Activity Monitor on Mac: A Practical Deep Dive

The fans on your MacBook are running flat-out, your menu bar clock is stuttering, and Safari has 14 tabs open. Most people open Activity Monitor at this exact moment, scan the CPU column, see a process called “WindowServer” using 80%, and have no idea what to do with that information. Activity Monitor doesn’t lie, but it also doesn’t explain. The names are cryptic, the numbers are easy to misread, and the most useful tabs aren’t the one it opens to.

Let’s fix that. Activity Monitor is genuinely one of the best free diagnostic tools on any operating system once you know what each column means and which processes are worth caring about.

Where to Find It

Activity Monitor lives at /System/Applications/Utilities/Activity Monitor.app. Or just hit Cmd+Space and type “activity.” You can also pin it to the Dock — when troubleshooting becomes a regular activity, having one click between you and process info matters.

By default, it opens to the CPU tab and sorts by CPU%. That’s usually wrong. The most informative tab depends on what’s wrong.

The Five Tabs and What They’re For

Activity Monitor has five tabs across the top:

1. CPU — what’s using your processor
2. Memory — what’s using RAM, and whether you have memory pressure
3. Energy — battery and power impact (laptop-relevant)
4. Disk — read/write activity per process
5. Network — bytes in/out per process

Each tab uses different default columns, and each has menu options for showing more. Use View → Columns to add hidden ones — it’s surprisingly hidden in plain sight.

The CPU Tab Done Right

The CPU tab shows process CPU usage as a percentage of one core. On an M2 with 8 performance cores, a process can theoretically show up to 800% (using all 8 cores fully), though Apple Silicon’s mix of performance and efficiency cores makes the math more nuanced.

Default columns to keep:

• Process Name
• % CPU — current usage
• CPU Time — total time the process has used since launch
• Threads
• PID
• User

Worth adding via View → Columns:

• % GPU — useful when something’s hammering the integrated GPU
• Idle Wake Ups — how often the process is waking the CPU from low-power state (high values = battery drain)

Click the % CPU header to sort. The top entries are your culprits.

Common processes you’ll see at the top

• WindowServer — the system’s display compositor. High usage often means a graphics-heavy window or animation, an external display refresh issue, or accessibility transparency turned up.
• kernel_task — the kernel itself. High usage often means thermal throttling (the kernel artificially loads itself to slow you down when the CPU is hot).
• mds / mds_stores — Spotlight indexing. Spikes after big file changes or after a recent macOS install.
• bluetoothd — Bluetooth daemon. High usage often means a misbehaving paired device.
• launchd — the master process. High CPU here is unusual and suggests a child process is crashing repeatedly.
• Your browser’s helpers — Chrome and Safari spawn one process per tab, and they roll up under the parent. Click the disclosure triangle to see them individually.

If you double-click a process, you get a detailed view: open files, ports, memory usage, even a “Sample” button to capture what the process is doing right now (a low-overhead snapshot of its threads).

Power users use SweepSweep handles all the cleanup that articles like this describe. Get Sweep free →

The Memory Tab and “Memory Pressure”

This is the most misread tab in Activity Monitor. People look at the “Memory Used” number, see it’s near their physical RAM, and panic. That number is misleading on its own.

What actually matters is the Memory Pressure graph at the bottom of the tab.

• Green — your Mac is comfortably handling memory. Even if “Memory Used” looks high, the system is happy.
• Yellow — memory is tight; the system is making decisions about what to compress or swap.
• Red — memory is severely constrained; you’re swapping heavily and apps will feel slow.

macOS uses memory aggressively as a cache by design. Empty RAM is wasted RAM. So a Mac with 16 GB of RAM “using” 14 GB isn’t necessarily strained — most of that might be cached file content the system can drop instantly when needed.

The columns that matter:

• Memory — actual private allocation
• Compressed Memory — pages compressed to fit more into RAM
• Real Memory — the more meaningful “this process is actually using” number

Bottom-of-tab stats:

• Physical Memory — total RAM
• Memory Used — currently allocated
• App Memory — used by apps
• Wired Memory — kernel and drivers, can’t be swapped
• Compressed — compressed by the kernel
• Swap Used — pages on disk because RAM was full

If “Swap Used” is consistently in the gigabytes and Memory Pressure is yellow or red, you have a memory problem. Either close apps, reboot, or get more RAM.

The Energy Tab

This is laptop-specific (or at least laptop-meaningful). Two key columns:

• Energy Impact — instant power draw
• 12 hr Power — average over the last 12 hours

Sort by Average Energy Impact. The processes near the top are what’s killing your battery — even when you’re not actively using them.

