List of Mac OSX Common processes

Activity Monitor icon

Ever wondered what all those processes in Mac OSX Activity Monitor are?

In Activity Monitor you might find a list of processes running upwards of 100 and over 500 threads!

By default you’ll only see the applications you launched, to see the full process list, click on the popup menu located in the title bar with the label ‘Show’ underneath, and choose ‘All Processes’.

Now you might wonder are all these necessary?
Is there something lurking here that’s just consuming my CPU power and I don’t really need it? Unfortunately, most of the time the answer is yes! Remember that nice little app with that cute icon you just had to try? Or a program you used for a while then deleted it?

Many applications install several small resident programs called These small programs usually run even when the application isn’t. Even worse, certain applications will install daemons as startup items so they start every time you turn on your computer. Unless the application comes with an uninstaller, daemons might remain in your system and run constantly even if you delete the original application!

Depending on your system and applications, some of the listed processes may or may not show up. Some of the listed processes have been discontinued.

Last updated: July 1st, 2008

For a full technical listing check Apple Developer Connection

Adobe LM Service

Adobe License Management Service


This is Adobe’s license management service, It’s used to make sure you have a valid serial number and are not using a pirated copy of their software. This process can be killed, but it will relaunch when you use one of their products.

Airport Base Station Agent

Airport Base Station Agent


Monitors base stations on the network and provides software updates.


Airport daemon


Configures wireless card parameters automatically. Also, automatically connects to preferred wireless networks after restart if the network is available.


Application Enhancer daemon


Developed by Unsanity for their Application Enhancer (APE) framework, it has the ability to load APE modules or haxies when certain applications are launched.

Apple Events

Apple Events


Provides GUI Scripting for AppleScript.


Apple File Protocol server


Shares your personal files, only present if you have enabled ‘Personal File Sharing’. To enable/disable; Launch System Preferences. Select Sharing. Select the Services tab. Select Personal File Sharing and check/uncheck the box.


Apple Spell


Provides spelling services throughout the system.


Apple Type Solution Server


Apple font management.


AutoFS daemon


Runs in the background and waits for network filesystem requests or configuration changes, and when such an event occurs, launches automount to update the mount points.


AutoFS Mount


Automatically Mounts/Unmounts Network Filesystems based on information provided by AutoFS. (See above)


Born Again Shell


GNU’s bash is a Command Line Interface (CLI) shell / interface. The application Terminal in Utilities is an example of a CLI shell that uses bash.


Bluetooth daemon


Responsible for bluetooth communication.


Core Graphics PDF To Raster


A CUPS (Common Unix Printing System) filter that rasterizes vector based graphics into pixels in order to be used by the printer.


AFP Client Session Monitor


Monitors AFP (Apple Filing Protocol) connections.


System Configuration daemon


Provides notifications to applications about system configuration changes.


CoreAudio daemon


Introduced with OSX version 10.4. Used for CoreAudio Related Purposes.


Core Services Daemon


Security Server.


Crash Detection and Panic Logging daemon


Responsible for crash detection. Listens for exceptions and launches Crash Reporter to investigate and report the crash to the user.


Crontab daemon


Responsible to execute scheduled commands. Looks through the crontab files and follows scheduled instructions. Cron wakes up every minute, to examine all stored crontab files, checking if something needs to be run in the current minute.


Common Unix Printing System daemon


Responsible to execute scheduled commands. Looks through the crontab files and follows scheduled instructions. Cron wakes up every minute, to examine all stored crontab files, checking if something needs to be run in the current minute.


Client-side URL Transfers


Used to transfer data from and to a server. Supports the following protocols: HTTP, FTP, GOPHER, DICT, TELNET, LDAP & FILE. Designed to operate autonomously.


DirectoryService daemon


Part of the Open Directory technology, DirectoryService gathers directory access information which includes permissions for directories and mounted disks and provides it to whatever program requested it.


Disk Arbitration daemon


Notifies the system about the appearance and disappearance of disks and filesystems, also manages the mounting of disks & filesystems and arbitrates claiming of disks.


