
Ever wondered what all those processes in Mac OSX Activity Monitor are?
In Activity Monitor you might find a list of processes running upwards of 100 and over 500 threads!
By default you’ll only see the applications you launched, to see the full process list, click on the popup menu located in the title bar with the label ‘Show’ underneath, and choose ‘All Processes’.
Now you might wonder are all these necessary?
Is there something lurking here that’s just consuming my CPU power and I don’t really need it?
Unfortunately,
most of the time the answer is yes!
Remember that nice little app with that cute icon you just had to try? Or a program you used for a while then deleted it?
Many applications install several small resident programs called These small programs usually run even when the application isn’t. Even worse, certain applications will install daemons as startup items so they start every time you turn on your computer. Unless the application comes with an uninstaller, daemons might remain in your system and run constantly even if you delete the original application!
Depending on your system and applications, some of the listed processes may or may not show up. Some of the listed processes have been discontinued.
Last updated: July 1st, 2008
For a full technical listing check Apple Developer Connection
Adobe LM Service
Adobe License Management Service
^TopThis is Adobe’s license management service, It’s used to make sure you have a valid serial number and are not using a pirated copy of their software. This process can be killed, but it will relaunch when you use one of their products.
Airport Base Station Agent
Airport Base Station Agent
^TopMonitors base stations on the network and provides software updates.
airportd
Airport daemon
^TopConfigures wireless card parameters automatically. Also, automatically connects to preferred wireless networks after restart if the network is available.
aped
Application Enhancer daemon
^TopDeveloped by Unsanity for their Application Enhancer (APE) framework, it has the ability to load APE modules or haxies when certain applications are launched.
Apple Events
Apple Events
^TopProvides GUI Scripting for AppleScript.
AppleFileServer
Apple File Protocol server
^TopShares your personal files, only present if you have enabled ‘Personal File Sharing’. To enable/disable; Launch System Preferences. Select Sharing. Select the Services tab. Select Personal File Sharing and check/uncheck the box.
AppleSpell
Apple Spell
^TopProvides spelling services throughout the system.
ATSServer
Apple Type Solution Server
^TopApple font management.
autofsd
AutoFS daemon
^TopRuns in the background and waits for network filesystem requests or configuration changes, and when such an event occurs, launches automount to update the mount points.
automount
AutoFS Mount
^TopAutomatically Mounts/Unmounts Network Filesystems based on information provided by AutoFS. (See above)
bash
Born Again Shell
^TopGNU’s bash is a Command Line Interface (CLI) shell / interface. The application Terminal in Utilities is an example of a CLI shell that uses bash.
blued
Bluetooth daemon
^TopResponsible for bluetooth communication.
cgpdftoraster
Core Graphics PDF To Raster
^TopA CUPS (Common Unix Printing System) filter that rasterizes vector based graphics into pixels in order to be used by the printer.
check_afp
AFP Client Session Monitor
^TopMonitors AFP (Apple Filing Protocol) connections.
configd
System Configuration daemon
^TopProvides notifications to applications about system configuration changes.
coreaudiod
CoreAudio daemon
^TopIntroduced with OSX version 10.4. Used for CoreAudio Related Purposes.
coreservicesd
Core Services Daemon
^TopSecurity Server.
crashreporterd
Crash Detection and Panic Logging daemon
^TopResponsible for crash detection. Listens for exceptions and launches Crash Reporter to investigate and report the crash to the user.
cron
Crontab daemon
^TopResponsible to execute scheduled commands. Looks through the crontab files and follows scheduled instructions. Cron wakes up every minute, to examine all stored crontab files, checking if something needs to be run in the current minute.
cupsd
Common Unix Printing System daemon
^TopResponsible to execute scheduled commands. Looks through the crontab files and follows scheduled instructions. Cron wakes up every minute, to examine all stored crontab files, checking if something needs to be run in the current minute.
curl
Client-side URL Transfers
^TopUsed to transfer data from and to a server. Supports the following protocols: HTTP, FTP, GOPHER, DICT, TELNET, LDAP & FILE. Designed to operate autonomously.
