Activity Monitor on Mac, explained: every tab and column in plain English

What Activity Monitor is and how to open it

Activity Monitor is a utility that ships with every Mac, in Applications, Utilities. It shows every process the Mac is running: the apps you opened, the helper processes those apps spawn, and the few hundred background processes macOS runs on its own. For each one it shows how much CPU, memory, energy, disk and network it is using right now. It is the first place to look when a Mac is slow, hot or loud, and it is the only place that gives you a name to look up.

Open it with Spotlight (⌘Space, type "act", press Return) or from Finder: Applications, Utilities, Activity Monitor. If you use it often, right-click its Dock icon and choose Options, Keep in Dock. The same Dock menu lets you show CPU usage or history in the Dock icon itself, which is a handy always-on gauge.

Two settings make it easier to read. In the View menu, set Update Frequency to Very often (1 sec) when you are hunting something and back to Often when you are not, because the monitor itself uses a little CPU. And in View, choose All Processes rather than My Processes if you want to see macOS's own daemons; by default you see only your processes, which hides things like kernel_task and mds_stores that are often the answer.

My Mac is slow. Which tab do I open?

Each tab answers a different question. Follow this path and you arrive at the right one in a few clicks.

If the top process is a name you do not recognize, look it up before deciding anything. The why is my Mac so slow guide walks the five usual causes in order, and the process pages on this site say what normal looks like for the common ones.

The CPU tab: % CPU, CPU Time, Threads, Idle Wake Ups

% CPU is the share of one processor core the process is using right now. Each core counts as 100, so on an 8-core Mac the total available is 800, and a single process at 100 has one core fully busy. That is why you see numbers above 100: a video export at 600 percent is using six cores, which is what it should do. A process at 100 can make its own app feel stuck without slowing anything else; a process at 300 or more pulls the whole Mac down. Sort by this column (click the header) and watch for 30 seconds, because many processes spike for a moment and settle.

CPU Time is the total processor time the process has used since it started, in hours, minutes and seconds. A high CPU Time with a low % CPU is a process that was busy earlier and is now quiet, which is normal for things like mds_stores after indexing. A high CPU Time that keeps climbing on a process you do not recognize is worth a look.

Threads and Idle Wake Ups are mostly for developers. Idle Wake Ups is the one worth knowing about on a laptop: a process that wakes the CPU hundreds of times a second while doing nothing visible is a battery drain, and Apple built the Energy tab largely to surface this.

The summary at the bottom shows System, User and Idle percentages for the whole Mac. System is time spent inside macOS itself (the kernel, drivers); User is time spent in apps. A high System share with nothing obvious at the top of the list usually points at kernel_task, which is to say heat, or at a driver problem.

The Memory tab: Memory vs Real Memory vs Compressed, and the pressure graph

This tab confuses more people than the other four combined, because it has several numbers that sound like the same thing. Here is what each means.

Memory (the default column) is the process's footprint: the memory it has dirtied plus whatever of that is currently compressed or in swap. This is the column to sort by when hunting a leak, because it does not shrink when macOS compresses the process. Real Memory (add it from View, Columns) is how much physical RAM the process is occupying right now; it goes down when pages are compressed or swapped out, so it understates a leaking app. Compressed Memory is the part of the footprint macOS has squashed to save RAM; a large value here is macOS doing its job, not a problem.

At the bottom: Physical Memory is how much RAM the Mac has. Memory Used is RAM in use, split into App Memory (your apps), Wired Memory (what macOS needs and cannot compress or swap) and Compressed. Cached Files is RAM holding recently used files so they open faster; macOS gives it up the instant an app needs it, so it is effectively free. Swap Used is how much has been written to the swap file on the SSD.

The Memory Pressure graph is the number that matters, and Apple says so in its own guide. Green means macOS has room. Yellow means it is compressing and starting to swap. Red means it is out of room and performance is suffering. A Mac can show Memory Used at 95 percent of Physical Memory and be perfectly happy in the green, because Cached Files are counted as used. It can show several gigabytes of swap and be fine, because that swap holds pages nothing has asked for in days. What it cannot do is sit in the yellow or red and feel fast. The memory pressure guide goes deeper, and the application memory dialog page covers what happens when it goes all the way to red.

The Energy tab: Energy Impact, 12 hr Power, App Nap

Energy Impact is a relative score of how much power a process is using right now, combining CPU, GPU, disk, network and how often it wakes the processor. It has no unit. Higher is worse, and anything consistently in the dozens on a laptop that is sitting idle is worth noticing. 12 hr Power (on MacBooks) is the same score averaged over the last 12 hours or since startup, so it catches the app that was quietly busy while you were doing something else. If the question is "why did my battery drop 30 percent during the meeting", sort by 12 hr Power.

The Energy tab is also the easiest place to see which helper processes belong to which app, because it groups them under the parent app with a disclosure triangle. If you have been staring at "Google Chrome Helper (Renderer)" in the CPU tab wondering which app owns it, this tab answers that.