Distributed Notifications daemon


Provides distributed notifications services.


Dynamic pager external storage manager


Manages a pool of swap files which is used by the system to support demand paging (virtual memory). Dynamic pager adds swap files as system load increases, and deletes files when the resources are no longer needed.




Proprietary process by Prosoft Data Backup. You will only have this in your system if you have installed Prosoft’s Data Backup program. Very difficult to get rid of, keeps showing up every time you use Data Backup; even if there isn’t anything scheduled.


HFS File System Consistency Check


The fsck_hfs utility verifies and repairs standard HFS and HFS+ file systems.


Filesystem Events daemon


Provides a way for applications to monitor when the contents of a directory are modified. For example a backup program needs to know whether a file/folder has been changed since a given date.


FTP (File Transfer Protocol) daemon


TheFTP is an internet protocol for transferring files. ftpd listens to the specified port (usually 21) for connection requests, and processes authentication and file transfers.


Global Regular Expression Print


Searches an input file for lines containing a match to the given regular expression (regexp) pattern.


Groff document formatting system


Groff (GNU troff) software is a Command Line Interface (CLI) typesetting package which reads plain text mixed with formatting commands and produces formatted output.


Groff Teletypewriter driver


Grotty translates the output of GNU troff into a form suitable for typewriter-like devices.


HDI Driver


Responsible for disk image loading and for compressed disk image decompression.


Human Interface Device daemon



Apache HyperText Transfer protocol (HTTP) server daemon


The Apache HTTP Server is an open-source HTTP server which serves pages from your computer to the public. The default server folder is located in /Library/WebServer/Documents. Usually running only if you have ‘Personal Web Sharing’ selected in ‘System Preferences’.


iCal Alarm Scheduler


Alerts you about upcoming appointments.

Image Capture Extension

Image Capture Extension


Works with the Image Capture application, receives events from external peripherals used by Image Capture.

iTunes Helper

iTunes Helper


Launches iTunes automatically when an audio CD is entered or when an iPod has been connected.


Process control initialization


Part of the boot process. Reads the initialization information file (ttys) and executes the commands. Usually executes the login utility.


Input/output UPS daemon


If you have an Uninterruptible Power Supply (UPS) connected to your computer (usually through USB), this process will monitor the UPS status. In the event of a power failure, ioupsd will follow the procedures specified in the ‘Energy Saver’ preferences panel.


IP Configuration daemon


Retrieve configuration and sets IP network parameters automatically.


IPIP Firewall Logger deamon


Logs connection attempts when a firewall is active.


Kernel Task


Handles system kernel tasks.


Kernel Event Agent


Disk & server events notifications. Notifies users about file and disk problems.


Kernel Extension daemon


A daemon process that handles requests for on demand loading & unloading system extensions.


Launch CFM Application


Runs CFM (carbon) Applications.


Launch daemon


Manages and launches daemons. launchd is the first process called by the system during startup, once running launchd looks through certain system folders for daemons to launch.




Less allows binary files to be read backwards.




The login process logs in users into the computer.


Login Window


A small program that displays the Login window after the system starts up, and allows you to enter a username and password.


Lookup daemon


The lookup daemon is a process that finds information like usernames, computer names, printers and IP addresses and provides the results to programs that requested them.


Little Snitch daemon


Proprietary daemon by Objective Development’s Little Snitch application. Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts.


Launch Services Database Registration


Registers applications in the Launch Services database. The Launch Services database keeps track of all application and what kind of files they can open.


Mach Initializer


Mach kernel bootstrap (starts the system).




Displays and formats online UNIX manual pages.


Managed Client X Daemon Compositor


Controls preference files for managed accounts.


Metadata importer


Imports file hierarchies to spotlight metadata server (the Spotlight indexing engine).


Multicast DNS Responder daemon


Provides network service announcement service.


Metadata server


Metadata indexing engine for Spotlight.


Metadata synchronizer


Metadata synchronizing for Spotlight.


Membership resolution daemon


Used by the system to resolves group membership permission conflicts.


NetInfo daemon


Domain information server.


