What Check Point process controls logging?

The FWD (FireWall Daemon) process is a core component running on Check Point Security Gateways and Management Servers. On a Security Gateway, its primary responsibilities include handling the logging mechanism. The kernel passes log data to the FWD process, which then processes these logs and forwards them to the designated Log Server or Security Management Server. FWD is also responsible for tasks such as handling security servers (e.g., for URI Filtering), and installing security policies fetched by the CPD process. Its central role in processing and dispatching logs makes it the correct answer.

A. CPWD (Check Point WatchDog) is a supervisor process that monitors other critical daemons, like FWD, and restarts them if they fail; it does not handle logging.
C. CPD (Check Point Daemon) is responsible for inter-process communication, fetching policies, and handling Secure Internal Communication (SIC), not for processing log records.
D. CPM (Check Point Management) is the main process on the Security Management Server that serves SmartConsole clients and manages the security policy database; it receives logs but does not control the logging process on the gateway.

1. Check Point Support Center. (2023). sk97638: Check Point Processes and Daemons. Retrieved from Check Point Support Center.

Reference Details: In the list of "Main Processes", the entry for fwd explicitly states: "FireWall Daemon. This is one of the major Check Point processes... It is also responsible for logging." The entries for cpwd, cpd, and cpm describe their respective non-logging functions.

2. Check Point. (2021). R81.10 Security Management Administration Guide.

Reference Details: In the "Logs and Monitoring" chapter, the logging architecture section describes how logs are generated on the Security Gateway and sent to the Security Management Server. The fwd process is identified as the daemon responsible for this communication and log forwarding task on the gateway.