Guides/Activity Monitor glossary
Activity Monitor glossary
Quick answer
Activity Monitor lists every process on your Mac across five tabs: CPU, Memory, Energy, Disk and Network. Three figures answer most questions: % CPU for an app that will not rest, Memory Pressure for whether the Mac is short of RAM, and Energy Impact for battery drain. System processes near the top, such as kernel_task, WindowServer and mds_stores, are usually macOS doing its own work. The 46 terms below are listed from A to Z.
Activity Monitor is the Mac’s built-in task manager, in Applications > Utilities. It packs a lot into a few columns and a footer of numbers, and it explains almost none of it on screen. This glossary does. Each entry says what the term means on macOS 26 Tahoe and, where it matters, when the figure is a problem. Entries are listed from A to Z, and the row of letters at the start of the list jumps straight to one.
How to use the glossary
Every term has its own link, so other guides can point straight at one definition. Memory pressure is the single most useful entry if you only read one: it is the figure Apple itself uses to say whether a Mac needs more RAM (Apple, macOS 26). Definitions of Activity Monitor’s figures follow Apple’s Activity Monitor User Guide for macOS 26. Process descriptions come from Apple’s support articles and the manual pages that ship with macOS, such as man launchd or man mdworker.
A few entries add a Terminal command that shows the same information. They only read values; none of them change anything on your Mac.
When a term points to a problem
Most of these figures are only worth worrying about when they stay high while you are not using the Mac. When one does, a step-by-step guide takes over:
- An app pinned at the top of % CPU, or a slow Mac in general: why your Mac is slow and how to check CPU and memory usage.
- Memory Pressure in yellow or red, or Swap Used that keeps growing: how to free up RAM on a Mac.
- kernel_task at the top and loud fans: why your Mac’s fans are loud.
- An “address already in use” error: what is using port 3000 on your Mac.
Activity Monitor shows these numbers for the last few seconds, one process at a time. Orcylo groups processes under the apps that own them, about 700 under 25 or so apps on our Mac, and keeps 30 days of history (see what Orcylo adds). Other replacements are compared in the best Activity Monitor alternatives.
A
- App Memory
- The amount of memory being used by apps and their processes. Sort the Memory tab by the Memory column to see which apps make it up.
- See also Memory Used, Memory column.
- App Nap
- A macOS feature that lowers the priority, timer frequency and disk access of apps that are not doing important work, for example an app in the background that is not visible or playing sound. The App Nap column says whether it applies to an app right now.
- See also Energy Impact.
B
- bird
- One of the system daemons behind iCloud Drive (Apple's man page calls it Documents in the Cloud). Activity from bird usually means iCloud Drive is syncing.
- Bytes Read
- The total amount of data a process has read from disk since it started, shown in the Disk tab.
- See also Bytes Written, Reads in and Writes out.
- Bytes Written
- The total amount of data a process has written to disk since it started. An app that writes gigabytes while you are not using it, such as a runaway log or a sync loop, is worth investigating.
- See also Bytes Read.
C
- Cached Files
- Files macOS keeps in otherwise unused RAM so they open faster next time. They stay cached until that memory is needed for something else, so a large figure is normal and not a leak.
- See also Memory Used, Memory Pressure.
- com.apple.WebKit.WebContent
- The WebKit process that loads and runs a web page's code, used by Safari and by apps that show web content. Pages get their own WebContent processes, so one heavy tab shows up as one busy process.
- See also Helper process, Google Chrome Helper.
- Compressed Memory
- Memory macOS has compressed to make more RAM available. When the Mac approaches its memory limit, macOS compresses the memory of inactive apps so active apps have more room. The Compressed Memory column shows the amount for each process; the Memory tab footer labels the total Compressed.
- See also Memory Pressure, Swap Used.
- coreaudiod
- The Core Audio daemon, which handles sound input and output. While audio plays, it can appear among the processes keeping the Mac awake.
- See also Preventing Sleep.
- % CPU
- The share of processor time a process used during the last update, where one fully busy core counts as 100%. A process running several threads at once can pass 100%, and the scale on an eight-core Mac runs to 800% (The Eclectic Light Company).
- See also CPU Time, Threads, Performance and efficiency cores.
D
- Data received and Data sent
- The total amount of data received and sent over the network, with throughput per second. Per process, the same information is in the Rcvd Bytes and Sent Bytes columns.
- See also Packets in and Packets out.
E
- Energy Impact
- A relative measure of how much energy a process is using right now; lower is better. It has no unit, so it is only useful for comparing processes with each other.
- See also 12 hr Power, Idle Wake Ups.
F
- Force Quit
- Ends a process immediately, without letting it save or clean up. Apple warns that if the process has files open you may lose data, so try Quit first and keep Force Quit for an app that does not respond.
- See also Process.
G
- Google Chrome Helper
- Chrome runs its work in separate helper processes: Google Chrome Helper (Renderer) for web pages, Google Chrome Helper (GPU) for graphics, and plain Google Chrome Helper for the rest. To see which tab or extension a helper belongs to, open Chrome's own Task Manager from More tools > Task manager.
- See also Helper process, com.apple.WebKit.WebContent.
