Published on MacDevCenter (
 See this if you're having trouble printing code examples

What Is Activity Monitor (or How to Take Your Mac's Pulse)

by Giles Turnbull
Activity Monitor

Activity Monitor is a GUI application included with Mac OS X. It provides graphical representations of your computer's CPU, system memory, disk activity, disk usage, and network processes. This little utility is easy to overlook, but it can help you manage your memory and processing power when running lots of applications. If you prefer to work in the text-only Terminal application instead, you can view much of this information by using the top command.

In this article

  1. What to Look For
  2. What's Keeping My Computer Busy?
  3. What's Happening with That Process?
  4. What's My Computer Actually Doing?
  5. What Can I Use All of This For?

Your computer is always, always, doing things. Even when you've just booted up, and it seems no applications are running, stuff is happening in the background.

There's the Finder, for one thing. The Mac OS X file manager runs automatically and starts consuming system resources straight away. And don't forget about the daemons and utilities running where you can't see them. Some simply don't have any graphical interface for you to see, others do, and have been told to keep it out of sight until needed.

Everything that's running on your computer consumes resources. But what are these resources and why do they matter?

Computers are very good at doing tasks that humans don't enjoy or tend to get wrong. But even the smartest computer's resources are finite. There's a limited amount of memory available for the OS and its applications to run in; a limited number of instructions that the CPU can handle at any one time; and a limited amount of disk space for them all to write files to.

Sometimes, a computer starts to run short of one or more of these resources, and that's when problems start. If there's not enough memory, applications start to run very slowly, or freeze up altogether. That's when Activity Monitor comes in handy. You can find this utility in your /Applications/Utilities folder. If you're running OS X 10.4, a Spotlight search for "activity" will find it for you.

What to Look For

When you open Activity Monitor, you will probably see something like this:

Activity Monitor's default view

Let's dissect the window. At the top there's a toolbar. You can customize this to your wishes as with any other Cocoa app. The main information area, the processes list, displays statistics about your computer's performance in real time. Each process represents an application, utility, or other program or daemon that is currently in use.

Underneath are a series of tabs for switching between further detailed views of different sources of information--different system resources. They are: CPU, System Memory, Disk Activity, Disk Usage, and Network. First, let's look at the processes list.

Mac OS X Tiger in a Nutshell

Related Reading

Mac OS X Tiger in a Nutshell
A Desktop Quick Reference
By Andy Lester, Chris Stone, Chuck Toporek, Jason McIntosh

What's Keeping My Computer Busy?

The processes list shows every application, utility, or daemon currently running on your computer, whether it's visible to you or not. Each running process has a row of its own. You can sort the display in different ways by clicking or option-clicking on any of the column headings. Let's go through the columns one by one, to see what they're for.

The left-most column displays the Process ID. This is a number assigned to each process by the computer. The number increases incrementally when another app is opened or process begun. The higher the process IDs are, the longer your computer has been running and adding processes to the list.

If you sort the list by Process ID, you can quickly see what the most recent applications or processes are. If you've just launched something that's slowed the whole machine to a near-standstill, this might help you spot the culprit.

Next along to the right is the Process Name, which is straightforward enough. The names you recognize in this list are the applications you're running, and they will probably be visible in the Dock or the Menu Bar. Anything you don't recognize here is likely to be a system process running behind the scenes.

Sorting the list by Process Name is handy for finding the details of a particular app. If one app is unresponsive, or keeps displaying the Spinning Beach Ball of Doom, you might be able to find out why.

After that there's the User column. Every running process is under the control of one of the users on your computer--although in this case, the computer itself can be a user. Processes assigned to root were instigated by the operating system, the kernel, or some other high-level part of the system. Most of these are things that are essential to the smooth running of your system--such as automount, which makes external hard disks or optical disks appear magically on your desktop when you connect or insert them.

There's a toolbar control for sorting by User. It lets you toggle the list between showing only the processes owned by you, or only those owned by the computer, or all processes. You can also choose to see only active, inactive, windowed, or your selected apps. This comes in handy when you have a very large number of processes running, and need to filter the list to make it easier to spot problems.

The next column is % CPU, and this is where things start to get really interesting.

This column shows what percentage of your processor's available capacity is being consumed by one single process. Usually, processes that are actively working on a task will move to the top of this column if you choose to sort the list with it.

So if iPhoto is importing pictures, Mail is fetching messages, or GarageBand is working on your pop masterpiece, those apps will be eating up much more processor oomph than TextEdit or Preview sitting quietly in the background. When your computer is slowing down, you can soon spot which process is hogging the CPU.

Next along is the # Threads column. A thread is a sequence of instructions being performed by one application or process, so one app might be running several of them simultaneously. The more threads you see shown in this column, the busier that application is. If there are several threads visible, but nothing appears to be happening on your screen, it might be a sign that the application is busy doing something in the background.

Finally, you'll see two more columns showing Real Memory and Virtual Memory, shown as a number of megabytes in use. Real memory is simply the physical memory you have installed in your machine--the sticks of 256MB, 512MB or 1GB RAM that are fixed into dedicated slots on the motherboard. This is the memory where the computer actually does work, where processes are run.

Virtual memory, on the other hand, is fake memory that uses a chunk of your hard disk. A specialist program (on OS X, it's the dynamic_pager process--look at the All Processes view in Activity Monitor and you'll find it lurking somewhere down the list) keeps track of everything that's in real memory and periodically assigns some data to virtual memory, by means of an essential swap file on the hard disk. Stuff gets sent to the swap file until it is needed, at which point it is called back into real memory. Something else is stored in virtual memory in its place.

