LogoفارسیFA

Complete Guide to cPanel & WHM Service Daemons and Their Functions

This article provides a detailed overview of the service daemons that operate within cPanel & WHM. These background processes power essential server functions such as email delivery, DNS management, PHP-FPM acceleration, brute force protection, log processing, Greylisting, Cron tasks, and more. The article also explains which daemons are affected by server profiles and how each service contributes to system performance and stability.

cPanel daemonsWHM servicescPanel background processes

~6 min read • Updated Feb 17, 2026

1. Overview of Service Daemons in cPanel & WHM


A daemon is a background process that runs independently of user interaction. cPanel & WHM relies on many daemons to manage essential server functions such as email, DNS, PHP processing, security, and log rotation.


To view all daemons on your server, use the WHM API 1 servicestatus function.


To view daemons that can be enabled or monitored via the interface, navigate to:

WHM » Home » Service Configuration » Service Manager

Note: Server profiles (Standard, Mail, DNS, Database) may enable or disable certain services automatically.


2. List of cPanel & WHM Service Daemons


2.1 apache_php_fpm — PHP-FPM for Apache


This daemon improves the performance of PHP-based internal applications in EasyApache 4.

  • Available only on EasyApache 4 systems.
  • Must be installed or removed via EasyApache 4.
  • Disabled in Database, DNS, and Mail server profiles.

2.2 clamd — ClamAV Daemon


Scans the server for malicious files and malware.

Install or uninstall via:

WHM » Home » cPanel » Manage Plugins

2.3 cpanel-dovecot-solr — IMAP Full-Text Search (Apache Solr)


Provides fast full-text search indexing for IMAP mailboxes.

  • Installed/removed via Manage Plugins.
  • Disabled in Database and DNS profiles.

2.4 cpanel_php_fpm — PHP-FPM for cPanel Services


Accelerates internal PHP applications such as:

  • phpMyAdmin
  • phpPgAdmin
  • Webmail applications
  • Third-party PHP apps installed by users

Limit: Up to 10 concurrent processes per user.


2.5 cpanellogd — Log and Bandwidth Processor


Compresses and archives log files monthly and processes bandwidth usage.

Related documentation: cPanel Log Rotation Configuration.


2.6 cpdavd — cPanel DAV Daemon


Enables WebDAV functionality for remote website management.

In version 120+, it also manages calendars and contacts.

  • Essential for hosting websites or email.
  • Disabled in Database and DNS profiles.

2.7 cpgreylistd — Greylisting Daemon


Protects the server from spam by temporarily rejecting mail from unknown senders.

Disabled in Database and DNS profiles.


2.8 cphulkd — Brute Force Protection Daemon


Manages cPHulk, which protects the server from brute force login attacks.


2.9 cpsrvd — cPanel Server Daemon


The main application server for cPanel, WHM, and Webmail.

Note: If the Web Server role is disabled, it listens on ports 80 and 443.


2.10 crond — Cron Daemon


Handles scheduled tasks (Cron Jobs).

On Ubuntu, the daemon is named cron, but managed by crond via restartsrv.


2.11 dnsadmin — DNS Admin Cache


Runs as a standalone daemon to improve DNS performance.

Can be deselected to use multiple dnsadmin processes instead.


2.12 exim — Exim Mail Server


The SMTP daemon responsible for sending and receiving email.

Recommended: Keep this service enabled on most servers.

Warning: Disabling Exim removes many email-related options in WHM, including:

  • SpamAssassin
  • Email Archiving
  • Max hourly emails per domain
  • X-Source tracking headers
  • POP-before-SMTP
  • BoxTrapper
  • Retry settings

2.13 exim-altport — Exim on an Additional Port


Allows Exim to listen on an extra port besides the defaults:

  • 25
  • 465
  • 587

Enter the additional port number in the provided field.


Conclusion


Service daemons are the backbone of cPanel & WHM, powering everything from email delivery and DNS resolution to PHP processing, brute force protection, and log management. Understanding these daemons helps administrators maintain a secure, stable, and high‑performance hosting environment.


1. Overview


This document lists the service daemons that run on cPanel & WHM servers. A daemon is a background process that performs essential system functions without direct user interaction.


You can view all daemons using the WHM API 1 servicestatus function, or view manageable daemons in:

WHM » Home » Service Configuration » Service Manager

Note: Server profiles (Mail, DNS, Database, Standard) may enable or disable certain services automatically.


2. Service Daemons


2.1 ftpd — FTP Server


The FTP daemon runs the FTP service. Enable this if you host websites for other users.

  • Recommended: Monitor this service.
  • Disabled in Database, DNS, and Mail profiles.

2.2 httpd — Web Server


The Apache web server daemon processes HTTP requests.

Note: If disabled, cpsrvd takes over ports 80 and 443.

  • Disabled in Database, DNS, and Mail profiles.

2.3 imap — IMAP Server (Dovecot)


Handles IMAP email retrieval for users.

  • Recommended: Monitor this daemon.
  • Disabled in Database and DNS profiles.

2.4 ipaliases — IP Aliases


Allows multiple IP addresses to be assigned to a single network adapter.

IP addresses added via WHM are stored in /etc/ips and activated at boot.


2.5 lmtp — Local Mail Transport Protocol


Allows Exim to deliver mail to Dovecot via LMTP.


2.6 mailman — Mailing List Manager


Enables Mailman mailing lists.

  • Disabled in Database and DNS profiles.
  • Starts only when at least one mailing list exists.

2.7 mysql — MySQL or MariaDB Server


Processes database queries for applications and CMS platforms.

  • Monitored by default.
  • Disabled in Mail profile.

2.8 named — DNS Server


Runs BIND, PowerDNS, MyDNS, or NSD.

  • Enable only if using your own nameservers.
  • Disabled in Database profile.

2.9 nscd — Name Service Cache Daemon


Caches name service requests.

Important: Enable only on servers with at least 1 GB free memory.


2.10 p0f — Passive OS Fingerprinting


Identifies visitor operating systems for security notifications and spam/cPHulk analysis.

If disabled, visitor information is removed from notification footers.


2.11 pop — POP3 Server


Handles POP3 email retrieval.

  • Recommended: Monitor this daemon.
  • Not monitored by default.
  • Disabled in Database and DNS profiles.

2.12 postgresql — PostgreSQL Server


Processes PostgreSQL database queries.

  • Disabled in Mail profile.

2.13 queueprocd — TaskQueue Processor


Processes queued system tasks periodically.

Located in /usr/local/cpanel/libexec.


2.14 rsyslogd — System Logger


Logs system activity and monitors server events.

Recommended: Keep this daemon enabled.


2.15 spamd — Apache SpamAssassin


Filters spam messages.

If disabled, also disable SpamAssassin in Tweak Settings.

  • Disabled in Database and DNS profiles.

2.16 sshd — Secure Shell Daemon


Allows terminal access to the server via SSH.


2.17 syslogd — System Logger


Handles system logging and monitoring.


2.18 tailwatchd — TailWatch Daemon


Monitors log files and performs actions based on detected activity.

Used by services such as chkservd, cPHulk, and others.


Conclusion


Service daemons form the backbone of cPanel & WHM, powering essential functions such as email delivery, DNS resolution, database management, security protection, and system logging. Understanding these daemons helps administrators maintain a stable, secure, and efficient hosting environment.


Written & researched by Dr. Shahin Siami

Next Article