---
title: "Daemon names in logs"
slug: "daemon-names-in-logs-v6-5"
updated: 2026-02-04T14:31:26Z
published: 2026-02-04T14:31:26Z
canonical: "support.appgate.com/daemon-names-in-logs-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Daemon names in logs

| **Appliance** | cz-configd | Manages and applies the Appliance configuration, works with the Controller (cz-managed). Also handles Appliance configuration seeding. |
| --- | --- | --- |
| cz-coredns | Handles all DNS requests on the appliance. |
| cz-proxyd | Listens for TCP connections and forwards them to nginx [HTTPS traffic] or one of the cz-vpnd instances [VPN traffic] respectively. Moreover, it handles the PROXY and Single Packet Authroization protocols according to its configuration. |
| cz-nginx | Frontend for all the HTTPS traffic, routes it to the correct daemon and the admin UI. |
| rsyslog | Receives the audit-logs from cz-logd, gathers logs from all the daemons running on the Appliance and forwards them to external log systems. |
| cz-logd | Gathers the audit-logs from all the daemons running on the Appliance, and forwards then to rsyslog and logserver. |
| ssh | Handles ssh connections to the appliance. |
| **Controller** | cz-controllerd | Handles all the authentication, authorization, , Policies & Conditions, tokens, etc. |
| **Gateway** | cz-vpnd | Handles the actual VPN traffic and has the firewall engine. There are multiple vpnd daemons running per Appliance and each has its own log file. Vpnd creates a tun device for each Client connection. |
| cz-sessiond | Handles the Client Claims and Entitlement tokens and generates the firewall rules that it sends to vpnd. It also works with named to resolve names that might be contained in Entitlements. |
| cz-gonamed | Name resolvers provide support for various types of cloud resolver (`azure://vnet:<NAME>`) as well as hostname resolution (`idns://crm.internal.my_company.com`). |
| cz-had | Handles Client failover via the ARP (IPv4) and NDP protocol (IPv6). It is also used to handle ARP and NDP requests sent over the local network so that the router and/or endpoints can find where to send back traffic to the Clients through the tunnel. |
| **Connector** | appgateservice@.service | Service to manage the Client service. |
| appgatedriver@.service | Service to manage the Client driver. |
| appgate-netns@.service | Service that creates/destroys the namespaces needed to run the Clients. |
| appgate-veth@.service | Service that sets/unsets the network interfaces/routes needed to run the Clients. |
| **Portal** | cz-webd | Session management |
| cz-webclient@xxxx | Specific session instance |
| cz-clientd | Responsible for creating / destroying Client instances |
| cz-dnsproxyd | DNS forwarding between nginx and user's Client |
| nginx_portal | Entry point for user's browsers, does tunneling towards endpoints (through Clients) |
| **LogServer** | cz-logd | Parses the audit-logs and inserts them into Opensearch. |
| cz-Opensearch | Log database used for audit logs. |
| cz-kibana | Log viewer used to view audit logs. |
| **LogForwarder** | cz-logd | Parses the audit.logs and forwards them to configured destinations. |
| **Metrics Aggregator** | cz-agentx | Handles metrics for Prometheus and SNMP. |
| **Appliance** | cz-configd | Manages and applies the Appliance configuration, works with the Controller (cz-managed). Also handles Appliance configuration seeding. |

The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions.

The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.

An appliance that acts as an enforcement point, controlling user access to protected resources.

Key-value pairs related to the identity and content of the user or device and are specific to each session.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.

A component that extends connectivity to remote sites and unmanaged resources without requiring the use of a standalone Client.

A web-based interface that allows users to access resources without requiring a standalone Client. It serves as a reverse proxy for user traffic.