DirectoyService
DirectoryService daemon
^TopPart of the Open Directory technology, DirectoryService gathers directory access information which includes permissions for directories and mounted disks and provides it to whatever program requested it.
diskarbitrationd
Disk Arbitration daemon
^TopNotifies the system about the appearance and disappearance of disks and filesystems, also manages the mounting of disks & filesystems and arbitrates claiming of disks.
distnoted
Distributed Notifications daemon
^TopProvides distributed notifications services.
dynamic_pager
Dynamic pager external storage manager
^TopManages a pool of swap files which is used by the system to support demand paging (virtual memory). Dynamic pager adds swap files as system load increases, and deletes files when the resources are no longer needed.
Executor
Executor
^TopProprietary process by Prosoft Data Backup. You will only have this in your system if you have installed Prosoft’s Data Backup program. Very difficult to get rid of, keeps showing up every time you use Data Backup; even if there isn’t anything scheduled.
fsck_hfs
HFS File System Consistency Check
^TopThe fsck_hfs utility verifies and repairs standard HFS and HFS+ file systems.
fseventsd
Filesystem Events daemon
^TopProvides a way for applications to monitor when the contents of a directory are modified. For example a backup program needs to know whether a file/folder has been changed since a given date.
ftpd
FTP (File Transfer Protocol) daemon
^TopTheFTP is an internet protocol for transferring files. ftpd listens to the specified port (usually 21) for connection requests, and processes authentication and file transfers.
grep
Global Regular Expression Print
^TopSearches an input file for lines containing a match to the given regular expression (regexp) pattern.
groff
Groff document formatting system
^TopGroff (GNU troff) software is a Command Line Interface (CLI) typesetting package which reads plain text mixed with formatting commands and produces formatted output.
grotty
Groff Teletypewriter driver
^TopGrotty translates the output of GNU troff into a form suitable for typewriter-like devices.
hdid
HDI Driver
^TopResponsible for disk image loading and for compressed disk image decompression.
hidd
Human Interface Device daemon
^Top
httpd
Apache HyperText Transfer protocol (HTTP) server daemon
^TopThe Apache HTTP Server is an open-source HTTP server which serves pages from your computer to the public. The default server folder is located in /Library/WebServer/Documents. Usually running only if you have ‘Personal Web Sharing’ selected in ‘System Preferences’.
iCalAlarmScheduler
iCal Alarm Scheduler
^TopAlerts you about upcoming appointments.
Image Capture Extension
Image Capture Extension
^TopWorks with the Image Capture application, receives events from external peripherals used by Image Capture.
iTunes Helper
iTunes Helper
^TopLaunches iTunes automatically when an audio CD is entered or when an iPod has been connected.
init
Process control initialization
^TopPart of the boot process. Reads the initialization information file (ttys) and executes the commands. Usually executes the login utility.
ioupsd
Input/output UPS daemon
^TopIf you have an Uninterruptible Power Supply (UPS) connected to your computer (usually through USB), this process will monitor the UPS status. In the event of a power failure, ioupsd will follow the procedures specified in the ‘Energy Saver’ preferences panel.
ipconfigd
IP Configuration daemon
^TopRetrieve configuration and sets IP network parameters automatically.
ipfwloggerd
IPIP Firewall Logger deamon
^TopLogs connection attempts when a firewall is active.
kernel_task
Kernel Task
^TopHandles system kernel tasks.
KernelEventAgent
Kernel Event Agent
^TopDisk & server events notifications. Notifies users about file and disk problems.
kextd
Kernel Extension daemon
^TopA daemon process that handles requests for on demand loading & unloading system extensions.
LaunchCFMApp
Launch CFM Application
^TopRuns CFM (carbon) Applications.
launchd
Launch daemon
^TopManages and launches daemons. launchd is the first process called by the system during startup, once running launchd looks through certain system folders for daemons to launch.
less
Less
^TopLess allows binary files to be read backwards.
login
Login
^TopThe login process logs in users into the computer.
loginwindow
Login Window
^TopA small program that displays the Login window after the system starts up, and allows you to enter a username and password.
lookupd
Lookup daemon
^TopThe lookup daemon is a process that finds information like usernames, computer names, printers and IP addresses and provides the results to programs that requested them.
lsd
Little Snitch daemon
^TopProprietary daemon by Objective Development’s Little Snitch application. Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts.
lsregister
Launch Services Database Registration
^TopRegisters applications in the Launch Services database. The Launch Services database keeps track of all application and what kind of files they can open.
mach_init
Mach Initializer
^TopMach kernel bootstrap (starts the system).
man
Manual
^TopDisplays and formats online UNIX manual pages.
