---
title: "Daemon names in logs"
slug: "daemon-names-in-logs-v6-6"
description: "Daemon names in logs categorized by appliance function."
updated: 2026-05-29T14:04:24Z
published: 2026-05-29T14:04:24Z
canonical: "support.appgate.com/daemon-names-in-logs-v6-6"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Daemon names in logs

| **Appliance** | `cz-configd` | Manages and applies the appliance configuration. Works with the Controller (`cz-managed`). Also handles appliance configuration seeding. |
| --- | --- | --- |
| `cz-coredns` | Handles all DNS requests on the appliance. |
| `cz-proxyd` | Listens for TCP connections and forwards them to `nginx` (HTTPS traffic) or one of the `cz-vpnd` instances (VPN traffic). It also handles the PROXY and Single Packet Authorization (SPA) protocols according to its configuration. |
| `cz-nginx` | Frontend for all the HTTPS traffic. Routes traffic to the correct daemon and the admin UI. |
| `rsyslog` | Receives audit logs from `cz-logd`. Gathers logs from all daemons running on the appliance and forwards them to external log systems. |
| `cz-logd` | Gathers audit logs from all daemons running on the appliance and forwards them to Rsyslog and the LogServer. |
| `ssh` | Handles SSH connections to the appliance. |
| **Controller** | `cz-controllerd` | Handles all authentication, authorization, entitlements, policies and conditions, tokens, and so on. |
| **Gateway** | `cz-vpnd` | Handles VPN traffic and has the firewall engine. There are multiple `vpnd` daemons running per appliance, each with its own log file. `vpnd` creates a tun device for each client connection. |
| `cz-sessiond` | Handles client claims and entitlement tokens, and generates firewall rules that it then sends to `vpnd`. It also works with `named` to resolve names contained in entitlements. |
| `cz-gonamed` | Name resolvers provide support for various types of cloud resolver (`azure://vnet:<NAME>`) as well as hostname resolution (`idns://crm.internal.my_company.com`). |
| `cz-had` | Handles client failover through the ARP (IPv4) and NDP protocol (IPv6). This daemon also responds to ARP and NDP requests on the local network, enabling routers and endpoints to route return traffic to clients through the tunnel. |
| **Connector** | `appgateservice@.service` | Manages the client service. |
| `appgatedriver@.service` | Manages the client driver. |
| `appgate-netns@.service` | Creates and destroys the namespaces needed to run the clients. |
| `appgate-veth@.service` | Sets and unsets the network interfaces and routes needed to run the clients. |
| **Portal** | `cz-webd` | Session management |
| `cz-webclient@xxxx` | Specific session instance |
| `cz-clientd` | Responsible for creating or destroying client instances |
| `cz-dnsproxyd` | DNS forwarding between `nginx` and the user's client |
| `nginx_portal` | Entry point for user's browsers. Performs tunneling towards endpoints through clients. |
| **LogServer** | `cz-logd` | Parses audit logs and inserts them into Opensearch. |
| `cz-Opensearch` | Log database used for audit logs. |
| `cz-kibana` | Log viewer used to view audit logs. |
| **LogForwarder** | `cz-logd` | Parses audit logs and forwards them to configured destinations. |
| **Metrics Aggregator** | `cz-agentx` | Handles metrics for Prometheus and SNMP. |