H
- Helper process
- A separate process an app starts to do part of its work, such as rendering web pages, running extensions or handling graphics. Splitting the work keeps a hang or crash in one page from freezing the whole app, which is why one browser can account for dozens of processes.
- See also Google Chrome Helper, com.apple.WebKit.WebContent, Responsible process.
I
- Idle Wake Ups
- How often a process woke the processor from its low-power idle state. Apple's developer guide describes the number as how many times per second a timer fired, averaged over the sample interval. Every wake costs energy, so a high figure on an app that should be idle drains a laptop battery even when its % CPU looks low.
- See also Energy Impact, App Nap.
K
- kernel_task
- The macOS kernel as Activity Monitor lists it. One of its jobs is to manage CPU temperature by making the CPU less available to processes that use it intensely, so a high kernel_task on a hot Mac is a symptom of heat, not its cause.
- See also Thermal throttling, % CPU.
- Kind
- Shows Apple for processes built for Apple silicon and Intel for Intel-based apps that Rosetta translates in the background. Apple says Rosetta will be limited to certain older games from macOS 28, so an Intel entry is an app to update.
L
- launchd
- The first process macOS starts at boot, with PID 1. It starts and manages system daemons, per-user agents and the XPC services bundled inside apps.
- See also PID, Process.
- Listening port
- A network port where a process waits for incoming connections, such as a dev server on port 3000. Only one process can listen on a given address and port, which is what an "address already in use" error means; lsof -nP -iTCP -sTCP:LISTEN lists every listening port.
- See also PID, Ports.
- Load average
- The average number of jobs in the run queue over the last 1, 5 and 15 minutes, printed by the uptime command in Terminal. A load well above the Mac's number of cores means work is waiting for a free CPU.
- See also % CPU, Threads.
M
- mds
- The metadata server that serves Spotlight and every other client of the metadata APIs. Its manual page says users should not run it manually.
- See also mds_stores, mdworker.
- mds_stores
- A Spotlight process from the same Metadata framework as mds, busy while the search index is built or updated. High CPU and disk use from it after a macOS update or a migration is indexing, which Apple says can take hours or even days.
- See also mds, mdworker.
- mdworker
- Worker processes Spotlight uses to scan and index files when a volume is mounted or a file changes. On current macOS they appear as mdworker_shared, sometimes a dozen or more at once.
- See also mds, mds_stores.
- Memory column
- The main column of the Memory tab: how much memory each process is using. Sort by it to find the heaviest processes, and watch for a figure that only ever grows over hours, which can mean a leak.
- See also App Memory.
- Memory Pressure
- Activity Monitor's graph of how well RAM is meeting demand, at the bottom of the Memory tab. Apple says it is determined by free memory, swap rate, wired memory and file-cached memory: green means RAM is used efficiently, yellow that the Mac might eventually need more, red that it needs more.
- See also Swap Used, Compressed Memory, Memory Used.
- Memory Used
- The amount of RAM in use right now, broken down to its right into App Memory, Wired Memory and Compressed. A figure close to Physical Memory is normal because macOS puts spare RAM to work; judge shortage by Memory Pressure instead.
- See also Memory Pressure, App Memory, Wired Memory, Compressed Memory.
P
- Packets in and Packets out
- Totals at the bottom of the Network tab: the number of network packets received and sent, with the rate in packets per second.
- See also Data received and Data sent.
- Performance and efficiency cores
- The two kinds of CPU core in Apple silicon: performance cores for demanding work and efficiency cores for lighter tasks at lower power. % CPU counts both the same even though they differ in speed; in Terminal, sysctl hw.perflevel0.logicalcpu hw.perflevel1.logicalcpu prints how many of each your Mac has.
- See also % CPU.
- photoanalysisd
- The Photos library analysis agent. It works through your library in the background for Memories, People and searches by scene or object, so it can stay busy for a while after you import many photos.
- Physical Memory
- The amount of RAM installed in the Mac. On Apple silicon it is unified memory: a single pool that the CPU, the GPU and the chip's other parts all work from.
- See also Memory Used.
- PID
- Process ID, the number macOS gives each running process. Activity Monitor shows it in the PID column, and Terminal tools such as kill, ps and lsof take it to pick a process. A PID is unique while the process runs and can be reused after it ends.
- See also Process, Listening port.
- Ports
- An Activity Monitor column that counts Mach ports, the channels macOS processes use to send messages to each other. It has nothing to do with network ports; a count that climbs without end can mean a leak in that app.
- See also Listening port.
- Preventing Sleep
- Whether a process is keeping the Mac from going to sleep, as a video call, a download or the caffeinate command can. In Terminal, pmset -g assertions lists the power assertions that can keep the Mac awake and the processes that hold them.
- Process
- A program running on your Mac (Operating Systems: Three Easy Pieces): an app, a system app used by macOS, or an invisible background process. A Mac runs several hundred at once, most of them belonging to macOS.
- See also PID, Helper process, Responsible process.
R
- Reads in and Writes out
- Totals at the bottom of the Disk tab: how many times the Mac has read from and written to disk, next to the amount of data read and written and the rates per second.
