Appendix A - FortiClient EMS services
The following lists FortiClient EMS services:
Critical severity
|
Service |
Description |
|---|---|
| apache2 | Serves the EMS administration console and the APIs that FortiOS uses to get endpoint and posture information. |
| fcems_chromebook | Processes requests and serves profiles to Chromebook endpoints. |
| fcems_das | Allows most processes to access and cache endpoint-related data. When this service is down, processing requests from endpoints results in error. |
| fcems_ecsocksrv | Receives connections from endpoints and routes their requests to other processes within EMS. If this process is down, endpoints cannot communicate with EMS. |
| fcems_ka | Processes heartbeat requests from endpoints and pushes profile changes and commands to be executed on the endpoints (vuln scan, AV scan, etc.) |
| fcems_monitor | Ensures EMS services are running and restarts ones that are down. It also can restart running services when it detects settings that affect those services have changed to ensure they use the latest settings. |
| fcems_notify | Notifies FortiOS when there are important changes in the endpoints. |
| fcems_pgbouncer | Database connection pooler. This is where all EMS processes except apache2 connect to to connect to the database. |
| fcems_probe | Handles probe requests, which are tests that endpoints perform to ensure they are talking to a supported EMS. When this service is down, new endpoints cannot connect to EMS and existing endpoints cannot reconnect. |
| fcems_reg | Handles registration requests from endpoints. |
| fcems_tag | Processes network change requests from endpoints. When down, network changes that affect the endpoint's posture may take longer for EMS to realized and inform FortiOS of. |
| fcems_wspgbouncer | Exclusive database connection pooler for the webserver (apache2). |
| fcems_ztna | Provides some APIs that FortiOS consumes to get information on endpoints and posture. |
Medium severity
Low severity
|
Service |
Description |
|---|---|
| fcems_adevtsrv | If syncing AD to EMS using a remote connector, this process parses the connector's requests. |
| fcems_dbop | Performs database-related tasks, such as site database creation, deletion, update, backup, and restore. |
| fcems_forensics | Integrates with the Forensics platform to pull updates from Forensics tickets associated with any of the endpoints under management. |
| fcems_ftntdbimporter | Decodes and imports signature and vulnerability databases downloaded from FDS. |
| fcems_installer | Interfaces with the FortiCloud repackaging services to generate installers with the EMS configuration. |
| fcems_mdmproxy | Integrates with mobile device management (MDM) platforms to exchange information about mobile endpoints. |
| fcems_scep | Serves ZTNA certificates for mobile endpoints that MDM platforms manage. |