About OS X system processes

Written by Topher Kessler

Following our recent article discussing the launch sequence of OS X and how processes are organized, we have had requests about exactly what processes are running in OS X and what they mean. A standard OS X installation will have a variety of tasks that run, some of which are applications, and others of which are daemons.

About Daemons

In Unix systems, a daemon is a background task that accepts client application connections. For instance, the web server "httpd" is a daemon (generally indicated by the "d" in the name, though not always) and will accept network web queries from web browser clients, either from the local system or from networked clients. Many of the system processes in OS X are run as daemons that will accept input from other processes in the system and perform a local function. Some examples of this are the system launcher "launchd" which receive a command to open an application (from the SystemUIServer "client" when you double-click something) and then does so. Another is the "coreaudiod" daemon which provides centrally managed audio services to any "client" application that demands them.

The Process List

Keep in mind the set of processes and services running on a computer may be different, depending on the specific computer's configuration and what applications have been installed. In our list, the processes in RED should not be forcibly quit, because doing so will crash the system. Ones in ORANGE may be quit without harming the system, but will leave the system running in a limited state and may require a restart to get things running properly again. Others labeled orange may force or require the current user to log out for them to be restored properly. Ones in GREEN can be quit and restarted without harming the system, and for the most part should automatically relaunch. In these cases the "launchd" process will automatically load them based on preference scripts for the respective processes.

The OS X Processes, listed hierarchically and with one admin user logged in:

