Which Check Point process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) & Event Logging API (ELA) services.

Mei-Ling H.May 2, 2026

FWD is the correct answer. The fwd process (ForWarD daemon) is the one that handles all the logging work on the gateway side, including shipping logs over to the Log Server and exposing both the LEA and ELA APIs, which is exactly what the question is describing. The other options are unrelated daemons, CPD handles general management communication, CPVIEWD is for the CPView performance monitor, and DASSERVICE is not a standard logging component.

Amara A.May 12, 2026

Sat for 156-315.81.20 last spring and this exact process question showed up, and I almost second-guessed myself toward CPD before remembering that FWD is the dedicated forwarding daemon that handles log shipping from the gateway to the log server and exposes both LEA and ELA to third-party SIEM collectors. Once I pictured a firewall module pushing logs outbound, FWD locked in and I moved on without looking back.

Bao N.May 19, 2026

FWD is the one you want to lock in here, and this trips people up because CPD looks tempting since it handles general policy and communication tasks between components. The key distinction is that FWD (the Firewall Daemon forward process) is specifically responsible for log forwarding from the Security Gateway to the Log Server, and it also exposes the LEA and ELA APIs that third-party SIEM integrations rely on. DASSERVICE handles disk space monitoring, CPVIEWD feeds the cpview utility, and CPD manages inter-process and SIC communication, so none of those touch the logging pipeline directly. Quick clarifying question for anyone drilling this topic: do you understand why LEA and ELA are tied to FWD rather than to the Log Server process itself? Knowing which side of the connection owns the API is what separates a solid understanding from a lucky guess on exam day.

Eitan E.May 31, 2026

FWD is correct. The fwd process (sometimes called the firewall daemon forwarder) has been the dedicated logging process since NG days, it handles log forwarding to the Log Server, serves LEA connections from third-party SIEM tools via OPSEC, and also provides ELA for event subscribers, which is why on any gateway you can run "fw debug fwd" to trace exactly what log records are being shipped.