This is how today's RAM-hungry operating systems and applications manage to run lots of stuff at the same time. Now that plenty of RAM and plenty of hard disk space come as standard on every new computer, it's easy for the system to swap data between different types of memory and make the most efficient use of the hardware available.

There are other columns you can select for viewing if you wish. Under View -> Columns, you'll see CPU Time, # Ports, Private Memory, Shared Memory, Messages Sent, and Messages Received. All of them have their own uses, but we shan't go into any further detail on them in this article.

What's Happening with That Process?

No matter how you sort the information in the processes list, any single process can be selected for further inspection. Simply double-clicking on a process in the list brings up a panel of detailed information about it. Let's take a look at one of those panels now.

A panel showing details of the running BBEdit process

The upper section of the panel gives you a summary of essentials: the parent process (that which initiated the one you're looking at now), the user, the process group, the percentage CPU use, and the number of recent hangs. The title bar of the panel tells you the process name and in parentheses, the corresponding process ID number.

The lower half of the info panel is divided into tabs. The first, Memory, goes into more detail about the process' memory usage. Alongside Real and Virtual Memory figures, it offers Shared, Private and Virtual Private. If that's not enough types of memory for you, just wait for the System Memory tab. We'll come to that later.

The second tab, Statistics, goes into much more detail. It tells you everything a hardened geek might ever wish to know about the way this process has been behaving since it was activated.

There may also be a third tab, Open Files and Ports, which displays a list of the files on the computer that this process is making use of. Note that these are files the process is using, not files that you have opened using the application. If you have a document open in Pages, that document's name will not appear in this list. At the end of the list, you'll see IP addresses or domains that the process is using, assuming its function requires some sort of network connectivity.

To be honest, most of the information in these info panels is more than most users will ever need, or need to understand. Experienced users are the only ones likely to ever have a need to check this kind of detail, and they know what all the jargon means already.

What's My Computer Actually Doing?

Now take a look at the lower section of the Activity Monitor window, the area with five tabs:

The lower tabbed section looks like this

Let's go through those tabs one by one, to get an overview of what each one is about.

The CPU tab shows you a simple graph of what the processor in your computer is doing. By default, the bar graph shows what percentage of resources it is devoting to System-level processes (essential operating system stuff, shown in red) and what percentage is allocated to User processes (the apps you're trying to Get Stuff Done in). You're also given totals for the number of threads and processes the chip is coping with. Simpler versions of this graph can be displayed on screen all the time, if you're keen on knowing what's going on all the time; we'll cover that in the final section.

The System Memory tab is another graph, this time as a pie chart. It tells you how much of your computer's real memory is actually being used. The VM Size figure is the amount of hard disk space being used for virtual memory or swap file; Page In/Outs refers to chunks of data being swapped in and out of the virtual memory store by the operating system.

For more detail on the hard disk's role in everything, the Disk Activity tab is the place to look. Here you can see exactly how much data is being, or has been, swapped in and out of virtual memory.

The Disk Usage tab is simple enough. It shows you how much of your hard disk space is being used, and how much is free. If the Space Free section of the pie chart is getting worryingly narrow, you probably need to archive some files off the hard disk, prune your music and movie collections, and maybe consider buying another disk to free up more space. Don't forget that the computer depends on the hard disk for virtual memory; if it starts getting too full, the whole system will slow down.

Finally, the Network tab displays a graph of the amount of data going in and out of your machine over the network. Next time you're downloading some huge .torrent file from somewhere, you should see it show up clearly as a spike on this graph.

What Can I Use All of This For?

The most useful things you can do with Activity Monitor are (1) keep a close eye on your computer's performance, and (2) zap applications or processes that have frozen or crashed.

If performance matters, and you like to know what kind of strain the processor is under at all times, you can tell Activity Monitor to display various indicators for you. Under the Window menu you'll find three different CPU usage displays which you can have floating constantly on your desktop if you wish.

The CPU history window   CPU usage window   Small floating CPU usage indicator

What's more, the humble Activity Monitor icon in the Dock can be set to display any of these graphs, or the network activity or memory usage pie chart. Just go to View -> Dock Icon, and select the process you want to monitor on the Dock.

Even if the processor and memory activity don't interest you, the ability to see what kind of network traffic is coming in and out of your machine might be useful, especially if you're still on a dialup connection.

And if you don't even care about network usage, or indeed any other performance indicator, Activity Monitor can still be a useful tool for finding problem apps and force-quitting them.

Tiger users who never paid much attention to Activity Monitor before might want to revisit it for keeping an eye on their Dashboard Widgets. More than once I've spotted a Widget that I don't use much, gobbling up loads of CPU. I can then take the Widget off my active Dashboard until I actually need it.

Much of what Activity Monitor does can also be done with top, a Unix program run in Terminal. If you're happy using command-line apps, top is probably a quicker way to spot the process IDs of misbehaving apps, which can then be stopped using the kill command. But if the command line puts you off, Activity Monitor's friendlier approach might be a better bet.

Giles Turnbull is a freelance writer and editor. He has been writing on and about the Internet since 1997. He has a web site at

Return to the Mac DevCenter

Copyright © 2009 O'Reilly Media, Inc.