OS X Process Management: Guide to Activity Monitor
<p>With UNIX having many tasks running simultaneously, through the years developers have incorporated several command-line tools that allow for live process management. These include "top", "kill", "ps", "df", and "vm_stats", and are available in the BSD
Written by Topher Kessler
With UNIX having many tasks running simultaneously, through the years developers have incorporated several command-line tools that allow for live process management. These include "top", "kill", "ps", "df", and "vm_stats", and are available in the BSD subsystem in OS X via the command line. Since these tools require knowledge of the Terminal (which I admit is one of the funnest aspect of OS X), Apple has compiled the function of these and similar tools into "Activity Monitor" to make process management more user-friendly.
When you launch Activity Monitor (available by default in the "Utilities" folder), you can view the main window by pressing "command-1" or by selecting "Activity Monitor" from the "Window" menu. There are other windows for viewing immediate CPU usage and CPU usage history, but those are relatively self-explanatory so I will only briefly touch on them later.
The main Activity Monitor window is comprised of two sections. The first is the process list section at the top, where all running processes in the system can be viewed and checked for system resource usage. The second is the system statistics section at the bottom of the window, where you can view the overall used and available system resources in tab-separated sections. There are no application preferences for Activity Monitor; instead, there are options for changing the views and included statistics, all of which are directly available in the "View" menu.
The Process List Section
This is where you view and manage all processes in the system. You can limit this to showing only user processes, or only system processes, active processes, or inactive ones, etc., which can be convenient for isolating specific tasks. In addition, you can use the "Filter" search bar to find a given task by name (only names are searchable). One final option for viewing the processes is to see them "heirarchically", which is available in the drop-down menu next to the filter box. Since processes in OS X can launch other ones, this will show which ones are the respective parents and children of each other. For instance, you can see in this view that all processes in the system are children of the root launchd "parent", which is the first "userland" process started in the system kernel upon booting (see our previous article on OS X system process organization).
The process list shows various attributes about the running processes, many of which are not viewable by default. In order to view them, you can check them by going to the "View" menu and checking the options in the "Columns" menus. We will go through them one-by-one to go over what they do:
PID (Process ID)
Whenever processes are started in OS X, they are given a unique identifier number, which can be used to identify it for recognition by other commands (for example, the "kill" utility that terminates processes). Processes can technically be given any number that is not in use; however, the system will use number ranges to separate different processes by levels of importance. For instance, the kernel is given number 0, followed by 1 for the parent "launchd" process. Progressively higher-level system processes are given PIDs up to approximately 200, with processes starting from user accounts being given higher process numbers. Every process is associated with its own Process ID, the Process ID of it's "parent" process, and the process group of which it is a member (generally the "parent" process).Process Name
The process name is the common name for the application, such as "Mail", or "Finder". The ones with abbreviated names such as "ntpd" or "hidd" are background processes that provide system support but for the most part aren't directly managed by the user.User
This is the owner of the process, or the active user under which the process was started. When the system boots up, the initial "launchd" process is started under the "root" user, and subsequent processes launched under this "launchd" umbrella are owned by this same user. The root user technically owns "everything" in the system, but system users by default can only directly control the subset of processes that they own. There are ways to temporarily promote a user to "root" in order to manage other processes, but we will not discuss that here.% CPU
This is the percentage of the overall processing power in the system being used by the process, and is relative to one CPU core, so many times in multiprocessor systems you will see a process take up 150% of the CPU, which indicates in a 2-core system that 75% of the total CPU power is being used by that process. This will only happen for processes that are multi-processor aware, and others will maximize at 100% but the system will divide their work among the various processors.When a process is programmed inefficiently, or has bugs in the code logic, the amount of CPU used can skyrocket and hog computing resources from other applications.
