Safe to Quitsyslogd on Mac: why the log writer is using CPU, and which app is really to blame
syslogd is the small macOS service that writes older-style system log messages to disk. On its own it does almost nothing: normal is 0 to 1 percent CPU. When it climbs to 30, 50 or 100 percent, it is because some other process is sending it a flood of messages, often thousands per second, and syslogd is just the one writing them down. The fix is never to quit syslogd. It is to find the chatty process, which is usually a third-party app, a stuck network service, or trustd failing repeatedly, and to quit or restart that.
- What it is
- The legacy system logger. Apps and daemons that still use the old syslog interface send their messages here.
- Normal
- 0 to 1 percent CPU, a few megabytes of memory. You should never notice it.
- Not normal
- Sustained CPU above 10 percent. That is a symptom: something else is logging in a loop.
- Safe to quit?
- No. It is a root system service, it relaunches, and quitting does not stop the flood.
- The one safe fix
- Find the process that is logging nonstop and quit that app, or restart the Mac to reset it.
What syslogd does
macOS has two logging systems. The modern one, used by Apple's own software since 2016, is the unified log, handled by logd and read with the Console app. The older one is the classic Unix syslog, and syslogd is its daemon. It accepts messages from any program that still uses the old interface, formats them, and writes them to files such as system.log under /var/log.
Plenty of software still talks to it: older third-party apps, command-line tools, VPN clients, printer drivers, some antivirus products, and a few Apple services that log through both paths. Each message is a few lines of text, and under normal conditions syslogd handles them in microseconds and goes back to sleep. It runs as root, starts at boot, and is one of the processes macOS will relaunch instantly if it stops.
That design is exactly why it looks guilty when something goes wrong. A program stuck in a loop that logs an error on every pass can generate thousands of messages a second. syslogd has to receive, format and write every one. The loop is in the other program; the CPU shows up on syslogd.
What normal looks like
Because syslogd only reflects other processes, its load has a very simple shape:
The most-visited Apple Community thread on this, with well over a hundred replies, is titled around trustd, nsurlsessiond and syslogd causing high CPU together. One contributor worked out the relationship: the syslogd load was the result of excess logging from the other two. That is the general rule. syslogd is the scribe, not the author.
Why syslogd is using CPU right now
- A security or network daemon is failing on repeat. trustd cannot verify a certificate, nsurlsessiond cannot reach a server, or a VPN keeps reconnecting. Each failure logs an error. Hundreds of times a minute, that is a flood.
- A third-party background tool is stuck. An old menu bar utility, a printer or scanner helper, a license checker, a backup agent, or antivirus. These are the most common sources in the forums, and they often date from before the app was updated for your macOS version.
- A full or failing disk. When writes fail, the program that failed logs it, syslogd tries to write that message, the write fails, and so on. Very low free space can create this.
- A corrupt preference or keychain item. A service tries to read it, fails, logs, and retries immediately. Logging out and back in sometimes clears this; a restart usually does.
- Right after a macOS update. Services are being migrated and some log heavily for a while. This settles within an hour or so on its own.
What is almost never the cause: syslogd itself. There is no setting in it to adjust and no cache to clear.
How to find the process that is flooding the log
Open the Console app from Applications, Utilities. Click your Mac under Devices on the left. Click Start Streaming if it is not already running. Within a few seconds you will see the live log scroll. When syslogd is busy, one process name will dominate the Process column, often repeating the same message over and over. That name is your culprit.
If the stream moves too fast to read, pause it, click any line, and the detail pane shows the process and the subsystem. You can also type the process name into the search box to confirm the volume.
Then go back to Activity Monitor. If the culprit is an app you installed, quit it normally. If it is an Apple service such as trustd, the problem is usually network or certificate related, and a restart or a change of network is the right move, not a force quit.
Is it safe to quit syslogd?
No, and it is also pointless. syslogd runs as root, so Activity Monitor will ask for your password and then macOS will relaunch it within a second. The messages that were piling up are still coming, so the new syslogd goes straight back to full CPU. You gain nothing and you lose the log entries that would have told you what was wrong.
The thing to quit is the app at the other end. If it is a user app, quit it. If it is a system daemon, treat the high syslogd load as a message that something is failing in a loop, and fix that: reconnect the network, log out, or restart.
The checker above returns the same answer for every root daemon: leave it, fix the cause.