mcxcompositor
Managed Client X Daemon Compositor
^TopControls preference files for managed accounts.
mdimport
Metadata importer
^TopImports file hierarchies to spotlight metadata server (the Spotlight indexing engine).
mDNSResponder
Multicast DNS Responder daemon
^TopProvides network service announcement service.
mds
Metadata server
^TopMetadata indexing engine for Spotlight.
mdsync
Metadata synchronizer
^TopMetadata synchronizing for Spotlight.
memberd
Membership resolution daemon
^TopUsed by the system to resolves group membership permission conflicts.
netinfod
NetInfo daemon
^TopDomain information server.
nfsiod
NFS asynchronous I/O server
^TopEnables NFS (Network File System) asynchronous Input/Output data transfer (concurrent data streams), and improves disk performance.
notifyd
Notification server
^TopMac OS X notification system.
ntpd
Network time protocol daemon
^TopAn operating system daemon which automatically synchronizes and maintains the system time through internet standard time servers. NTPD usually checks for the correct time every 1000 seconds. If the configuration file is missing, NTPD will poll the time server every 64 seconds, until it can determine how accurate the built-in time keeping chip is and reduce the checking frequency to a level where the timescale is effectively continuous.
ocspd
Tiger LeopardOCSP and CRL daemon
^TopUsed by the security framework. Retreives and manages a list of revoked security certificates via the OCSP (Online Certificate Status Protocol).
pcscd
PC/SC Smartcard daemon
^TopA daemon that coordinates communications with smartcard readers. PC/SC Smartcard daemon will load the correct driver for different types of card readers allowing applications to communicate with smartcards without knowing specific technical details of the card reader chipset.
pbs
Piton daemon
^TopProprietary multicast daemon. Used by EMC Insignia’s Retrospect backup software to find local backup client.
pboard
Pasteboard Server
^TopProvides pasteboard (caching) services.
pmTool
Process Monitor Tool
^TopInvoked by the Activity Monitor. Polls the system and collects detailed process information, which is usually displayed in ‘Activity Monitor’.
portmap
Port Mapper
^TopConverts RPC program numbers to DARPA protocol numbers. RPC (Remote Procedure Call) is a protocol that allows a program to execute code on another computer.
pppd
PPP (Point-to-point) daemon
^TopA protocol used for establishing internet connections over dialup, DSL and other types of links. Some of the PPP daemon responsibilities include, IP negotiation, authentication and security.
PubSubAgent
LeopardPublication Subscription Agent
^Top
The PubSub agent syncs the RSS read/unread status of bookmarked RSS feeds between computers that are syncing bookmarks via .Mac Sync.
PubSubAgent is part of the Mac OS Publication Subscription technology introduced in Leopard. In short, it provides support for developers to subscribe to web feeds in their applications. According to Apple documentation, PubSubAgent is a background app that handles downloading of feeds, notification of Publication Subscription clients, and various other tasks.
HINT:
There have been reports of PubSubAgent unexpectedly quitting when used behind a proxy.
qmasterd
Qmaster daemon
^TopProvides automatic load distribution across processors for CPU intensive projects.
rasterto [printers specific]
Raster To [printers specific]
^TopA CUPS (Common Unix Printing System) filter that handles converting CUPS raster data to a printer.
RetroRun & RetroRunSL
RetroRun
^TopProprietary process by EMC Insignia’s Retrospect backup software.
rpc.lockd
Remote Procedure Call (RPC) Locking daemon
^TopLocks files or records on a network. Monitors files & records on a network, if a user opens a file rpc.lockd locks the file for other users.
securityd
Security daemon
^TopMaintains security & cryptographic operations and control access to keychain items. securityd was first introduced in Mac OS X version 10.0 (Cheetah) as the “Security Server” and was renamed in 10.4 (Panther) to securityd.
service
Service
^TopA simple utility to check what services are provided by the system. Can be used to start and stop services, as well as to determine the status of services.
SFLSharedPrefsTo
SFL Shared Preferences Tool
^Top
A .Mac tool using the
(S/MIME Freeware Library) API’s to facilitate applications sharing data with a .Mac account.
SFL is a freeware implementation of
IETF
S/MIME v3
RFC 2630 CMS
and
RFC 2634 ESS
security protocols.
sh
Shell
^TopSee bash
slpd
SLP (Service Location protocol) daemon
^TopAnnounces network services.
spindump
Spin Dump
^Top
A tool used by various system components to create hang reports and notify the user of application hangs.
