Skip to Content
Skip to Table of Contents

← Previous Article Next Article →

ATPM 12.11
November 2006


How To



Download ATPM 12.11

Choose a format:

How To

by Sylvester Roque,

Activity Monitor: How to Keep Tabs on Your Mac

For some Mac users, one of the more interesting things about each new computer purchase or major OS upgrade has been poking around the hard drive to see what interesting pieces of software got included as extras. The usefulness of AppleWorks, MacWrite, and MacDraw was fairly obvious, but some of the more recently bundled software has been little-understood or under-utilized. That realization led to my first Automator article. Now I have a new candidate for most underutilized application. When was the last time you opened Activity Monitor?

Just What Is Activity Monitor?

As a multitasking, multi-user operating system, Mac OS X usually has a dizzying array of tasks going on simultaneously. As I write this article, I have Safari, two word processing programs, MPEG Streamclip, and Mail running simultaneously. Meanwhile, my wife’s account is running another program. That’s just the tasks that I know about. What about all the underlying tasks that the operating system starts without my knowledge? How do I keep tabs on all of that activity?

Open the Applications folder of your boot drive. Tucked inside the Utilities folder is a program called Activity Monitor. It gives Unix-challenged Mac users such as myself a more comfortable means of investigating the inner workings of our systems. Versions of OS X prior to 10.3 included a program called Process Monitor that allowed users to examine the processes running on the Mac; Activity Monitor yields much more information. Disk input and output, network throughput, CPU utilization, memory usage, and processes can all be examined in Activity Monitor.

Overview of Activity Monitor

The first few times I opened Activity Monitor I was more than a little intimidated. If that has happened to you, put your fears aside and let’s do a little exploration. Locate Activity Monitor in the Utilities folder and launch the program. If you don’t see the main window choose Activity Monitor from the Window menu.

When the window appears, the columns listed may be vary slightly depending upon whether you have done any prior exploration, but the window will look something like this:


The Main Activity Monitor Window

The large red button in the toolbar allows you to quit active processes. Click on the name of a process once to select it and push this button. The resulting sheet will give you the option to Force Quit, Cancel, or Quit. Read this sheet carefully before you answer. The messages are not always the same. For many processes you will get a generic message asking whether you want to quit, but some processes provide a bit more information. Attempt to quit the “loginwindow” process, for example, and the resulting quit sheet will inform you that this will log you out of the system. We’ll discuss some uses for this button in a moment. For now, don’t quit anything.

The large blue Inspector button is unavailable until you select a process. Once a process is selected, clicking the Inspector brings up another window with additional information about that specific process. You can examine memory usage, additional statistics, and open files and ports. You can even sample what’s happening with that process. File most of the results under the heading of “information only a programmer could love.” There may be some instances, though, where a support technician may request this information.

The Filter field allows searching for specific processes, while the pop-up menu offers several options for how you want the processes organized in the Activity Monitor window. My favorite views are “All Processes Hierarchically” and “My Processes.” The former shows processes spawned by other processes, while the latter shows processes associated with the current user account.

It’s All in the Process

The heart of the Activity Monitor window is the list of processes and various tidbits of information about each process. Your view of the Activity Monitor window may not have every column of available information active. With the main window open, take a quick trip to the View menu and choose Columns. Any columns that are checked will appear in the main window. The following columns are available: Process ID, Private Memory, User, Shared Memory, %CPU, Virtual Memory, CPU Time, Messages Sent, # Threads, Messages Received, # Ports, Kind, Real Memory.

Let’s just take a quick glance at some of the more useful pieces of information.

The Process ID is a number assigned to each process on the machine. Even activities that are not usually visible in the Dock or Force Quit dialog are processes and thus have a process number assigned to them. Sorting the list by ID number can give you an idea of which processes were last launched on your Mac, even if it was not launched from your account. For example, while preparing this article I launched a word processor that the system assigned a three-digit ID number. Sometime later I launched a second instance of the same program while logged in as a different user. That instance of the program was assigned a four-digit ID number. Knowing the last process launched can help pinpoint sudden system slowdowns. Note, however, that after it assigns the maximum process ID, OS X will wrap around and start re-using the low-numbered IDs.