NFS asynchronous I/O server


Enables NFS (Network File System) asynchronous Input/Output data transfer (concurrent data streams), and improves disk performance.


Notification server


Mac OS X notification system.


Network time protocol daemon


An operating system daemon which automatically synchronizes and maintains the system time through internet standard time servers. NTPD usually checks for the correct time every 1000 seconds. If the configuration file is missing, NTPD will poll the time server every 64 seconds, until it can determine how accurate the built-in time keeping chip is and reduce the checking frequency to a level where the timescale is effectively continuous.


Tiger  Leopard

OCSP and CRL daemon


Used by the security framework. Retreives and manages a list of revoked security certificates via the OCSP (Online Certificate Status Protocol).


PC/SC Smartcard daemon


A daemon that coordinates communications with smartcard readers. PC/SC Smartcard daemon will load the correct driver for different types of card readers allowing applications to communicate with smartcards without knowing specific technical details of the card reader chipset.


Piton daemon


Proprietary multicast daemon. Used by EMC Insignia’s Retrospect backup software to find local backup client.


Pasteboard Server


Provides pasteboard (caching) services.


Process Monitor Tool


Invoked by the Activity Monitor. Polls the system and collects detailed process information, which is usually displayed in ‘Activity Monitor’.


Port Mapper


Converts RPC program numbers to DARPA protocol numbers. RPC (Remote Procedure Call) is a protocol that allows a program to execute code on another computer.


PPP (Point-to-point) daemon


A protocol used for establishing internet connections over dialup, DSL and other types of links. Some of the PPP daemon responsibilities include, IP negotiation, authentication and security.



Publication Subscription Agent


The PubSub agent syncs the RSS read/unread status of bookmarked RSS feeds between computers that are syncing bookmarks via .Mac Sync.

PubSubAgent is part of the Mac OS Publication Subscription technology introduced in Leopard. In short, it provides support for developers to subscribe to web feeds in their applications. According to Apple documentation, PubSubAgent is a background app that handles downloading of feeds, notification of Publication Subscription clients, and various other tasks.

There have been reports of PubSubAgent unexpectedly quitting when used behind a proxy.


Qmaster daemon


Provides automatic load distribution across processors for CPU intensive projects.

rasterto [printers specific]

Raster To [printers specific]


A CUPS (Common Unix Printing System) filter that handles converting CUPS raster data to a printer.

RetroRun & RetroRunSL



Proprietary process by EMC Insignia’s Retrospect backup software.


Remote Procedure Call (RPC) Locking daemon


Locks files or records on a network. Monitors files & records on a network, if a user opens a file rpc.lockd locks the file for other users.


Security daemon


Maintains security & cryptographic operations and control access to keychain items. securityd was first introduced in Mac OS X version 10.0 (Cheetah) as the “Security Server” and was renamed in 10.4 (Panther) to securityd.




A simple utility to check what services are provided by the system. Can be used to start and stop services, as well as to determine the status of services.


SFL Shared Preferences Tool


A .Mac tool using the (S/MIME Freeware Library) API’s to facilitate applications sharing data with a .Mac account.

SFL is a freeware implementation of IETF S/MIME v3 RFC 2630 CMS and
RFC 2634 ESS security protocols.




See bash


SLP (Service Location protocol) daemon


Announces network services.


Spin Dump


A tool used by various system components to create hang reports and notify the user of application hangs.

Hang reports are stored at:


OpenSSH (Secure Shell) daemon


Listens for incoming ssh (secure shell) connections and provides encrypted communications over an insecure network.


Socket Filter Firewall



System Log utility


Processes & controls the flow of log messages from client processes.


System Starter


A utility to start or stop system services which are located in the StartupItems folder.


System User Interface Server


Maintains the Menu Items on the right side of the menubar, like Date & Time, Language & other custom menus.




Formats tables for the UNIX troff formatting system.




Troff is a UNIX text processing program.


TWAIN Bridge


TWAIN is a standard for acquiring images from image scanners. TWAINBridge is a driver which connects TWAIN compatible devices to applications. TWAIN is maintained by The TWAIN Working Group.




