Just What Is Activity Monitor?

As a multitasking, multi-user operating system, Mac OS X usually has a dizzying array of tasks going on simultaneously. As I write this article, I have Safari, two word processing programs, MPEG Streamclip, and Mail running simultaneously. Meanwhile, my wife’s account is running another program. That’s just the tasks that I know about. What about all the underlying tasks that the operating system starts without my knowledge? How do I keep tabs on all of that activity?

Open the Applications folder of your boot drive. Tucked inside the Utilities folder is a program called Activity Monitor. It gives Unix-challenged Mac users such as myself a more comfortable means of investigating the inner workings of our systems. Versions of OS X prior to 10.3 included a program called Process Monitor that allowed users to examine the processes running on the Mac; Activity Monitor yields much more information. Disk input and output, network throughput, CPU utilization, memory usage, and processes can all be examined in Activity Monitor.

Overview of Activity Monitor

The first few times I opened Activity Monitor I was more than a little intimidated. If that has happened to you, put your fears aside and let’s do a little exploration. Locate Activity Monitor in the Utilities folder and launch the program. If you don’t see the main window choose Activity Monitor from the Window menu.

When the window appears, the columns listed may be vary slightly depending upon whether you have done any prior exploration, but the window will look something like this:

The Main Activity Monitor Window

The large red button in the toolbar allows you to quit active processes. Click on the name of a process once to select it and push this button. The resulting sheet will give you the option to Force Quit, Cancel, or Quit. Read this sheet carefully before you answer. The messages are not always the same. For many processes you will get a generic message asking whether you want to quit, but some processes provide a bit more information. Attempt to quit the “loginwindow” process, for example, and the resulting quit sheet will inform you that this will log you out of the system. We’ll discuss some uses for this button in a moment. For now, don’t quit anything.

The large blue Inspector button is unavailable until you select a process. Once a process is selected, clicking the Inspector brings up another window with additional information about that specific process. You can examine memory usage, additional statistics, and open files and ports. You can even sample what’s happening with that process. File most of the results under the heading of “information only a programmer could love.” There may be some instances, though, where a support technician may request this information.

The Filter field allows searching for specific processes, while the pop-up menu offers several options for how you want the processes organized in the Activity Monitor window. My favorite views are “All Processes Hierarchically” and “My Processes.” The former shows processes spawned by other processes, while the latter shows processes associated with the current user account.

It’s All in the Process

The heart of the Activity Monitor window is the list of processes and various tidbits of information about each process. Your view of the Activity Monitor window may not have every column of available information active. With the main window open, take a quick trip to the View menu and choose Columns. Any columns that are checked will appear in the main window. The following columns are available: Process ID, Private Memory, User, Shared Memory, %CPU, Virtual Memory, CPU Time, Messages Sent, # Threads, Messages Received, # Ports, Kind, Real Memory.

Let’s just take a quick glance at some of the more useful pieces of information.

The Process ID is a number assigned to each process on the machine. Even activities that are not usually visible in the Dock or Force Quit dialog are processes and thus have a process number assigned to them. Sorting the list by ID number can give you an idea of which processes were last launched on your Mac, even if it was not launched from your account. For example, while preparing this article I launched a word processor that the system assigned a three-digit ID number. Sometime later I launched a second instance of the same program while logged in as a different user. That instance of the program was assigned a four-digit ID number. Knowing the last process launched can help pinpoint sudden system slowdowns. Note, however, that after it assigns the maximum process ID, OS X will wrap around and start re-using the low-numbered IDs.

The User column makes it possible to identify which processes were started by which user account. If multiple users are logged into the system and Activity Monitor is set to show all processes, processes are shown in the main window no matter which account initiated that particular process. Several important system tasks, such as the kernel task, are assigned to the root user and cannot be killed unless you are logged in as the root user.

