Monitor Mac OS X processes like a pro

Erik Eckel goes over the basics of using Mac's Activity Monitor and the command line to monitor processes on Mac OS X.

Macs aren't foolproof. Just as with other platforms, occasional issues arise. When it's necessary to troubleshoot performance by tracking active processes and determining whether a runaway or frozen application or process is overwhelming the system, a couple options exist: Activity Monitor and the command line. Here's how you can use both to monitor Mac OS X processes like a professional.

Activity Monitor

The Mac OS X Activity Monitor helps graphically identify applications or processes consuming abnormal memory and CPU levels. Activity Monitor is located within the Utilities folder within Applications. Once opened, the Activity Monitor lists the PID (process identification), Process Name, User, CPU percentage, number of threads, physical memory usage (Real Mem), and Kind (processor architecture type).

Users can sort entries by column. Typically it's best to sort by % CPU or Real Mem when trying to identify a runaway application or process. It's important, too, to be sure to select All Processes from the provided drop-down menu that displays My Processes by default.

For more information on a single process, users can double-click the process in question. Double-clicking a specific process opens a window that provides more information about that process, including real and virtual memory consumption (displayed within the Memory tab), threads and ports (displayed within the Statistics tab), and actual file and port data (displayed within the Open Files and Ports tab).

The same information can be accessed by selecting the process within Activity Monitor and clicking the Inspect icon. Alternatively, to terminate a process, users need only highlight the process name in question and click the Quit Process icon.

Additional system information, including CPU, System Memory, Disk Activity, Disk Usage and Network statistics, and corresponding performance graphs, is included at the bottom of the Activity Monitor window. In addition to CPU statistics, such as the number of active threads and processes, a pie chart provides a graphic representation of the system's RAM use; disk reads and writes are logged; and network packet counts are displayed and updated essentially in real time.

Command line

Old school administrators can view the active processes using the command line. Two commands prove particularly useful: top and ps.

The top command lists the processes consuming the most, or "top," resources. Typing top within a terminal console reveals much of the same statistical information found within the Activity Monitor window. Among the information the top command returns are processes (listed by descending PID), % CPU time, and physical memory consumption.

The top command basically hijacks the Terminal window, refreshing values on its own. To suspend its use, press the [Q] key, which  terminates the command.

When needing to review more specific process information, the ps (process status) command provides administrators with the ability to leverage the command line to view more precise process information. Similar to the Windows tasklist command, ps possesses a variety of option switches enabling almost surgical precision.

For example, typing ps -u followed by a username returns active processors for that specific user. Typing ps -p followed by the PID lists specific information just for that process. Adding the -r option sorts the results by current usage (such as by typing ps -u erik -r).

The top command also boasts a variety of options, including users (-user), process ID (-pid), and intervals (-i). More information on the two commands can be obtained by opening a Terminal window and typing man top or man ps, respectively.