Some surprises you may find:

• Slack and Discord — chat apps that should be idle often hover at 1–3 energy impact, multiplying over many hours
• A misbehaving Spotlight — mds_stores stuck in a re-index can sit high for days
• Bluetooth daemon — when paired with a flaky device
• Photos — when iCloud Photos is doing background analysis (face recognition, scene detection)

The “Preventing Sleep” column tells you which processes are stopping your Mac from going to sleep automatically. If your laptop won’t sleep when you close the lid (yes, that’s a thing), this column has the answer.

The Disk Tab

Shows reads and writes per process. The columns that matter:

• Bytes Written — cumulative since launch
• Bytes Read
• PID

In day-to-day use, the Disk tab is usually quiet — most apps don’t do constant I/O. When it’s not quiet, the suspects are:

• Backup software — Time Machine, Carbon Copy Cloner, Backblaze
• Sync clients — Dropbox, Google Drive, OneDrive doing initial sync
• Spotlight — mds_stores reading or writing the index
• Compilers — Xcode, gcc, swift, when you’re building something

The total at the bottom of the tab — system-wide reads and writes per second — tells you whether disk is actually busy or not. On modern Apple Silicon SSDs, sustained writes of a few GB/s are routine; reads can hit 5+ GB/s. The disk is rarely the bottleneck unless something pathological is happening.

There’s a faster waySweep does this kind of cleanup automatically. Try Sweep free →

The Network Tab

Bytes per second going out and in, per process. Useful for:

• Catching unexpected uploads — if a process you don’t recognize is pushing data, that’s worth investigating
• Spotting bandwidth hogs — Time Machine over network, an Adobe download, a big iCloud sync
• Verifying VPN routing — if your VPN claims to be active but you see traffic going through the wrong process, something’s wrong

The bottom-of-tab stats show overall data sent and received. Right after a major macOS update, expect lots of network traffic for a few hours as Spotlight reindexes cloud-stored documents and APFS performs background tasks.

The Hidden Power Features

A few things buried in Activity Monitor’s UI that most people don’t know exist:

System Diagnostics

Window → System Diagnostics captures a comprehensive snapshot — Activity Monitor process list, recent panic logs, hardware info, kernel state — and saves it to /var/tmp/. Useful when you need to send everything-at-once to a developer or support engineer.

Spindump

Window → Spindump captures a system-wide spin (when something’s pegging the CPU). Good for “the whole Mac is slow” situations where you don’t know which process is causing it.

Sample Process

Select a process, then View → Sample Process (or Cmd+Option+S). Captures a few seconds of stack traces from the process. Useful for understanding what an app is doing at a moment of unresponsiveness.

Sending Signals

View → Send Signal to Processes lets you send Unix signals to processes. Includes:

• Quit (TERM) — politely ask
• Force Quit (KILL) — kill it
• Hangup (HUP) — used by some daemons to reload config
• Stop and Continue — pause and resume execution

For frozen apps that won’t respond to Force Quit, KILL is the nuclear option.

Inspecting Open Files and Ports

Double-click any process and you get the inspector window. The “Open Files and Ports” tab shows every file the process has open and every network port it’s bound to. Useful for:

• Confirming what files an app is reading/writing
• Seeing what TCP/UDP ports it’s listening on or connected to
• Spotting which library it’s loaded (drag the column to see paths)

This is essentially what lsof -p <pid> shows on the command line, but in a usable GUI.

The ‘inactive’ and ‘cached files’ Memory Confusion

If you check memory stats from the command line:

vm_stat

You’ll see categories like “Pages free,” “Pages active,” “Pages inactive,” “Pages speculative,” “Pages wired down,” “Pages purgeable,” and so on. Activity Monitor abstracts most of these into “App Memory” and “Cached Files” and the rest. But the underlying truth is more granular.

For most users, the right reading is: only Memory Pressure matters. If it’s green, you have enough memory regardless of the numbers. If it’s red, you don’t, regardless of which Apple has labeled the breakdown.

The Specific Workflow

A pragmatic workflow when something’s wrong:

1. Mac is hot/fans running — Open CPU tab, sort by % CPU. Look for sustained 100%+ from a single process.
2. Mac feels slow — Open Memory tab. Check Memory Pressure first. If green, look at CPU. If yellow/red, find the memory hog.
3. Battery draining fast — Energy tab, sort by Average Energy Impact.
4. Network feels slow — Network tab to see who’s hogging bandwidth.
5. Disk activity light constant — Disk tab to see what’s reading/writing.

Activity Monitor isn’t a fix-it tool. It’s a “see what’s wrong” tool. Once you know what’s wrong, the fix is usually obvious: kill the process, restart the misbehaving app, free up RAM, kill an unexpected uploader. The skill is reading the tabs accurately. After a few weeks of using it deliberately, you’ll diagnose problems in 30 seconds that previously felt like mysteries.