The %CPU column shows how much of the CPU’s resources are devoted to a particular task. The percentages will vary quite a bit with many processes staying at or near zero until some activity puts that process to use. Although some processes can report high percentages, most will stay below 20% unless they are part of some processor-intensive task. If an application is open but not actively performing a task its percentage may well be very low.

If I activate the Kind column, the software I use regularly appears in the list as PowerPC. None of my software would show up in this list as Intel, since my system pre-dates those machines, but that could be useful information for some users.

If that wasn’t enough information for you, the tabs at the bottom of the Activity Monitor window provide a graphic representation of system performance. CPU usage, system memory, disk activity, disk usage, and network activity are all graphically represented. Simply click on a tab to see the relevant graph.

What Can I Do With All That Information?

We’ll discuss using Activity Monitor to track down some performance issues next month, but in the meantime here’s how to turn Activity Monitor into the ultimate force quit dialog.

Macs usually perform very reliably, but if you experiment with them enough from time to time you will experience a situation where one or more applications stop responding. Even after you have waited for what seems like an eternity the offending program refuses to respond. I had this happen recently when an application was unable to read some corrupted data. I didn’t want to power down the entire system because I had other applications open with unsaved work. What to do?

Most long-time Mac users know that under these circumstances simultaneously pressing Command, Option, and Escape brings up a Force Quit dialog that allows you to click on the offending program and force it to quit. Alternately you can Option-click a program’s icon in the Dock and choose Force Quit. That technique works much better now than it ever did under OS 9, but what if the all the programs in that box appear to be functioning as expected? That probably means that the problem is due to a background process whose name does not appear in the usual dialogs. Enter Activity Monitor and the superhero version of the force quit. Here’s how it works:

1. Launch Activity Monitor and bring up the main window.
2. As you look through the list of processes, those that are stuck usually appear in red. If you cannot find the offending process, change the list to show all processes. Once you have identified the problem, click on that process.
3. Now choose the Quit Process button at the top of the window. In the sheet that appears, choose Quit or Force Quit. You will know when that process quits since it disappears from the list.

I have started calling this procedure the Super Quit. It has two advantages over the usual method for force quitting applications. First, this procedure allows you to quit background processes that do not appear in the Force Quit dialog. Ever have to quit the Dock? Dread those Unix commands? This is one solution. Second, if multiple users are logged into a Mac, it allows you to quit a process initiated by another user. Here’s how that procedure works:

1. Launch Activity Monitor and choose Other User Processes from the pop-up menu.
2. Locate the process that you would like to terminate. If more than one user has the same process running, make sure that you look at both the process name and the user name to identify the process.
3. Single click the process as before and choose Quit Process. This time, since you are quitting a process started by someone else, you will be asked for an administrator password. Simply enter your password when prompted.

Before you use either of these procedures, here are a few things to keep in mind. It will make your life easier and perhaps prevent the loss of important data.

1. Before initiating a standard Force Quit or either of the above procedures, wait for a bit to see if the offending process will resolve itself. All of the force-quit methods will result in loss of unsaved work. Sometimes a program that appears “frozen” is simply being forced to work more slowly due to limited resources.
2. Be careful when quitting processes started by other users. I suggest this as a last resort since it will cause the loss of any unsaved work affected by that process. If the user has not saved the 500th page of a next great novel, you’re not going to make friends by needlessly quitting the word processor.
3. While many processes have names that you will recognize, there are other processes with names that give little or no clue to their function. Did you know, for example, that when Classic is launched it appears in Activity Monitor’s list as TrueBlueEnvironment? Neither did I until recently. Be very careful and use these procedures only when necessary. Here is a partial list of some of the more important processes to get you started.

This should get you through the basics of Activity Monitor for the time being. Next month we’ll use this information to identify some system performance issues. Does your favorite application have a memory leak? Is it making use of both processors when needed? Do you really need additional memory? We’ll find out together next month.

Copyright © 2006 Sylvester Roque, sroque@atpm.com.