• kernel_task -- This is the lowest level process in the computer, that distributes hardware resources to processes and manages system memory. You cannot force-quit this process, but if you could it would immediately crash your system.
• launchd -- This is the parent process started by the kernel, under which all other processes are run. Quitting this will immediately force-quit your current applications and restart your system.
• kextd -- This is the kernel extension loader, and allows for drivers to be loaded in the system. It is loaded early so the kernel can be configured for boot.
• DirectoryService -- This is the the daemon for the system to interface with Open Directory, which is the database OS X uses for storing user authentication information.
• notifyd -- This is the "notification" server, which the system uses to send messages between running processes, allowing them to keep track of their various states (ie: if one has been quit, the others can be "notified").
• syslogd -- This is the default system logging server, allowing for system logs to be centrally managed.
• configd -- This is the system configuration daemon, which uses notifications to ensure critical system components are aware of system configuration changes.
• distnoted -- Distributed notification server (Apple provides little information on this).
• mDNSResponder -- A "Bonjour" system service that implements multicast DNS service discovery for local networks, and unicase DNS service discovery for non-local networks.
• securityd -- A daemon that sequesters authorization requests via Security Agent so they are kept away from other running processes. This is how the keychain manages authorization requests, and while quitting it should have it relaunch, doing so may prevent applications that use authentication from working (ie: Mail).
• ntpd -- The network time protocol daemon, which is used to set your system's time with a time server.
• usbmuxd -- This is a daemon that is involved with iPhone and mobile device synchronization with iTunes and other applications...
• update -- This regularly flushes local disk caches to maintain synchronization with the disk and cached data, and reducing data loss in the event of a crash.
• SystemStarter -- This utility is used to start, stop, and restart the system services stored in /Library/StartupItems/ and /System/Library/StartupItems/. These are generally third-party utilities such as antivirus and firewall suites.
• mds -- This is the metadata server, which is responsible for serving any application "client" that uses the metadata APIs, such as Spotlight.
• loginwindow (user) -- This is the process that presents the system login window. If it is quit, the account that is the owner for it will be forced to log out.
• KernelEventAgent -- This allows the system to send errors pertaining to inaccessible or unresponsive devices such as the filesystem. If the disk is full, this will allow the kernel to display a message to the user.
• kdcmond -- This daemon launches, monitors, and relaunches the kerberos process when necessary.
• krb5kdc -- This is the kerberos authentication service, allowing for secure and encrypted single sign-on events in the system.
• hidd -- This is the "Human Interface Device Daemon", which is responsible for managing mice, tablets, keyboards, and other input devices.
• httpd -- This is the web server. It's active if you have "Web Sharing" enabled.
• fseventsd -- this is the filesystem events daemon, which is used to monitor changes to the filesystem and is used by Time Machine to back up only changed files.
• dynamic_pager -- This works with the kernel to manage the size and location of virtual memory swap files.
• diskarbitrationd -- This daemon manages disk use among system processes.
• blued -- This is the bluetooth daemon, allowing for communication with bluetooth devices.
• autofsd -- This daemon updates the status of mounted network shares (AFP and NFS) to ensure the mounted shares reflect network changes.
• socketfilterfw -- This is a utility (located in /usr/libexec/ApplicationFirewall/) that is included to help dynamically configure the firewall, offering the options to debug, sign and verify, check files, and kill the firewall daemon.
• coreservicesd -- This is the server responsible for much of how OS X funcitons, including support for drag and drop, and custom application icons, among other features. While it will automatically relaunch, your current open applications may freeze and force you to restart.
• WindowServer -- This is the process that is responsble for managing display resolutions and displaying and managing windows in the Aqua interface.
• launchd (user) -- The parent launcher process for an individual user account.
• Spotlight -- Schedules file indexing with the "mds" process and provides support for metadata searching in OS X.
• UserEventAgent -- Allows the loading and unloading of system plugins in response to user-generated events, such as plugging in a peripheral device.
• pboard -- This is the pasteboard server, which is responsible for cutting, copying, and pasting items from applications to and from the clipboard.
• Dock -- The user's dock, responsible for expose and dashboard behaviors as well as holding running carbon and cocoa applications.
• Finder -- The OS X file manager.
• ATSServer -- This is the Apple Type Solution Server, which manages fonts and font accessibility by applications.
• SystemUIServer -- This is the "User Interface" server which primarily manages system menu items.
• iTunes Helper -- This monitors iPod connectivity so songs can be synchronized. Can be relaunched by opening iTunes.
• iChatAgent -- Notifies iChat of incoming message requests, and allows for status update to be managed without iChat being open. Can be relaunched by opening iChat.
• AppleSpell.service -- A system-wide spell and grammar checking service. If quit, applications that support it will not be able to spell check until restarting or logging back in.
• ARDAgent -- Remote desktop service, active if you have Remote Management enabled.
• AppleVNCServer -- The Screen Sharing server, active if you have "Screen Sharing" enabled.
• SyncServer -- The service behind iSync and .Mac/MobileMe synchronization.
• Quick Look Server -- This is active when you start up QuickLook in the Finder or other application that supports QuickLook
• racoon -- a key management daemon for establishing secure connections with other computers via the IPsec protocol suite. Can be restarted by toggling network off and on.
• coreaudiod -- this is the process responsible for managing the system audio
• mdworker (user) -- The user-specific mdworker will update a filesystem's index in real-time as files are modified on the filesystem, allowing their content to be seen in Spotlight.
• mdworker (_spotlight) -- This is the system-based mdworker process that will update the spotlight indices less frequently than the user-specific mdworker.
• VNCPrivilegeProx -- This is started up when you enable Screen Sharing.
• RFBRegisterMDNS -- This is started up when you enable Screen Sharing.

In addition to these, you may also see child processes listed in Activity Monitor as well, such as the shell and any active processes you may be running in the Terminal. These will be named the same as the command being run, so if you are running a shell you will see an instance of "sh" in Activity Monitor, as well as "top" as a child process of that shell if you are running that command.

We are working on a guide to Activity Monitor that we hope to finish soon, which will let you know some details about the various aspects of the program and enhance your system troubleshooting abilities. Have comments or questions? Let us know: http://www.macfixit.com/contact/

Click the following URL for part 1 of this series: Process organization in OS X

Click the following URL for part 3 of this series: Guide to Activity Monitor

Check us out on Twitter and the CNET Mac Forums.

Topher has been an avid Mac user for the past 10-15 years, and has been a contributing author to MacFixIt for just over a year now. One of his diehard passions has been troubleshooting Mac problems and making the best use of Macs and Apple hardware both for family and friends, as well as in the workplace. He and the newly formed MacFixIt team are hoping to bring enhanced and more personable content to our readers, and keep the MacFixIt community going here at CNET.

Resources