App Nap shows whether macOS has put a backgrounded app into a low-power idle state. Preventing Sleep shows which process is keeping the Mac awake; if the lid is closed and the MacBook is still warm in the morning, this column names the culprit. The battery draining fast guide uses both.

The Disk and Network tabs

The Disk tab shows how much each process has read and written since it started. Sort by Bytes Written to find what is filling the disk or wearing the SSD: sync clients during a big upload, Time Machine during a backup, mds_stores during indexing, and the occasional app writing logs in a loop. The graph at the bottom shows reads and writes per second for the whole Mac. A disk graph that is flat out while the CPU is idle explains a Mac that is slow to open and save things but fine once an app is running.

The Network tab shows packets and bytes sent and received per process. Sort by Sent Bytes to find out what is uploading (a cloud backup, a sync client, a video call) and by Rcvd Bytes to find what is downloading (a macOS update, an app update, a streaming video in a background tab). Numbers here are cumulative since the process started, so a big number on a process that has been running for a week is not a problem by itself; a number that is climbing fast while you watch is.

Which processes are macOS and which are yours?

Add the User column if it is not showing (View, Columns, User). Processes running as your username are yours or your apps'. Processes running as root or as a name starting with an underscore (_spotlight, _windowserver, _coreaudiod) are macOS. Most macOS process names end in "d", for daemon: mds, mdworker, corespotlightd, cloudd, bird, trustd, nsurlsessiond. A few do not: kernel_task, WindowServer, launchd, Finder, Dock.

For the ones that turn up at the top most often: kernel_task high means the Mac is hot and macOS is throttling it on purpose; cool it down. WindowServer draws the screen; high CPU means lots of windows or an app redrawing constantly, high memory after days of uptime means log out and back in. mds_stores, mdworker and corespotlightd are Spotlight indexing; they finish on their own in minutes to a few hours. Apple Community threads are full of people alarmed by these: one saw corespotlightd that "often occupies more than 100% of the CPU load, sometimes spiking as high as 400%", another saw mds_stores "consistently using more than 85% of the CPU". Both are indexing, and both settle.

If you see a name you do not know, type it into the box below. The rule of thumb while you wait: if you can name the app it belongs to, it is yours and safe to quit; if it is a root daemon, look it up before doing anything, and expect the answer to be "leave it" or "wait".

Safe to Quit, the Mac app this site belongs to, does this lookup automatically and adds the part Activity Monitor cannot show: how long the process has been busy and whether it is growing, which is the difference between "indexing, wait" and "leaking, quit".

When is it safe to force quit, and when is it not?

The X button in the toolbar (or ⌥⌘Esc anywhere on the Mac) offers Quit and Force Quit. Quit asks the app to close normally, which saves state and is always safe to try first. Force Quit kills the process without asking. For your own apps, it is safe whenever an app has ignored ⌘Q for a minute or more: you lose unsaved changes in that app and nothing else. For a browser, force quitting loses unsaved form text but the browser will usually offer to restore tabs.

For macOS processes, Force Quit is at best useless and at worst disruptive. Daemons are managed by launchd, which restarts them within seconds, so you gain nothing. Some are load-bearing: force quitting WindowServer logs you out instantly, force quitting Finder or Dock just relaunches them, force quitting kernel_task is refused outright. The right move for a busy system process is to find out why it is busy and address that: heat, indexing, a sync in progress. The force quit guide covers the edge cases, including apps that will not die on the first try.

One practical tip: Activity Monitor can look up a process for you. Select it and choose View, Sample Process to see what it is doing, or double-click it and open the Open Files and Ports tab to see which files it has open. Both tell you more than the name does, and both are read-only.

Sort tricks and settings that make it faster to use

Click any column header to sort by it; click again to reverse. Click a header while holding nothing and the list resorts live every refresh, so a process that spikes jumps to the top and back down. The search box in the toolbar filters by name, which is the quick way to find one process across the hundreds listed. View, Columns adds or removes columns; the ones worth adding are User (to tell macOS from yours), Real Memory (on the Memory tab) and Bytes Written (on the Disk tab).

View, Update Frequency sets how often the list refreshes. Very often (1 second) is right while you are diagnosing; Often (2 seconds) or Less often (5 seconds) when it is sitting in the background. View, Dock Icon turns the Dock icon into a live CPU or memory graph. Window, CPU History and Window, GPU History open floating graphs you can leave on a second screen. And Window, Keep CPU Usage Window on Top pins a small per-core bar chart that is often the quickest way to see whether the Mac is doing nothing or doing everything.

Finally, Activity Monitor only shows the present moment. It cannot tell you that a process was at 400 percent an hour ago, or that WindowServer has doubled since lunch. For that you either check it repeatedly, keep the CPU History window open, or use something that watches over time.