# Activity Monitor glossary Canonical page: https://vitalsmac.com/glossary What the processes, columns and figures in Activity Monitor mean, when they are a problem, and what to do about it. 55 terms, each with a Markdown copy at its URL plus .md. ## Processes you will see The system processes near the top of the list, what they do, and when they are worth a look. - [kernel_task](https://vitalsmac.com/glossary/kernel-task): kernel_task is the macOS kernel as it appears in Activity Monitor. One of its jobs is to manage CPU temperature: when the processor gets too hot, kernel_task takes CPU time so that less is available to the processes that are working it hardest. - [WindowServer](https://vitalsmac.com/glossary/windowserver): WindowServer is the macOS system process that manages windows, composites what apps draw into the final image on your displays, and routes input events such as clicks and key presses to the right app. - [mds_stores and mdworker](https://vitalsmac.com/glossary/spotlight-indexing): mds, mds_stores and mdworker are the macOS processes that build and maintain the Spotlight search index. mds is the metadata server, and mdworker processes scan files and read their contents and metadata so they can be found in search. - [launchd](https://vitalsmac.com/glossary/launchd): launchd is the first process macOS starts at boot, with process ID 1. It starts and manages the background services, agents and many other processes that run on the system and for each user. - [Helper processes](https://vitalsmac.com/glossary/helper-processes): Helper processes are separate processes an app starts to do part of its work, such as rendering web pages, running extensions, or handling graphics. They appear in Activity Monitor as their own rows, often with the app's name followed by Helper. - [coreaudiod](https://vitalsmac.com/glossary/coreaudiod): coreaudiod is the macOS background process for Core Audio, the system that handles sound input and output. It passes audio between apps and audio devices such as speakers, headphones and microphones. - [backupd](https://vitalsmac.com/glossary/backupd): backupd is the Time Machine backup process in macOS. It creates Time Machine backups and manages the history of backups on the backup disk. - [photoanalysisd](https://vitalsmac.com/glossary/photoanalysisd): photoanalysisd is the macOS process that analyzes your Photos library in the background. It powers features such as Memories, People, and searching photos for scenes or objects. - [syspolicyd](https://vitalsmac.com/glossary/syspolicyd): syspolicyd is the macOS system policy process. It decides whether software is allowed to be installed, loaded or run, and other parts of the system ask it for that verdict, for example when you open an app. - [cloudd](https://vitalsmac.com/glossary/cloudd): cloudd is the macOS process behind CloudKit, which apps use to store and sync data with iCloud. bird is a related process that backs iCloud Drive document syncing. - [mediaanalysisd](https://vitalsmac.com/glossary/mediaanalysisd): mediaanalysisd is the macOS process that analyzes the photos and videos on your Mac: it recognizes scenes, objects and text in images so you can search Photos for "beach" or copy text out of a picture. It works through your library in the background and is busiest after an import, a new Mac or a macOS update. - [nsurlsessiond](https://vitalsmac.com/glossary/nsurlsessiond): nsurlsessiond is the macOS process that downloads and uploads files in the background on behalf of apps and the system. When an app hands a transfer to macOS so it can continue after the app closes, nsurlsessiond does the work, which is why it can show heavy network use without an app open. - [trustd](https://vitalsmac.com/glossary/trustd): trustd is the macOS process that decides whether a certificate can be trusted. Every secure connection an app makes, and many code signature checks, ask trustd to verify the certificate chain and, when needed, whether the certificate has been revoked. - [tccd](https://vitalsmac.com/glossary/tccd): tccd is the macOS process that manages privacy permissions: which apps may use the camera, microphone, screen recording, your files and folders, contacts, Full Disk Access and Accessibility. TCC stands for Transparency, Consent and Control, the system behind every "would like to access" prompt. - [mDNSResponder](https://vitalsmac.com/glossary/mdnsresponder): mDNSResponder is the macOS process that turns every domain name into an address. It is the Mac's DNS resolver, and it also runs Bonjour, which finds printers, AirPlay speakers, shared Macs and other devices on your local network without any setup. - [fileproviderd](https://vitalsmac.com/glossary/fileproviderd): fileproviderd is the macOS process that puts cloud storage into Finder. iCloud Drive, and on recent macOS Dropbox, OneDrive, Google Drive and Box, use Apple's File Provider system: fileproviderd keeps track of every file, downloads it when you open it, and frees the space when you do not need it offline. - [sharingd](https://vitalsmac.com/glossary/sharingd): sharingd is the macOS process behind AirDrop and the Mac's other sharing features. It finds nearby devices, sends and receives AirDrop transfers, and handles parts of Continuity between your Mac, iPhone and iPad. - [rapportd](https://vitalsmac.com/glossary/rapportd): rapportd is the macOS process your Apple devices use to find and talk to each other on the same network. It is behind Continuity features between a Mac, an iPhone, an iPad and an Apple TV signed in to the same Apple