156-582 · Question #7
What Check Point process controls logging?
The correct answer is B. FWD. The FWD (Firewall Daemon) process is responsible for controlling logging in Check Point environments. It manages the creation, storage, and transmission of logs from Security Gateways to the Security Management Server, ensuring that all relevant security events are recorded and…
Question
What Check Point process controls logging?
Options
- ACPWD
- BFWD
- CCPD
- DCPM
How the community answered
(42 responses)- A10% (4)
- B83% (35)
- C5% (2)
- D2% (1)
Explanation
The FWD (Firewall Daemon) process is responsible for controlling logging in Check Point environments. It manages the creation, storage, and transmission of logs from Security Gateways to the Security Management Server, ensuring that all relevant security events are recorded and available for analysis.
Topics
Community Discussion
6
Samuel O.Jun 27, 2026FWD is the one you want here. The firewall daemon, fwd, handles the actual logging function on Check Point gateways, collecting log records and forwarding them to the log server. I spent years watching network logs come in from various platforms before pivoting into this space, and when I got to Check Point the fwd process was the first thing that clicked because it behaves like any other syslog forwarder I had worked with, just tightly integrated into the Check Point architecture. CPWD is the watchdog process that keeps other processes alive, CPD handles SIC and general communication, and CPM is the management API process, so none of those three touch logging directly.
Orla P.Jun 27, 2026FWD is the one, it is the Check Point firewall daemon responsible for handling and forwarding log records from the gateway to the log server. Pull up fw log on any gateway and you will see FWD at work, it is the core process behind all that log traffic.
Wesley A.Jun 9, 2026FWD is the one you want here, and if you missed this on your first sit like I did, it is probably because CPD looks tempting since it handles general Check Point communications and keeps the policy alive. The key is that FWD, the Firewall Daemon, is specifically responsible for handling and forwarding log records to the Log Server, which is why it shows up in troubleshooting steps whenever logging stops working. CPWD is just the watchdog that restarts processes if they die, and CPM is the management API server introduced in R80. When you see a question about the logging pipeline specifically, FWD is your answer every time.
Samuel O.Jun 12, 2026Good call on FWD, and worth adding that on the gateway side you can run "fw ctl debug -m fw +drop" alongside checking the FWD process to catch situations where logs are generated but silently dropped before they even reach the forwarding stage.
Luis F.Jun 6, 2026FWD (FireWall Daemon) handles all logging on Check Point gateways, yep.
Ola B.Jun 15, 2026Spun up a lab yesterday, CPM is running that show.