The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to the cpd process via the fwm process. This is the correct sequence of processes for log forwarding in Check Point environments.