Account. - [contactsd](https://vitalsmac.com/glossary/contactsd): contactsd is the macOS process that manages your contacts. It keeps the Contacts database on your Mac, answers every app that looks up a name, number or address, and works with the accounts in Internet Accounts to keep contacts in sync with iCloud, Google, Exchange and other servers. - [secd](https://vitalsmac.com/glossary/secd): secd is the macOS process that manages the keychain items in your user account: the passwords, passkeys, keys and certificates kept in iCloud Keychain or Local Items. Every app that saves or fills in a password asks secd for it, and secd keeps those items in sync with your other devices when iCloud Keychain is on. - [logd](https://vitalsmac.com/glossary/logd): logd is the macOS process that runs the unified log, the system-wide record of what macOS and your apps report while they run. Every process hands its log messages to logd, which compresses them, keeps recent ones in memory and saves the rest to a log store on disk, where the Console app and the log command in Terminal read them. - [XProtect](https://vitalsmac.com/glossary/xprotect): XProtect is the malware protection built into macOS. It checks apps against Apple's malware signatures when they first open, when they change and when the signatures update, scans the Mac in the background, and removes the malware it finds. Apple updates its rules separately from macOS updates. ## Memory What each figure on the Memory tab means, and which one tells you whether you need more. - [Memory pressure](https://vitalsmac.com/glossary/memory-pressure): Memory pressure is Activity Monitor's graph of how well the Mac's RAM is meeting current demand. It is based on free memory, swap rate, wired memory and file cached memory, and is shown in green, yellow or red. - [App Memory](https://vitalsmac.com/glossary/app-memory): App Memory is the amount of RAM being used by apps and their processes. It is one of the parts that make up Memory Used in Activity Monitor, alongside Wired Memory and Compressed. - [Wired Memory](https://vitalsmac.com/glossary/wired-memory): Wired Memory is RAM the system needs to operate that must stay in physical memory. It cannot be moved to disk or cached, so it is not available to apps. - [Compressed memory](https://vitalsmac.com/glossary/compressed-memory): Compressed memory is data in RAM that macOS has compressed to make more RAM available. Activity Monitor shows the total as Compressed, part of Memory Used. - [Cached Files](https://vitalsmac.com/glossary/cached-files): Cached Files is the size of files macOS has kept in otherwise unused memory to improve performance. The system gives this memory to apps when they need it. - [Swap Used](https://vitalsmac.com/glossary/swap-used): Swap Used is the amount of space on the startup disk that macOS is using to move memory out of RAM and back again. It is used when there is not enough physical memory for everything that is running. - [Memory column](https://vitalsmac.com/glossary/memory-column): The Memory column in Activity Monitor shows how much memory each process is using. The figure reflects the process's memory footprint, so it can include memory that has been compressed, not only data sitting uncompressed in RAM. - [Unified memory](https://vitalsmac.com/glossary/unified-memory): Unified memory is the single pool of RAM in an Apple silicon Mac, shared by the CPU, the GPU and the Neural Engine. There is no separate graphics memory: what the GPU uses comes out of the same 8, 16, 32 or more gigabytes as your apps. ## CPU, GPU and energy The columns on the CPU, GPU and Energy tabs, and why the numbers look the way they do. - [% CPU](https://vitalsmac.com/glossary/cpu-percent): % CPU is the share of processor capacity a process is using, measured per CPU core. Because each core counts as 100%, a process using several cores at once can show more than 100%. - [Energy Impact](https://vitalsmac.com/glossary/energy-impact): Energy Impact is a relative measure of how much energy an app is using right now, shown in the Energy tab of Activity Monitor. Lower is better, and the number has no unit such as watts. - [Idle Wake Ups](https://vitalsmac.com/glossary/idle-wake-ups): Idle Wake Ups counts how many times a process has woken the CPU from an idle state. Frequent wakeups keep the processor from resting and can cost battery life even when % CPU looks low. - [Load average](https://vitalsmac.com/glossary/load-average): Load average is the average amount of work that is running or waiting to run on the CPU, usually shown as three numbers for the last 1, 5, and 15 minutes. It is a Unix measure you can read on a Mac with the `uptime` command. - [Threads](https://vitalsmac.com/glossary/threads): A thread is a separate line of execution inside a process, and a process can run several threads at the same time on different CPU cores. The Threads column in Activity Monitor shows how many threads each process currently has. - [App Nap](https://vitalsmac.com/glossary/app-nap): App Nap is a macOS feature that slows down apps you are not using, such as apps whose windows are hidden and that are not playing audio. The App Nap column in the Energy tab of Activity Monitor shows which apps are napping right now. - [Preventing Sleep](https://vitalsmac.com/glossary/preventing-sleep): Preventing Sleep is a column in the Energy tab of Activity Monitor that shows whether an app is currently keeping the Mac from going to sleep. Apps do this on purpose while they play media, download, or run long tasks. - [% GPU](https://vitalsmac.com/glossary/gpu-percent): % GPU is the share of