Hint:
Hang reports are stored at:
/Library/Logs/HangReporter/[application-name]/[hang-date].hang
sshd
OpenSSH (Secure Shell) daemon
^TopListens for incoming ssh (secure shell) connections and provides encrypted communications over an insecure network.
socketfilterfw
Socket Filter Firewall
^Top
syslogd
System Log utility
^TopProcesses & controls the flow of log messages from client processes.
SystemStarter
System Starter
^TopA utility to start or stop system services which are located in the StartupItems folder.
SystemUIServer
System User Interface Server
^TopMaintains the Menu Items on the right side of the menubar, like Date & Time, Language & other custom menus.
tbl
Table
^TopFormats tables for the UNIX troff formatting system.
troff
Troff
^TopTroff is a UNIX text processing program.
TWAINBridge
TWAIN Bridge
^TopTWAIN is a standard for acquiring images from image scanners. TWAINBridge is a driver which connects TWAIN compatible devices to applications. TWAIN is maintained by The TWAIN Working Group.
update
Update
^TopFlushes (writes) filesystem caches to the disk. Update helps protect the integrity of disk volumes by flushing volatile cached filesystem data to disk at thirty second intervals.
usbmuxd
USB Muxing daemon
^TopPerforms USB multiplexing when synchronizing iTunes music libraries with USB music devices like iPods & iPhones.
WindowServer
Window Server
^TopManages Application Windows.
xinetd
Extended Internet Service daemon
^TopStarts programs that provide Internet services. Instead of having services like FTP, HTTP and telnet started at system boot time, and stay dormant until a connection request comes in, only xinetd is started and listens on all ports for services listed in the configuration file. When a request arrives, xinetd starts the appropriate service.
More processes coming up soon…
- diskmanagementto
- issave
- securityagent
- dashboardclient
- writeconfig
- schelper
- managedclient
- authorizationhos
- readconfig
- synchronize-pref
Helpful links:
Sponsored links:
13 people have left comments
Very informative list. This page is linked from the Wikipedia article on Activity Monitor.
http://en.wikipedia.org/wiki/Activity_Monitor
Anyone familiar with a process called
SFLSharedPrefsTo
This appears to be using my file system, which I have revealed by using
sudo fs_usage
command, which shows all disk activity.
There almost no references about it at all in the www, except people asking wheter it might be a trojan or so!
Please comment if You have knowledge about it. Is it any legitimate system process or not?
(I have no uncommon software installed.)
Thanks for your interest.
SFLSharedPrefsTo has been added to the S section.
http://theprimepixel.com/list-of-mac-osx-common-processes#s
Thanks a lot, Joshmax! Nowhere else have I been able to get this question answered. There is no other reference to this process within the reach of Google search, and even in the Apple discussions site someone else is asking about SFLSharedPrefsTo to no avail.
Much appreciated!
Furthermore: do You (or someone else) know wheter it is normal / legitimate that this process is running even though I do not have a .Mac account? Thanks!
Definitely possible, I have seen that with other Apple technologies as well.
I’d be interested in learning what synchronize-pref is for. We’re trying to investigate it, but there doesn’t seem to be any info online about it.
Some more processes that have been occuring in my Activity Monitor:
SyncServer
Sandbox-compiler (appears just briefly, never seen before.)
Quick Look Server
DashboardClient
…
(Recently I was watching a web video
-> FireFox crashed
-> Excel crashed
-> Process ID numbers went up to 30000. (Usually less than 1000)
-> Kernel_task had 49 threads, usually ALWAYS 48, never mind what software I am running.
I am truly wondering about malware possibilty in my computer, altough this is probably not the correct forum to discuss that in depth.)
Somehow similar site with a bit more processes and links is this: http://triviaware.com/macprocess/all
someone
pboard
Pasteboard Server ?
Provides pasteboard (caching) services.
What would prompt this to run and why?
This definition is useless.
webmaster as of 030511 your formatting looks a little off for the lsd/Little Snitch Daemon listing. BTW, thanks for this resource I’m a noob to mac and I found it very useful ;o)./cie
silkythreads, pasteboard services means cut, copy & paste. It’s run once for every user that’s logged in, because it’s the process that holds whatever is on your clipboard & lets applications get hold of it.
What about the process “warmd” ???