How to Use Activity Monitor on a Mac (Read It Properly)

Activity Monitor is the only tool you need to diagnose a slow Mac, and it's already installed. The problem is that it shows about forty numbers and only three of them usually matter. This guide covers which ones, what the strange process names mean, and how to tell a genuine problem from macOS doing its job.

Opening it

Activity Monitor lives in /Applications/Utilities. The fastest way there is ⌘ + Space, type activity, press Return. If you're going to be watching it for a while, right-click its Dock icon and choose Dock Icon → Show CPU History — you get a live graph in the Dock without keeping the window in front.

One thing to set up first: choose View → All Processes. The default view hides processes belonging to other users and to the system, which is exactly where the interesting ones live.

The CPU tab: who's using the processor

Click the % CPU header once to sort descending, then watch for thirty seconds rather than taking a snapshot. Momentary spikes are normal; a process that stays at the top is your answer.

Two columns are worth understanding beyond % CPU:

• CPU Time — cumulative processor time since the process launched. A process using 2% right now but showing hours of CPU Time has been busy all day, which is often the more useful signal on a laptop.
• Threads — how many parallel tasks it's running. Useful mainly for spotting a process that has run away and spawned hundreds.

Percentages above 100% are not a bug. On a multi-core Mac, 100% means one core fully used, so a video export legitimately showing 780% just means it's using nearly eight cores. Process names shown in red are not responding — that's the same state that produces the spinning beach ball.

Process names that alarm people and shouldn't

• kernel_task — macOS itself. High usage generally means it's deliberately making the CPU less available to control heat, not that something is broken.
• mds, mds_stores, mdworker_shared — Spotlight building its search index. Expected after an update or a large file copy; it stops when it's done. If it never stops, rebuild the index.
• WindowServer — draws everything on screen. It rises with more displays, more windows, and heavier animation, which is one reason turning animations down helps older Macs.
• photoanalysisd — Photos scanning for faces and Memories. Runs when idle and on power; it finishes eventually.
• backupd — Time Machine mid-backup.
• syspolicyd, XProtectService — the security checks macOS runs when you launch an app for the first time. Brief by design.

The Memory tab: the one number people read wrong

Ignore “free” memory. macOS deliberately fills unused RAM with cached files because empty RAM does nothing for you, and it hands that memory back the instant an app asks. A Mac with almost no free memory and green pressure is a Mac working exactly as designed.

Read these instead:

• Memory Pressure (the graph at the bottom) — green means supply is comfortable, yellow means macOS is compressing and swapping to keep up, red means it's out.
• Swap Used — how much memory has been pushed out to the SSD. A few hundred megabytes is routine. Several gigabytes alongside yellow or red pressure is a genuine shortage.
• Compressed — memory macOS squeezed rather than swapping. Compression is much faster than swap, and a large compressed figure with green pressure is a good sign, not a bad one.

Memory pressure explained goes into what each colour should change about your behaviour.

Energy, Disk and Network

The Energy tab only appears on laptops, and its most useful column is 12 hr Power — an average rather than a snapshot, which is how you catch an app that quietly drains the battery in the background rather than one that's obviously busy right now. See fixing fast battery drain.

The Disk tab shows bytes read and written per process. It's the tab to check when the Mac is slow but CPU and memory both look fine: heavy sustained writes usually mean a sync client, a backup, or swap. The Network tab does the same for data sent and received, which is how you find the app saturating your connection before you go and test the line itself.

Quitting something safely

1. Select the process.
2. Click the ✕ button in the toolbar.
3. Choose Quit first. This asks the app to close normally, so it can save.
4. Only choose Force Quit if a normal quit does nothing after ten or fifteen seconds — it discards unsaved work.

Don't force quit processes you can't identify. Many are system daemons that macOS immediately relaunches, and a few will take the interface down with them. If the name means nothing to you, search it before you kill it. The force quit guide covers the keyboard and Dock routes as well.

The Terminal equivalent

When the interface is too busy to draw Activity Monitor, Terminal still works — sometimes it's the only thing that does:

# Live process list, sorted by CPU. Press q to quit.
top -o cpu

# Sorted by memory instead
top -o mem

# One-line memory and swap summary
sysctl vm.swapusage

None of these change anything — they only report.

The settings-level fixes above are one-click, reversible toggles in Mainspring — labelled in plain English, with an undo button for every one.

Common questions

What should CPU usage be on an idle Mac?

On an idle Mac, total CPU usage typically sits in the low single digits with brief spikes as background tasks run. A single process holding above 80% while you are doing nothing is worth investigating; short bursts are not.

Why does Activity Monitor show over 100% CPU?

Percentages are per core. On a Mac with eight cores, the maximum is 800%, so a process showing 400% is using roughly four cores. It is normal for exports, compiles and video calls.

Is it safe to force quit processes in Activity Monitor?

It is safe for apps you recognise, though you lose unsaved work. Avoid force quitting system processes you cannot identify: macOS will usually relaunch them immediately, and a few will log you out or freeze the interface.

What is kernel_task and can I stop it?

kernel_task is the macOS kernel itself. You cannot and should not quit it. High kernel_task CPU is usually macOS reserving processor capacity to bring temperature down, so the real fix is improving cooling rather than touching the process.

Does Activity Monitor slow down my Mac?

Its own overhead is negligible. Leaving it open is fine, and the Dock icon graph option lets you keep watching without a window in the way.