the graphics processor's capacity that a process is using. The GPU draws the screen and also runs work such as video effects, games, and machine learning tasks. - [Thermal throttling](https://vitalsmac.com/glossary/thermal-throttling): Thermal throttling is when a computer lowers its processor speed to keep temperatures in a safe range. The Mac keeps working, but tasks take longer until it cools down. - [Performance and efficiency cores](https://vitalsmac.com/glossary/performance-efficiency-cores): Performance and efficiency cores are the two kinds of CPU core in Apple silicon Macs. Performance cores are fast and use more power; efficiency cores are slower, use a fraction of the power, and take the background work. macOS decides which kind each task runs on. - [Unmeasured processes](https://vitalsmac.com/glossary/unmeasured-processes): The processes in a system monitor rarely add up to the total in its graph. In Activity Monitor that is because each core counts to 100% and work between two samples is missed. In other monitors it is also because macOS lets an app measure only the processes that belong to your user, so system processes such as WindowServer and kernel_task stay blank unless a helper reads them. ## When something goes wrong Stuck apps, stuck ports and the tools for finding out why. - [Force Quit](https://vitalsmac.com/glossary/force-quit): Force Quit ends an app or process immediately, without letting it save or clean up. A normal Quit asks the app to close itself, which gives it the chance to save your work first. - [Sample Process](https://vitalsmac.com/glossary/sample-process): Sample Process is an Activity Monitor tool that records what a selected process is doing over a few seconds and produces a text report of where its threads spend their time. Developers use these reports to find why an app is slow, busy, or hung. - [Spindump](https://vitalsmac.com/glossary/spindump): A spindump is a diagnostic report that records what processes on a Mac were doing, used to investigate apps that hang or stop responding. macOS includes a `spindump` tool, and Activity Monitor can create one from its More menu. - [PID](https://vitalsmac.com/glossary/pid): A PID, or process ID, is a number macOS assigns to each running process to identify it. No two running processes share a PID, but a number can be reused after its process ends. - [Listening port](https://vitalsmac.com/glossary/listening-port): A listening port is a network port where a process is waiting for incoming connections, such as a web server on port 3000. Only one process can listen on a given port and address at a time, which is why you see errors like "address already in use". - [Spinning wait cursor](https://vitalsmac.com/glossary/spinning-wait-cursor): The spinning wait cursor, often called the spinning beach ball, is the rainbow pointer macOS shows when an app has not responded to input for a few seconds. It means the app is busy or stuck, not that the whole Mac has frozen. - [Not Responding](https://vitalsmac.com/glossary/not-responding): Not Responding is the label macOS gives an app that has stopped handling input. In Activity Monitor, an unresponsive process is marked (Not Responding) and shown in red. - [Zombie process](https://vitalsmac.com/glossary/zombie-process): A zombie process is a process that has finished running but still has an entry in the process table, because its parent process has not yet collected its exit status. It uses no CPU and holds almost no memory. ## Figures Activity Monitor leaves out Uptime, purgeable space, fan speed, the menu bar and network units: what the Mac shows elsewhere, or not at all. - [Purgeable space](https://vitalsmac.com/glossary/purgeable-space): Purgeable space is disk space macOS counts as available but has not freed yet: files it can delete on its own when something needs the room. Local Time Machine snapshots, caches, and copies of files that also live in iCloud, Apple Music or the TV app are the usual contents. - [Uptime](https://vitalsmac.com/glossary/uptime): Uptime is how long a Mac has been running since it last started up. Sleep counts: closing the lid does not reset it, only a restart or a shutdown does. Activity Monitor does not show it; the `uptime` command in Terminal and System Information → Software do. - [Menu bar item](https://vitalsmac.com/glossary/menu-bar-item): A menu bar item is an icon or figure at the right end of the Mac's menu bar, put there by an app or by macOS, with a menu or a panel behind it. Wi-Fi, the battery and the clock are Apple's; a system monitor's readouts are the most common third-party ones. - [Fan curve](https://vitalsmac.com/glossary/fan-curve): A fan curve is the rule that maps a Mac's temperature to its fan speed: cool means slow or off, hot means fast. macOS sets the curve itself through the system management controller, and no built-in app shows or changes it. Fan control apps replace the curve with one you draw. - [Mbps and MB/s](https://vitalsmac.com/glossary/mbps-and-mbs): Mbps is megabits per second and MB/s is megabytes per second. A byte is eight bits, so 100 Mbps is 12.5 MB/s. Internet plans and speed tests use bits; Activity Monitor, Finder and the download bar in a browser use bytes, which is why a fast connection looks slow in Activity Monitor. - [System Data](https://vitalsmac.com/glossary/system-data): System Data is the category in the Mac's storage settings for files macOS does not put anywhere else: caches, logs, local Time Machine snapshots, swap files, and the data apps keep in the Library folders. Before macOS Monterey it was called Other.