Flushes (writes) filesystem caches to the disk. Update helps protect the integrity of disk volumes by flushing volatile cached filesystem data to disk at thirty second intervals.


USB Muxing daemon


Performs USB multiplexing when synchronizing iTunes music libraries with USB music devices like iPods & iPhones.


Window Server


Manages Application Windows.


Extended Internet Service daemon


Starts programs that provide Internet services. Instead of having services like FTP, HTTP and telnet started at system boot time, and stay dormant until a connection request comes in, only xinetd is started and listens on all ports for services listed in the configuration file. When a request arrives, xinetd starts the appropriate service.

More processes coming up soon…
- diskmanagementto
- issave
- securityagent
- dashboardclient
- writeconfig
- schelper
- managedclient
- authorizationhos
- readconfig
- synchronize-pref

Please help support by following some links below.

Helpful links:

Sponsored links:

13 people have left comments

Very informative list. This page is linked from the Wikipedia article on Activity Monitor.

Chris wrote on May 12, 2008 - 11:26 am | Visit Link

Anyone familiar with a process called


This appears to be using my file system, which I have revealed by using

sudo fs_usage

command, which shows all disk activity.

There almost no references about it at all in the www, except people asking wheter it might be a trojan or so!

Please comment if You have knowledge about it. Is it any legitimate system process or not?

(I have no uncommon software installed.)

M wrote on June 30, 2008 - 8:48 pm | Visit Link

Thanks for your interest.

SFLSharedPrefsTo has been added to the S section.

joshmax wrote on July 1, 2008 - 11:14 am | Visit Link

Thanks a lot, Joshmax! Nowhere else have I been able to get this question answered. There is no other reference to this process within the reach of Google search, and even in the Apple discussions site someone else is asking about SFLSharedPrefsTo to no avail.

Much appreciated!

Furthermore: do You (or someone else) know wheter it is normal / legitimate that this process is running even though I do not have a .Mac account? Thanks!

M wrote on July 2, 2008 - 5:36 pm | Visit Link

Definitely possible, I have seen that with other Apple technologies as well.

joshmax wrote on July 4, 2008 - 2:24 pm | Visit Link

I’d be interested in learning what synchronize-pref is for. We’re trying to investigate it, but there doesn’t seem to be any info online about it.

Justin Williams wrote on July 25, 2008 - 11:58 am | Visit Link

Some more processes that have been occuring in my Activity Monitor:


Sandbox-compiler (appears just briefly, never seen before.)

Quick Look Server


(Recently I was watching a web video
-> FireFox crashed
-> Excel crashed
-> Process ID numbers went up to 30000. (Usually less than 1000)
-> Kernel_task had 49 threads, usually ALWAYS 48, never mind what software I am running.

I am truly wondering about malware possibilty in my computer, altough this is probably not the correct forum to discuss that in depth.)

M wrote on August 11, 2008 - 5:34 pm | Visit Link

Somehow similar site with a bit more processes and links is this:

JKI wrote on August 23, 2009 - 10:52 am | Visit Link


Christina wrote on June 17, 2010 - 8:06 am | Visit Link

Pasteboard Server ?

Provides pasteboard (caching) services.

What would prompt this to run and why?

This definition is useless.

silkythreads wrote on August 29, 2010 - 9:56 am | Visit Link

webmaster as of 030511 your formatting looks a little off for the lsd/Little Snitch Daemon listing. BTW, thanks for this resource I’m a noob to mac and I found it very useful ;o)./cie

ciefish wrote on March 5, 2011 - 2:28 pm | Visit Link

silkythreads, pasteboard services means cut, copy & paste. It’s run once for every user that’s logged in, because it’s the process that holds whatever is on your clipboard & lets applications get hold of it.

George wrote on September 19, 2011 - 4:52 am | Visit Link

What about the process “warmd” ???

Randall Blanchard wrote on February 21, 2012 - 1:21 am | Visit Link
Powered by Wordpress XHTML Dashboard Using the Joshmaxonian Theme - A mod