Info: Process organization in OS X

OS X is built as a multitasking, multi-user environment in which resources are "shared" between various processes and tasks, which enables simultaneous processing of tasks. Essentially, the whole system is a bunch of independent processes, and while so

OS X is built as a multitasking, multi-user environment in which resources are "shared" between various processes and tasks, which enables simultaneous processing of tasks. Essentially, the whole system is a bunch of independent processes, and while some rely on others, only a minimum number of them are dependent on another. As such, many can be quit and relaunched without harming the system, but sometimes if a process is not coded properly, resources can be used up rather quickly and cause the system to hang. There are several indicators when this happens in OS X, including the affected application (or dependent applications) freezing and running slowly, and displaying the infamous spinning beach ball cursor.

Because of this, it is useful to know how processes are organized in OS X, so you can target them using Activity Monitor or terminal commands to either quit or relaunch them to clear a system hang.

For background, let's take a look at what happens when you start up your computer. Read the inset box for an in-depth view of the Mac boot process, or skip it for a shorter description.

Mac Boot Process: The Long Version

When you press the power button on your system, the computer's components become active and start an initialization routine in their firmware. These components include network cards, graphics cards, the system's motherboard, and hard drives, all which will start up and assume a "ready" state to send and receive commands from controllers. The main firmware (Open Firmware for PowerPC Macs, and EFI for Intel Macs) on the motherboard gets executed and interacts with the various system components in their "Ready" states to ensure everything is running properly. If a vital component is not working properly, ie: RAM, the firmware will detect this and provide an alert.

After the hardware checks out, the boot devices are scanned for availability and are searched for a boot loader. Most computers will have a specific hard drive designated as the boot device in the computer's firmware settings (PRAM) which will allow for quick booting from that device. If the device is not present or not set, then the computer will start from the first one found in the hardware initialization. It will look for a boot loader on each hard drive, and activate the first one that is found. In PowerPC versions of OS X, the boot loader is called BootX, but on intel Macs it is called "Boot.efi". This loader loads the hardware required for booting and accepts various boot commands from input devices (command-V for verbose mode, "shift" for safe mode, etc). If the designated boot device has a properly packaged kernel on it, the kernel is activated and kernel extensions are referenced. At this point, the computer displays the first boot images on the screen. A grey Apple will appear if everything checks out, but for instance a folder with a blinking question mark may be posted if a valid boot device is not found.

On a healthy boot, the boot caches are then read for a quick launch of the system. These caches are filled with device drivers and other system extensions for the previously used system hardware configuration, which prevents the system from having to find them on the disk and configure them for each boot. Any other drivers are then found and loaded, and the system continues booting and loads the kernel. At this point, the computer's firmware hands control over to the software that will now load from the disk, and system processes are run as individual applications. The system launches the first "parent" process under which all other processes and applications are run. In OS X versions before Leopard this process was called "init", but in Leopard Apple changed to use "launchd". The launchd process accepts the various boot commands (single-user, verbose, safe mode, etc, if provided) from the firmware and proceeds to run the boot scripts which launch programs and services in the required sequence for booting.

Under the parent "launchd" process, various low-level and core applications are started to provide services to the system, including the "Core" components, SystemStarter, WindowServer, and loginwindow. These processes allow for startup items to be run, windows to be drawn and displayed on the screen, and finally the login window to be presented. The system then waits for valid login credentials, and then loads a "launchd" process under the supplied username. This process is a smaller "parent" process for all applications which that user will open and work with.

After the hardware and firmware on your computer initializes, a boot device is found and a healthy kernel is started up. The kernel is the lowest level software interface on the computer, and which makes resources such as RAM, video, and hard drives available to the operating system and programs in ways that allows for resource sharing and multitasking.

When the kernel loads in OS X, it makes these hardware resources available to software and immediately starts up the launcher process ("launchd") that will handle initialization of all "userland" processes, which are processes that have user-based access privileges (i.e.: "root" or a human user). In addition to initialization, launchd offers scheduling options and configurations for running every process on the system. It is the parent process that umbrellas every other process underneath it, which is useful for the system to compartmentalize processes.