What to do, in order
- Confirm it is sustained
A brief syslogd spike during an app launch or an install is normal. Watch Activity Monitor for two minutes. Only a steady load above 10 percent needs action.
- Open Console and find the chatty process
Applications, Utilities, Console. Select your Mac, click Start Streaming, and look for the process name that repeats. This takes under a minute and tells you exactly who to deal with.
- Quit that app if it is one you installed
Quit it from its menu or Dock icon. If it has a menu bar item, quit from there. syslogd should drop to zero within seconds. Check whether an update for that app exists before launching it again.
- Change network or reconnect
If the source is trustd, nsurlsessiond or a VPN, turn Wi-Fi off and on, or disconnect the VPN. Certificate and network failures stop looping once the connection is healthy.
- Free up disk space
If the disk is nearly full, failed writes can drive a logging loop. Keep 10 to 20 GB free. The free up space guide has the safe steps.
- Log out, then restart
Logging out clears user-level services. If that is not enough, a restart resets every daemon and clears any stuck state. This fixes the large majority of cases where the source is an Apple service.
- Remove or update the offending login item
If the same third-party process comes back after a restart, open System Settings, General, Login Items & Extensions, and turn it off. Then update or uninstall the app. See Mac background items for how to audit the list.
When to worry
High syslogd on its own is not dangerous. It is a loud symptom. Worry a little when:
- It stays high across a restart with no third-party apps running, which suggests a failing disk or a corrupt system state that may need a reinstall of macOS over the top.
- The log files themselves are growing by gigabytes, filling the disk. Console will show the same message millions of times.
- The chatty process is one you do not recognize and did not install. Check its path in the Activity Monitor info panel before assuming the worst.
None of these call for deleting log files by hand or touching anything in the hidden system folders. Fix the source, restart, and macOS trims its own logs.
- 1Some process fails and logs the error
- 2It retries immediately and logs again
- 3syslogd receives and writes each message
- 4syslogd CPU climbs; the source is hidden
- 5Console reveals the repeating process name
- 6Quit or restart that; syslogd falls to zero
One more thing that helps: knowing which process started misbehaving and when. Safe to Quit keeps a history of every process over the day, so when syslogd spikes you can see which other name jumped at the same minute.
What people hit, in their words
“The syslogd high CPU I am pretty sure is a result of the excess logging coming from trustd and nsurlsessiond.”
“I'm trying to do the operations you recommend, but I feel like a beginner.”
Questions people ask
What is syslogd on Mac?
syslogd is the daemon that handles the classic Unix system log on macOS. Programs that still use the older syslog interface send their messages to it, and it writes them to log files under /var/log. Apple's own software mostly uses the newer unified log handled by logd, but many third-party tools and some system services still go through syslogd. It runs as root and starts at boot.
Why is syslogd using high CPU on my Mac?
Because something else is sending it a flood of messages. A process stuck in an error loop can log thousands of lines a second, and syslogd has to write every one. The usual sources are trustd and nsurlsessiond failing on a network or certificate problem, a stuck third-party background tool, a VPN reconnecting endlessly, or a disk that is nearly full. Console shows which process it is.
Can I quit syslogd?
You can try, but it needs your password, macOS relaunches it within a second, and the flood of messages is still arriving, so the CPU comes straight back. Quitting also loses the log lines that would show you the cause. The effective move is to find the process that is logging nonstop in Console and quit or restart that instead.
How do I find what is writing to syslogd?
Open Console from Applications, Utilities, select your Mac in the sidebar, and click Start Streaming. The live log scrolls past; when syslogd is busy, one process name repeats far more than any other, usually with the same message. Click a line to see the process and subsystem in the detail pane. That process is the cause, and syslogd will calm down as soon as it stops.
Is syslogd a virus?
No. syslogd is part of macOS, lives on the sealed system volume at /usr/sbin/syslogd, and runs as root under launchd. A process using the same name from another location would be suspicious, but that is not what people see in these reports. High CPU on the real syslogd means another process is logging in a loop, which is a bug or a failing connection, not malware.
Sources and further reading
- Why are trustd, nsurlsessiond, syslogd causing high CPU on Mac? Apple Community, Apr 2020. More than a hundred replies; source of the quotes above.
- Unified logging and syslog on macOS Eclectic Light. How the unified log and the legacy syslog relate.
- Console User Guide: view log messages Apple's guide to streaming the live log.
- What to do when a process uses too much CPU Eclectic Light, Jun 2023. The general method for tracing a busy daemon back to its cause.