Textbook of Linux

A daemon is a long-running background process that provides a service to other programs or to the system itself. The name, suggested by Maxwell's thought experiment, is a whimsical but apt analogy: like Maxwell's sorting demons, daemons quietly do their work out of sight. Typical daemons include sshd (SSH server), systemd-journald (logging), crond (scheduled jobs), nginx (web server), and dbus-daemon (message bus).

Traditional daemons detach from their controlling terminal by forking, creating a new session with setsid, closing standard file descriptors, and often chdir'ing to /. This "daemonisation" dance was once written into every daemon. Modern daemons under systemd skip most of it: systemd handles the session, file descriptors, logging, and restart, and the daemon itself stays in the foreground.

Daemon names conventionally end in d: sshd, httpd, smbd, crond, ntpd. Their configuration lives under /etc/ and their state and logs under /var/. On systemd-based systems you manage them with systemctl start/stop/enable/status and view their logs with journalctl -u.

The distinction between "daemon" and "service" has blurred under systemd, which uses "service" as its preferred term. For practical purposes, think of a daemon as the process, and a service as the systemd unit that runs it.