Time (CPU Time)
This is a running tally of the amount of time the CPU has spent on running the process. It can be compared with the %CPU number to see if the process regularly takes up a lot of the CPU, or if any observed spikes in the %CPU statistic are just temporary.Threads
Applications can be programmed to be multithreaded, which means separate tasks can be divided up into their own sub-processes that each run independently and in parallel with each other. These sub-processes are called threads, and can make applications run more efficiently, depending on the hardware they are running on. In multi-processor aware programs, individual threads are used to send tasks to available processor cores.Ports
The "ports" column shows how many "Mach ports", or "kernel queues" the process has open, which basically describes how communicative the process can be with others (ie: reserving memory usage from the system). This information will only be useful to system administrators and programmers.RPRVT (Private Memory)
This is RAM that's reserved for the application alone. When an application needs to store something in memory it will allocate the needed memory, and then of that amount it will reserve only crucial amounts and share other amounts with other applications. The amount it cannot (or "won't") give up is called "Private Memory". It is basically the minimum amount of memory required for the application to run.RSHRD (Shared Memory)
Shared memory is the amount of normally reserved memory that a program can free up by swapping out pages to virtual memory (hard disk space). This memory can be accessed by other programs if they demand it, and the kernel will swap it out to virtual memory if needed.RSIZE (Real Memory)
Real memory is the full amount of physical RAM the process is currently using. Technically it should be the sum of the Private and Shared memory usage, but not all the "Shared" memory is always in use by the process even though it still claims stake in it.VSIZE (Virtual Memory)
When a process runs, it reserves an amount of free hard drive space to manage memory. When shared memory is in high demand by other processes, the current process will write the contents of the shared memory to disk and free up more physical RAM for the processes that are demanding it. This used space is not displayed as being occupied by a file, and therefore does not change the amount of free space shown by the Finder.Kind
This shows the architecture codebase for the process. On most Macs you will see either "intel" or "PowerPC" listed here. This can be useful to see if a process is running under "Rosetta" emulation on intel macs, which can be a cause for slowdowns for a specific process.Messages Sent
How much the current process is communicating with other processes (ie: requesting memory). As with the "ports" column, this may only be useful for programmers and system administrators.Messages Received
How much the current process is receiving communication from other processes.
System Statistics Section
While the process list will show information and statistics for individual processes, it does not give an overview of the total load on the system, so Apple provides this in the lower section of the main window, which is divided into five tab-separated categories that will show information on CPU, System Memory, Disk Activity, Disk Usage, and Network. For the most part, the information in the CPU and System Memory categories are a summation of all the information thats available in the process list window, with a few exceptions. The other categories have no information from the process list.
CPU:
% User
This is the total amount of processing percentage used by user-owned processes (anything under your username and other human users currently logged into the system)% System
This is the total amount of processing percentage used by non-user processes (such as those owned by "root")% Nice
This is a priority system for processes, and will show how much of the CPU is being taken up by processes that have been given CPU priority over others. You can change the nice value for processes using the "nice" or "renice" terminal commands.% Idle
This is the total amount of available processing percentage, which is basically the User, System, and Nice processing percentage subtracted from 100%.Threads
The total number of threads in all processes combined. This basically gives an overview of how many independent "tasks" may be running at once.Processes
This gives the number of processes listed in the process list window. Coupled with the "Threads" number, this gives an idea of how the independent the various threads are.
System Memory:
Free
This is the total amount of free and available RAM that can be used by any current or newly launched application.Wired
This is the total amount of memory that must be kept active in RAM for the system to run stably.Active
This is the current amount of memory that is being used or has recently been used.Inactive
This is the amount of used RAM that has not recently been accessed.Used
This is the total amount of Active, Inactive, and Wired RAM.
Disk Activity:
Reads in/Writes out
This is the number of times the drive has been accessed for reading or writing. If a file is split into two segments on the drive, when the file is read, the number of "reads" will be two.Data read/Data written
This is the total number of bytes that has been read from or written to the drive.
All of these statistics are accompanied by respective "rates", where the number of each is presented over a second's worth of time, and provides a current display of the data rate. These are the most useful aspects of this statistical section, because it shows what the drive is currently doing.
Disk Usage:
Space utilized
The amount of space being used on the drive (in short and long versions)Space free
The amount of space that is free on the drive (in short and long versions)
Network:
Packets in/Packets out
This is the total number of TCP packets that have been received or sent from the system, and is similar to "Reads in" in the "Disk Activity" section.Data received/Data sent
This is the total number of bytes currently received or sent through the network.
As with the "Disk Activity" section, all of these statistics have their respective "rates" as well, showing the current activity level.
Other Activity Monitor Windows
Available in the "Window" menu, these small floating windows allow for you to have a quick meter of CPU activity and monitor how much CPU the system processes are using.
CPU Usage
This is just an ever-updating snapshot window that shows the total processor usage.CPU History
This is an ever-updating history graph of all the snapshot levels seen in the "CPU Usage" window.
Click the following URL for part 1 of this series: Process organization in OS X
Click the following URL for part 2 of this series: About OS X System Processes
Be sure to check us out on Twitter and the CNET Mac forums.
Topher has been an avid Mac user for the past 10-15 years, and has been a contributing author to MacFixIt for just over a year now. One of his diehard passions has been troubleshooting Mac problems and making the best use of Macs and Apple hardware both for family and friends, as well as in the workplace. He and the newly formed MacFixIt team are hoping to bring enhanced and more personable content to our readers, and keep the MacFixIt community going here at CNET. If you have questions or comments for Topher or the other MacFixIt editors, feel free to contact us at http://www.macfixit.com/contact
Resources