Activity Monitor on Mac: how to read every number

Activity Monitor is the system monitor that comes with every Mac. You'll find it in Applications > Utilities, and the quickest way there is Command-Space, type "activity", press Return. It costs nothing, Apple wrote it, and it's a good tool. The difficulty starts after you open it, because the window fills with numbers that never say whether anything is wrong, which is why a lot of people look once and close it again.

Here's how to read it.

The five tabs, one line each

Along the top: CPU, Memory, Energy, Disk, Network. (A sixth tab, Cache, shows up only if you've switched on Content Caching in System Settings. Most people never see it.)

• CPU is who's using the processor right now.
• Memory is whether you have enough RAM.
• Energy is what's costing you battery.
• Disk is how much reading and writing is going on.
• Network is how much data is moving.

GPU isn't a tab, which trips people up. It's a separate window, under Window > GPU History.

On every tab, the big list is processes, and clicking a column heading sorts by it. That single move is most of the skill. Pick a tab, sort by the column that matters, read the top three names. By default the numbers refresh every five seconds; you can speed that up under View > Update Frequency, though Apple notes that doing so costs a little performance itself.

The CPU tab, and the number that goes past 100

Sort by % CPU and the busiest process rises to the top. Then comes the reading that confuses almost everyone: the column says 340%, or 780%.

That's not a bug. Apple defines % CPU as the percentage of CPU capability being used, and it's counted per core. Each core can contribute up to 100, so on an eight-core Mac the scale runs to 800. A process at 400% is using about half your processor. A process stuck at 99% may be pinning one core with no way to spread the work, which can feel worse. Howard Oakley, who writes about macOS internals, explains the arithmetic in detail: the figure is the summed active residency of every core.

Two things the number leaves out. It takes no account of how fast the cores are running, and on Apple silicon it doesn't separate the efficiency cores from the performance ones. Those cores differ enormously in throughput, so identical percentages can represent very different amounts of work. Treat % CPU as a measure of how busy something is, not how much it's getting done.

At the bottom of the window sit three figures: System (macOS itself), User (the apps you opened), and Idle (what's spare).

Three names come up again and again at the top of this list, and two of them are innocent.

kernel_task is macOS itself, and a big number here is usually thermal management rather than trouble. Apple's own note says kernel_task helps manage CPU temperature by making the processor less available to whatever is running it hot, and that it "does not itself cause those conditions." The high reading is the response, not the cause. What kernel_task is really doing covers the mechanism, including the charging quirk on older Intel MacBook Pros.

WindowServer draws everything you see on screen, and it grows with the number of windows and external displays you have open. Why WindowServer runs high explains when that's normal.

A browser, usually, splitting itself into one process per tab and per extension, which is why it appears fifteen times. Chrome's memory habit is the same story on the Memory tab.

If none of those is your culprit, the wider list of reasons a Mac slows down is the next place to look.

The Memory tab: read the graph, not the number

Memory Used is the figure people read, and it's the wrong one. The answer is the Memory Pressure graph running along the bottom.

Apple's guidance is unusually direct here. Green means your Mac is using all its RAM efficiently. Yellow means it might eventually need more. Red means it needs more. Activity Monitor's own tooltip calls it an indicator of "the system's ability to meet the memory requirements of the user's activities."

The reading that causes the most needless worry is Cached Files, described by Apple as the size of files the system has cached into unused memory to improve performance. macOS deliberately fills spare RAM with recently used file data so that opening the same things again skips the disk, and it gives that memory straight back the moment something else wants it. It counts as used and is effectively available. A large Cached Files figure is a sign of a healthy Mac. Apple states plainly that having free or unused memory does not necessarily improve performance.

The rest, briefly. Swap Used is how much has been pushed out to the SSD, and near zero is what you want; a large and growing figure next to red pressure is the honest out-of-RAM picture. Compressed is memory squeezed down to avoid that. Wired is memory macOS can neither compress nor move.

Memory pressure explained in full goes deeper on the colors, and if you're on a base-spec machine, whether 8 GB is enough puts the readings in context. One thing to skip either way: apps that promise to free up RAM. They evict the cache macOS put there on purpose.

Energy, Disk and Network in one pass

Energy ranks apps by Energy Impact, which Apple describes as a relative measure of current consumption where lower is better. On a laptop you also get a 12 hr Power column (the average over the last twelve hours or since startup), a battery graph covering the same period, and columns showing whether an app is in App Nap or preventing sleep. This is the one corner of Activity Monitor that looks backwards at all. What's draining your battery works through it.

Disk counts reads and writes and the bytes moved. It's most useful for catching one process hammering the drive: a backup, a sync client, Spotlight rebuilding its index.

Network shows bytes sent and received per process, with totals at the bottom and a graph you can switch between packets and data. It tells you how much is moving, not where it's going, which is a different question.

Quitting something, and when to leave it alone

Select a process, click the stop button in the toolbar, and you get two choices. Quit behaves exactly like choosing File > Quit inside the app, and macOS will refuse if quitting would lose data or break something else. Force Quit ends the process immediately, and any open files may lose whatever wasn't saved. Anything already stuck shows in red and marked "(Not Responding)".

For anyone who isn't a developer, the rule is short. Quit apps you recognize. Leave alone anything you don't, and leave kernel_task alone in particular, since it's the part of macOS keeping your processor cool. If macOS asks for an administrator password before it will quit something, that's a system process, and restarting is almost always the better move.

What it's good at, and what it isn't

Activity Monitor answers "what is happening right now" very well. It's free, it's already installed, it reads the system directly, and nothing third-party beats it for accuracy at the instant you look.

Two questions it can't answer, both structural rather than sloppy.

It doesn't remember. Apart from the Energy tab's twelve-hour figures, the panes are live and nothing is written down. So the classic sequence defeats it: your Mac crawls at nine in the morning, you open Activity Monitor at eleven, and everything is calm. The window is honest and useless at the same time, because the process responsible finished an hour ago.

It also has no idea what's normal for your Mac. Forty percent CPU is unremarkable on an M3 Pro mid-export and close to an emergency on a 2017 Air checking email. Green pressure with three apps open means something different from green pressure with twenty. Activity Monitor hands you raw numbers with no baseline, so reading it well requires you to already know roughly what the answer should be. Fine for people who've stared at these panes for years. Not much help for everyone else.

Neither gap is a reason to avoid it. Use it. It's the right first stop, and for plenty of problems it's the only stop you need. The intermittent problems are harder, because catching one means already watching before you notice.

Where a second tool helps

Plumby doesn't replace Activity Monitor and isn't trying to. It covers the parts that make Activity Monitor hard to read. Background processes carry a plain-language label, so WindowServer arrives described as the thing that draws your screen rather than as a name you have to go and look up. A live CPU and free-memory readout can sit in the menu bar, so you catch the crunch while it's happening. Memory pressure comes from the kernel rather than a guess, CPU temperature is on screen at all (Activity Monitor never shows it), per-app network totals are kept across days, and a process can be quit or paused without leaving the window. It notices, too, when something is burning a lot more CPU than it was fifteen minutes ago. It reads and reports. It never purges caches out from under macOS, and it never touches your documents, photos, or projects.