- See also Bytes Read, Bytes Written.
- Responsible process
- The app macOS holds accountable for a process, such as the app behind the helpers and XPC services that work on its behalf. Activity Monitor lists those helpers under their own names; Orcylo uses the responsible app to group them under the app you recognise.
- See also Helper process, Process.
S
- Swap Used
- Space on the startup disk that macOS is using to move memory out of RAM and back again. The disk is slower than RAM, which is why heavy swapping slows a Mac down (Operating Systems: Three Easy Pieces). Some swap is normal; swap that keeps growing while Memory Pressure is yellow or red means the Mac is short of RAM. In Terminal, sysctl vm.swapusage shows the same figure.
- See also Memory Pressure, Compressed Memory.
T
- Thermal throttling
- The Mac lowering its processor speed to keep temperatures in a safe range. On macOS it shows up as kernel_task high in the CPU tab, often with loud fans on Macs that have them.
- See also kernel_task.
W
- WindowServer
- The system process that manages windows, composites what apps draw into the image on your displays, and routes events such as clicks and key presses to the right app.
- See also % GPU.
- Wired Memory
- Memory the system needs to operate. Apple says it cannot be cached and must stay in RAM, so it is not available to other apps.
- See also Memory Used.
0–9
- 12 hr Power
- The average Energy Impact of an app over the last 12 hours, or since the Mac started if that is more recent. The column appears only on Mac laptops.
- See also Energy Impact.
Questions people ask
What does memory pressure mean on a Mac?
Memory pressure is Activity Monitor's measure of whether RAM is meeting demand, shown as a graph at the bottom of the Memory tab. Green means the Mac is using its memory efficiently, yellow that it might eventually need more, and red that it needs more RAM. It matters more than Memory Used, which is close to full on a healthy Mac.
Why is kernel_task using so much CPU?
Because the Mac is hot. kernel_task takes CPU time away from busy processes to bring the temperature down, so it is reacting to heat rather than causing it. Find the app just below it in the CPU tab and check that the vents are clear.
Why does Activity Monitor show more than 100% CPU?
% CPU counts each core as 100%, so a process that keeps two cores busy shows 200% (The Eclectic Light Company). The scale on a Mac with eight cores runs to 800%. A high figure only matters if it stays high while you are not using that app.
Is it bad if my Mac uses swap?
Not on its own. macOS moves memory to the startup disk when RAM runs short, and some swap is normal. Swap Used that keeps growing while Memory Pressure is yellow or red means the Mac does not have enough RAM for what you run.
What is the difference between WindowServer and kernel_task?
WindowServer draws the screen: it manages windows, composites what apps draw and routes clicks and keys. kernel_task is the macOS kernel itself, which also manages CPU temperature. WindowServer is busy when the screen is busy; kernel_task climbs when the Mac is hot.
Sources
- 1.Apple: View information about Mac processes in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 2.Apple: View CPU activity in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 3.Apple: View memory usage in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 4.Apple: Check if your Mac needs more RAM (macOS Tahoe 26) · support.apple.com
- 5.Apple: View energy consumption in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 6.Apple: View disk activity in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 7.Apple: View network activity in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 8.Apple: Quit an app or process in Activity Monitor (macOS Tahoe 26) · support.apple.com
- 9.Apple: If kernel_task is using a large percentage of your Mac CPU · support.apple.com
- 10.Apple: About Spotlight indexing and search results on Apple devices · support.apple.com
- 11.Apple: Using Intel-based apps on a Mac with Apple silicon (Rosetta) · support.apple.com
- 12.Apple Developer: Energy Efficiency Guide for Mac Apps, Extend App Nap · developer.apple.com
- 13.Apple Developer: Energy Efficiency Guide for Mac Apps, Minimize Timer Usage · developer.apple.com
- 14.Apple Developer: Optimize for Apple silicon with performance and efficiency cores · developer.apple.com
- 15.Apple Developer Forums: Mach port leakage (Activity Monitor Ports column) · developer.apple.com
- 16.The Eclectic Light Company: CPU percentage is misleading on M1 Macs · eclecticlight.co
- 17.Chromium: Multi-process architecture · chromium.org
- 18.Chromium: GPU accelerated compositing in Chrome (the GPU process) · chromium.org
- 19.WebKit documentation: WebKit2 multi-process architecture · docs.webkit.org
- 20.Operating Systems: Three Easy Pieces (University of Wisconsin–Madison), ch. 21: Beyond Physical Memory: Mechanisms · pages.cs.wisc.edu
- 21.Operating Systems: Three Easy Pieces (University of Wisconsin–Madison), ch. 4: The Abstraction: The Process · pages.cs.wisc.edu
About the author
Maker of Orcylo
Orcylo is a native menu bar system monitor for macOS 15 Sequoia and later. It groups about 700 processes under the 25 or so apps that own them, keeps 30 days of history and shows your Claude Code and Codex limits. The guides cover the same ground: what is slowing a Mac down, what Activity Monitor's figures mean, and how much of an AI coding limit is left.
How these guides are written and checked: our editorial policy. To report a mistake, contact support@orcylo.app.