The User column makes it possible to identify which processes were started by which user account. If multiple users are logged into the system and Activity Monitor is set to show all processes, processes are shown in the main window no matter which account initiated that particular process. Several important system tasks, such as the kernel task, are assigned to the root user and cannot be killed unless you are logged in as the root user.

The %CPU column shows how much of the CPU’s resources are devoted to a particular task. The percentages will vary quite a bit with many processes staying at or near zero until some activity puts that process to use. Although some processes can report high percentages, most will stay below 20% unless they are part of some processor-intensive task. If an application is open but not actively performing a task its percentage may well be very low.

If I activate the Kind column, the software I use regularly appears in the list as PowerPC. None of my software would show up in this list as Intel, since my system pre-dates those machines, but that could be useful information for some users.

If that wasn’t enough information for you, the tabs at the bottom of the Activity Monitor window provide a graphic representation of system performance. CPU usage, system memory, disk activity, disk usage, and network activity are all graphically represented. Simply click on a tab to see the relevant graph.

What Can I Do With All That Information?

We’ll discuss using Activity Monitor to track down some performance issues next month, but in the meantime here’s how to turn Activity Monitor into the ultimate force quit dialog.

Macs usually perform very reliably, but if you experiment with them enough from time to time you will experience a situation where one or more applications stop responding. Even after you have waited for what seems like an eternity the offending program refuses to respond. I had this happen recently when an application was unable to read some corrupted data. I didn’t want to power down the entire system because I had other applications open with unsaved work. What to do?

Most long-time Mac users know that under these circumstances simultaneously pressing Command, Option, and Escape brings up a Force Quit dialog that allows you to click on the offending program and force it to quit. Alternately you can Option-click a program’s icon in the Dock and choose Force Quit. That technique works much better now than it ever did under OS 9, but what if the all the programs in that box appear to be functioning as expected? That probably means that the problem is due to a background process whose name does not appear in the usual dialogs. Enter Activity Monitor and the superhero version of the force quit. Here’s how it works:

  1. Launch Activity Monitor and bring up the main window.
  2. As you look through the list of processes, those that are stuck usually appear in red. If you cannot find the offending process, change the list to show all processes. Once you have identified the problem, click on that process.
  3. Now choose the Quit Process button at the top of the window. In the sheet that appears, choose Quit or Force Quit. You will know when that process quits since it disappears from the list.

I have started calling this procedure the Super Quit. It has two advantages over the usual method for force quitting applications. First, this procedure allows you to quit background processes that do not appear in the Force Quit dialog. Ever have to quit the Dock? Dread those Unix commands? This is one solution. Second, if multiple users are logged into a Mac, it allows you to quit a process initiated by another user. Here’s how that procedure works:

  1. Launch Activity Monitor and choose Other User Processes from the pop-up menu.
  2. Locate the process that you would like to terminate. If more than one user has the same process running, make sure that you look at both the process name and the user name to identify the process.
  3. Single click the process as before and choose Quit Process. This time, since you are quitting a process started by someone else, you will be asked for an administrator password. Simply enter your password when prompted.

Before you use either of these procedures, here are a few things to keep in mind. It will make your life easier and perhaps prevent the loss of important data.

  1. Before initiating a standard Force Quit or either of the above procedures, wait for a bit to see if the offending process will resolve itself. All of the force-quit methods will result in loss of unsaved work. Sometimes a program that appears “frozen” is simply being forced to work more slowly due to limited resources.
  2. Be careful when quitting processes started by other users. I suggest this as a last resort since it will cause the loss of any unsaved work affected by that process. If the user has not saved the 500th page of a next great novel, you’re not going to make friends by needlessly quitting the word processor.
  3. While many processes have names that you will recognize, there are other processes with names that give little or no clue to their function. Did you know, for example, that when Classic is launched it appears in Activity Monitor’s list as TrueBlueEnvironment? Neither did I until recently. Be very careful and use these procedures only when necessary. Here is a partial list of some of the more important processes to get you started.

This should get you through the basics of Activity Monitor for the time being. Next month we’ll use this information to identify some system performance issues. Does your favorite application have a memory leak? Is it making use of both processors when needed? Do you really need additional memory? We’ll find out together next month.

