| Process | CLI command restart | Impact of restarting the process. |
| configd | > debug software restart process configd | If there are any logged in admins when the configd is restarted, they will be kicked from the WebGUI as well as the CLI. Any uncommitted config change will be deleted/lost. |
| logrcvr | > debug software restart process log-receiver | Small risk of log loss. |
| useridd | > debug software restart process user-id | Restarting useridd will temporarily disrupt User-ID mappings and new user authentication. Existing user sessions might remain functional, but new user authentications or updates to group memberships will not be processed until the service is fully restored.
There would be non-matched users for the period of time it takes for the service to restart, so it it best to do this during a down time or have a catch-all security policy in place to temporarily allow users to get through without mapping |
| httpd | N/A (Alternative CLI > debug software restart process web-backend) | Restarting web-backend will cause a temporary loss of access to the web-based management interface (GUI) of the device. This impacts administrative access and monitoring through the GUI, but typically does not affect traffic forwarding. |
| devsrvr | > debug software restart process device-server | Restarting device-server on a firewall primarily impacts management plane operations that communicate with the dataplane, such as configuration commits and URL filtering lookups. However, it generally does not disrupt existing network traffic traversing the dataplane, ensuring ongoing connectivity. |
| java | N/A | |
| mgmtsrvr | > debug software restart process management-server | If there are any logged in admins when the management-server is restarted, they will be kicked from the WebGUI as well as the CLI. Any uncommitted config change will be deleted/lost. |
| snmpd | > debug software restart process snmpd | Restarting snmpd will temporarily stop the device from responding to SNMP queries from monitoring systems. This will result in a brief loss of real-time performance and status data collected via SNMP, but will not affect traffic. |
| logd | > debug software restart process logd (Panorama) | The primary impact is a temporary delay in log processing and a small risk of log loss |
| distributord | > debug software restart process distributord | Restarting the distributord process is a common troubleshooting step for issues related to User-ID, but it can have a direct impact on services that rely on user-to-IP mapping. |
| reportd | > debug software restart process reportd | Restarting the reportd process on a firewall mainly affects reporting and visibility features, but does not impact traffic forwarding or security enforcement. This will temporarily interrupt the generation of reports, including custom reports, ACC (Application Command Center) data, and scheduled reports. Any reports being generated at the time of restart will fail and need to be re-run manually. ACC and Monitor data views may briefly show incomplete or missing data until reportd restarts and resumes log processing. There is no impact on firewall traffic forwarding, security policies, or log collection. |
| mprelay | N/A | |
| brdagent | N/A | |
| sslmgr | > debug software restart process sslmgr | Restarting sslmgr will temporarily interrupt SSL/TLS decryption and encryption processes, affecting any traffic requiring SSL Forward Proxy or SSL Inbound Inspection. This will lead to decryption failures and potential traffic disruptions for encrypted sessions. |
| panio | N/A | |
| dsclient | N/A | |
| mongod | > debug software restart process mdb | A restart of the mongod process can temporarily impact the management graphical user interface (GUI).
When the mongod process is malfunctioning (e.g., experiencing high CPU usage), it can lead to poor performance, login timeouts, and an inability to complete tasks in Panorama.
Therefore, while the restart is in progress, these management functions may be briefly unavailable. |
| gpsvc | > debug software restart process gpscv | Restarting the gpsvc (GlobalProtect service) process on a PAN-OS device temporarily impacts GlobalProtect functionality. |
| svsd | N/A | |
| iotd | > debug software restart process iotd | iotd is the IoT Security daemon. Restarting it will temporarily disrupt IoT device identification, profiling, and security policy enforcement based on IoT attributes. This could lead to a temporary loss of visibility and policy enforcement for IoT devices. |
| dagger | N/A | |
| cryptod | > debug software restart process crypto | The cryptod process is fundamental to the cryptographic operations required for IPsec VPNs. |
| contentd | > debug software restart process ctd-agent | Restarting ctd-agent will temporarily impact the processing of Advanced Security Services, such as SaaS inline and ATP. This could lead to temporary delays or inaccuracies in identifying SaaS applications and threats covered with ATP, potentially affecting security policy enforcement.
Note that ctd-agent refers to the "wifclient" process. |
| authd | > debug software restart process authd | Restarting authd will disrupt authentication services on the device, impacting user authentication for management access, VPN connections, and other services that rely on local or external authentication. This will prevent new authentications and could disrupt active authenticated sessions. |
| ehmon | N/A | |
| redis-server | N/A | |
| chasd | N/A | |
| monitor | N/A | |
| logpurger.sh | N/A | |