporting/charts.
Note: In BIG-IP 11.6.0, the monpd process is enabled by default on
vCMP hosts.

ntlmconnpool The ntlmconnpool daemon is the plug-in process for the NTLM NTLM connection pooling does not function as /var/log/ltm
profile. expected

overdog The overdog process monitors the high availability (HA) table for Failover action types of restart, restart-all or /var/log/ltm
failover action types of restart, restart-all or reboot. When the reboot will not occur.
overdog process receives a signal that one of these failover action
types is true, the configured failover action is triggered. This process
cannot be managed using the Traffic Management Shell (tmsh).

pfmand The pfmand process handles link monitoring, link statistics, and Link monitoring, link statistics, and media /var/log/daemon.log
media settings for some platforms such as the BIG-IP 2000 and settings lose functionality
4000 series.

pvad The packet velocity accelerator daemon runs on systems The PVA runs in wire mode /var/log/ltm
equipped with the PVA ASIC chip.

restjavad The restjavad daemon provides control-plane access to the BIG-IP Limited REST access to the control plane /var/log/restjavad.[0-9]*.log
using an http REST api.

restnoded The restnoded daemon provides control-plane access to the BIG-IP Limited REST access to the control plane /var/log/restnoded.[0-9]*.log
using an http REST api.

rmonsnmpd The RMON snmp daemon provides remote monitoring, alarm, and Partial loss of SNMP functionality /var/log/daemon.log
event functionality.

scriptd The scriptd process runs application template implementation Scripts are not started/stopped as expected /var/log/ltm
scripts when an application service is created or updated. /var/tmp/scriptd.out

snmpd The snmp daemon is the master SNMP agent. Without this No SNMP functionality /var/log/daemon.log
daemon, no data is exposed by SNMP, including data from the /var/log/ltm
SNMP subagents. The process also exposes common SNMP data.

sod The switch over (failover) daemon causes the unit to become No failover capability /var/log/ltm
active or standby, and provides failover capability through a HA
table.

statsd The stats daemon collects statistics from the system and records No rrd data recorded for system graphs /var/log/ltm
them in the rrd files.

stpd The stp daemon implements the IEEE Spanning Tree Protocol No bridge loop detection /var/log/ltm
(STP) to prevent bridge loops. The protocols include the original /var/log/daemon.log
STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning
Tree Protocol (MSTP).

syscalld The syscall daemon manages system call functions. Loss of system call functions /var/log/ltm

tamd The traffic authorization daemon authorizes traffic. No remote authentication/authorization /var/log/ltm
functionality /var/log/secure

tmipsecd The tmipsecd process subscribes to notifications from IPsec- No IPsec-related notifications /var/log/tmipsecd
related configuration objects.

tmm The Traffic Management Microkernel (TMM) is the process running Loss of all traffic management functionality for /var/log/tmm
on the BIG-IP host O/S that performs all of the local / global traffic the system /var/log/ltm
management for the system.

tmrouted The routing table management daemon updates the TMM routing TMM cannot learn or advertise routes /var/log/ltm
table based on the kernel routing table.

tomcat The tomcat daemon provides web server functions for the BIG-IP The BIG-IP Configuration utility does not /var/log/tomcat/catalina.out
web utility. Tomcat is an open-source implementation of Java function
Servlet and JavaServer Pages technologies developed under the
Jakarta project at the Apache Software Foundation.

vcmpd The vcmpd process performs most of the work to create and The BIG-IP system will not be able to manage /var/log/ltm
manage guests, as well as configure the virtual network. or run vCMP guests. /var/log/vcmp

syslog-ng The syslog-ng process performs system logging based on the Unable to generate system logs /var/log/messages
syslog-ng utility. /var/log/daemon.log

zxfrd The zxfrd process manages zone transfers and writes to the zone The DNS Express feature does not function as /var/log/ltm
database files. expected

md / The md process collects, aggregates, and publishes application The Analytics module does not collect, /var/log/avr/md.log
avrd performance data for the BIG-IP Analytics module. The md process aggregate, and publish application /var/log/avr/avrd.log
was renamed to avrd process in BIG-IP 11.3.0. performance data

evrouted The evrouted process handles all events on the local control plane Processes that subscribe to the evrouted No relevant log files
and directs the messages to the appropriate subscribed process. process will not receive any information
The evrouted process was introduced in BIG-IP 11.3.0. Note: When the
log.evrouted.level db key is
configured with Debug, the
evrouted process logs debug
messages to the
/shared/tmp/evrouted.out
file.

Starting and stopping core BIG-IP daemons using bigstart

You can use the command line to manage most core daemons on the BIG-IP system. To stop, start, restart, or view the status of a core daemon, use the
bigstart command.

For example, to view the status of the bcm56xxd process, type the following command:

bigstart status bcm56xxd

For information about using the bigstart utility, see the bigstart main page.