Also in This Series

Reader Comments (8)

Marianne Ryan · September 9, 2008 - 05:27 EST #1
You seem to be the only one I can find that has the knowledge on the Activity Monitor for the Mac. So I thought maybe you could answer a question for me. My Mac was running slow, and also the clicking sounds (such as when booting up or opening a program, etc.) were continuous and I wasn't doing anything. I Googled the problem and came across your site.

After reading your article "How to Keep Tabs on Your Mac", I opened my Activity Monitor for the first time. (Thanks for the info btw.) Anyway, at one point I opened the window 'Other User Processes'. I noticed an unrecognizable name in it called, "Security Agent". It took up quite a bit of CPU %. Under the user it had 'nobody'. After a few minutes it disappeared. I'm wondering if this is an outside source coming in, since I don't have anything on my computer, (software, etc.) named Security Agent. I am hooked up with cable in case that's important for you to know. Do you have any idea what this is all about. I Googled this trying to get information on what this Security Agent is, and I couldn't find a thing. Not even software name Security Agent. So I'm not sure what's going on. I'd appreciate your input.

To give you a little background, I purchased my G5 off ebay just about 2 months ago. It is two years old. My son downloaded a virus about two weeks ago called Porn4Mac. I thought I got rid of it, but discovered a plug-in for it on my Firefox Plug-ins. I'm waiting on a response from them as well in order to delete it. I've disabled it anyway at this point.

Also, I found out the answer to my problem as to why my Mac was slowing down, thanks to you. It was because I had Google Desktop and it was taking up 48% CPU. Crazy!! I wouldn't have know that if I didn't come across your informative site. Thanks again.
Lee Bennett (ATPM Staff) · September 9, 2008 - 08:58 EST #2
Marianne - the Security Agent process is not malicious. It's part of the user login/authentication process for your Mac. It's not a specific application you'll find on your computer—rather it's a component of the OS X system. It will appear as a process any time you perform some action on your Mac that requires Admin authentication, such as installing applications. Note that this doesn't necessarily mean that you'll see a name/password dialog box. Depending on the timeout setting in your Keychain, a recent entering of an Admin password is still in play, in which case Security Agent fires up, recognizes that you've authenticated recently, and quietly shuts itself off.
Marianne Ryan · September 9, 2008 - 10:57 EST #3
Thank you. That's good to know.
Reinhold Linnartz · April 14, 2009 - 14:03 EST #4
Even I'm a beginner in the Mac business, finding your story's very helpful!
There is a lot to know if the mac gives you a
hard time, good to read your articles and learn

Scott Poston · July 5, 2009 - 07:11 EST #5

Very informative piece on The Activity Monitor. I will enjoy investigating it's uses. I have a quick question, and it's a little vague so I apologize ahead of time for that. I missed the last day of a class on Avid Editing systems recently. The teacher was all gung-ho on Mac, etc. Anyway, he mentioned a few cool tricks and promised that at the end of class he'd show us 2 things you should always know about with regards to keeping your Mac running smoothly. I know with PC's there are certain utilitiy programs, such as defrag, that you want to do on occasion. But I missed that last day and was sort of wondering if you might have a clue. I know he wasn't big on Automatic Updates, suggesting to take that setting off, since when your running certain apps like Avid you don't want an update to halt everything. But, are there other things you'd suggest in order to keep your OS running smoothly.

Thank You for your time/
Jeff Michaels · March 3, 2011 - 00:31 EST #6
Is there a list of what things are ok?
Jeff · May 11, 2011 - 04:38 EST #7
Hi, thanks for your help!
Was wondering if there were some particular malicious processes that were good to look out for?
Is there some sort of list of these online I could find?
This is what's on my activitity monitor right now: usbmuxd, ATSServer, SecurityAgent, WindowServer, MDNSResponder, distnoted (from user 'daemon').
Your info was super helpful but I'm definitely not as savvy with Computer stuff as I'd like to be and it's hard not to get a little paranoid with security issues. recently while on Firefox, some link about a trojan horse took over the window, decided to just ignore it and quickly shut everything down. Researched a little bit and found your blog. Is there a place that lists safe and unsafe processes? Thanks for any help you can give or steer me towards!!
Sylvester Roque (ATPM Staff) · May 31, 2011 - 11:29 EST #8
I looked for such a list while I was writing this article and most of the descriptions I found were either outdated or I had questions about their accuracy. I'll try another search and see what I find.

Add A Comment

 E-mail me new comments on this article