After launchd loads, it runs scripts that load the remainder of the system processes in proper sequence to the point where the login window loads and displays.

System process organization

The system is basically comprised of a bunch of independently running programs, each of which supply part of the OS X experience. For instance, to manage windows, the system uses the "WindowServer" process, and to manage "kerberos" single sign-on authentication the system has "krb5kdc" running. Likewise, the Dock, Finder, and user applications that you start up are all programs.

All system processes are run by the "root" user, which is the user invoked by the kernel to launch the first "launchd" process. The "root" user is just the system itself, but since unix is a multi-user environment, all processes are given some ownership and permissions attributes, which are by default "root" unless another user is logging in and launching programs. There are a variety of system users, such as "daemon", and "_windowserver", which are used to give these processes special permissions and utility without running as root.

These processes run parallel to each other, and if one is quit, then others will still run, but may lose the functionality provided by the closed process. Despite the stability of the system, we recommend you do not randomly quit system processes, especially those with lower PID (Process ID) numbers in Activity Monitor. However, some "root" processes like antivirus scanners can use up resources at times and become unresponsive, and quitting these can clear the problem.

User process organization

When you log in, a new "launchd" process is started for your user (unlike the parent one that is running as "root") and all tasks you perform will be run under this new (but smaller) launchd "umbrella." In a sense, this is similar to when the system boots and launches the "root" user's "launchd" process.

You can see this task organization in "Activity Monitor" by opening the main activity window and choosing to view "All Tasks, Hierarchically" from the drop-down menu, which will tab-indent processes under their parent processes. All processes will be under the root "launchd" with Process ID (PID) 1, and all user processes will be under the "launchd" process for that user.

With tasks organized like this, the computer can easily manage resources for users. For instance, if a problem ever occurs with a user's account, the main "launchd" process for that account can be shut down immediately without harming the system.

There are many processes that are launched by a user when that user logs in, including file indexers, spelling services, and background agents that help launch programs such as Dashboard, iTunes, and iChat. You may wonder why these and other system processes do not show up in the Dock, even though they technically are applications. Unlike other processes, applications that are invoked by a user will show up in the Dock because they are specifically coded to do so. When developers use Xcode and the carbon or cocoa APIs, they create an application that is "Windowed" and package it with the support files necessary to make it viewable in the Dock. Most underlying processes do not have this specific code, so even though they are running, they will not show in the Dock.As such, you may need to use Activity Monitor to see which processes may be hanging or causing problems, rather than quitting all open applications that you can see in the Dock.

Making use of it all

With knowledge of how processes are organized, you can troubleshoot when your system hangs by being able to better identify which processes are ones that belong to your user account, and which ones are system processes or those belonging to other users. If you have "fast user switching" enabled on your system, you can see if another account has a process running that hogs the CPU, and be able to deal with it. Apple's Activity Monitor and other activity viewer utilities are exceptionally useful interfaces for managing these processes, primarily by allowing you to target and quit any that are not functioning properly.

In addition, if you are having hardware troubles and cannot get past a certain part of the boot process, you can use knowledge of that sequence to better understand where the problem is occurring.

More to come: We plan on writing a few additional tutorial and info articles based off this information, which will hopefully help MacFixIt readers better understand and troubleshoot OS X. If you have comments or suggestions for future articles, please contact us:

Click the following URL for part 2 of this series: About OS X System Processes

Click the following URL for part 3 of this series: Guide to Activity Monitor

  • About OS X System Processe...
  • Guide to Activity Monitor
  • More from Late-Breakers

    Join the discussion

    Conversation powered by Livefyre

    Don't Miss
    Hot Products
    Trending on CNET


    iPhone running slow?

    Here are some quick fixes for some of the most common problem in iOS 7.