Starting and stopping core BIG-IP daemons using the tmsh utility
1. Log in to the tmsh utility by typing the following command:
tmsh

2. To restart the requested daemon, use the following command syntax:

restart /sys service <service name>

For example:

restart /sys service bcm56xxd

Non-core daemons
Non-core daemons may not be essential to system operation. Some non-core daemons are used by a feature that requires an add-on license. The following
table lists non-core BIG-IP daemons:

Daemon Description Impact if not running Relevant log files

dpid The Deep Packet Inspection daemon (dpid) collects classification statistics for the AVR Traffic classification statistics /var/log/pem/dpid.log
and PEM applications. won't be available

dwbld The dynamic white/black daemon (dwbld) is a Control Plane daemon that supports the Enforcement of dwbl will not /var/log/dwbl/dwbld.log
AFM IP intelligence feature. happen

gtmd The gtmd process initiates iQuery connections to big3d, processes monitor and path Global traffic functionality /var/log/gtm
probe requests, forwards response information to TMM, as needed. impaired

icrd The iControl Rest daemon (icrd) is used for mapping tmsh commands to/from REST No command access for iControl logs to /var/log/icrd
API requests. using REST

iprepd The iprepd daemon is responsible for interaction with 3rd parties The IP reputation database will /var/log/iprepd/iprepd.log
(Webroot/BrightCloud), to bring IP Intelligence functionality to the BIG-IP system. This not be updated
daemon connects to the BrightCloud server, downloads the IP reputation database, and
shares it with the Data plane of different modules, like LTM, ASM, AFM, etc. This
database contains a list of IP addresses and their threat codes.

lldpd The lldpd process interacts with bcm56xxd to receive and send LLDP PDUs. lldpd LLDP attributes will not be /var/log/ltm
collects BIG-IP local information from mcpd and sends out the LLDP PDU per EEE advertised
802.1ab specification on LLDP TX-enabled ports. When lldpd receives LLDP PDU on
an LLDP RX-enabled port, lldpd saves or modifies the neighbor information as
statistics. lldpd checks to see if bcm56xxd is running, so this daemon only runs on
hardware platforms, not virtual editions.

named The named process is the DNS server daemon. No BIND functionality /var/log/messages
/var/log/daemon.log

ntpd The ntp daemon sets and maintains the system time. System time is not updated /var/log/ltm
/var/log/daemon.log

pkcs11d The pkcs11d process acts as an interface between the BIG-IP daemons/utility that SSL connections cannot be /var/log/pkcs11d.debug
need to access the third-party network- connected HSMs (like Thales and Safenet). established on a virtual server
that is associated with an SSL
profile that references the
affected certificate/key pair
stored on the Thales HSM.

racoon The racoon daemon is an open source user-space daemon running on the Linux IPsec tunnels will not function /var/log/racoon.log
system. This daemon handles Internet Key Exchange (IKE) for IPsec.

radvd The radv daemon is the router advertisement service for IPv6. It listens to router No router advertisements for /var/log/daemon.log
solicitations, and answers with router advertisements. IPv6

sflow_agent The sflow_agent is an SNMP subagent that handles polling and SNMP accessibility. The sflow data will not be /var/log/sflow_agent.log
available by way of SNMP

sshd The ssh daemon provides remote access to the BIG-IP system command line interface. No SSH command line access /var/log/daemon.log

vxland The vxland daemon manages multicast sockets and routing for IGMP protocol activity. VXLAN traffic is impaired /var/log/ltm
/var/log/tmm

zrd The zrd process is the ZoneRunner daemon. This daemon is active only on systems ZoneRunner does not function /var/log/gtm
running the BIG-IP GTM module.

websso The websso daemon is a TMM plug-in that performs single-sign-on (SSO) functionality SSO does not function for APM /var/log/daemon.log
for Web access through the BIG-IP APM system.

Starting and stopping non-core daemons using the Con guration utility
Use the Configuration utility to manage secondary BIG-IP daemons. The Configuration utility lists the name of each daemon and its current status.

To stop, start, restart, or view the status of a secondary daemon, perform the following procedure:

1. Log in to the Configuration utility.

2. Navigate to System > Services.
3. In the Service column, locate the name of the service you want to start, stop, or restart.
4. Select the Service Select box.
5. Click Start, Stop, or Restart.

Starting and stopping non-core BIG-IP daemons using bigstart

You can use the command line to manage most core daemons on the BIG-IP system. To stop, start, restart, or view the status of a core daemon, use the
bigstart command.

For example, to view the status of the named process, type the following command:

bigstart status named

For information about using the bigstart utility, see the bigstart main page.

Starting and stopping noncore BIG-IP daemons using the tmsh utility
1. Log in to the tmsh utility by typing the following command:
tmsh

2. To restart the requested daemon, use the following command syntax:

restart /sys service <service name>

For example:

restart /sys service named

Supplemental Information
K14387: Overview of BIG-IP AFM daemons
K14441: Overview of BIG-IP WebAccelerator daemons (11.x)
K12976: Overview of BIG-IP WebAccelerator daemons (9.x - 10.x)
K14020: BIG-IP ASM daemons (11.x - 12.x)
K10227: BIG-IP ASM daemons (9.x - 10.x)
K14736: BIG-IQ daemons
K4080: Adding and removing services included in the 'bigstart' process
K9231: Overview of BIG-IP daemon heartbeat failover
K15263: BIG-IP APM daemons (11.x)

Feedback? Login to give feedback on this article.

HAVE A QUESTION? | Support and Sales > FOLLOW US

ABOUT F5 EDUCATION F5 SITES SUPPORT TASKS

Corporate Information Training F5.com Read Support Policies

Newsroom Certi cation DevCentral Create Service Request
Investor Relations F5 University Support Portal Leave feedback [+]
Careers Free Online Training Partner Central
About AskF5 F5 Labs

©2019 F5 Networks, Inc. All rights reserved. Policies | Privacy | Trademarks

rev: 1.5.42.5364