Something is using too much CPU on my Mac — how to find it

Your Mac is warm, the fans are up, and you’d like to know which process is responsible. Activity Monitor’s CPU tab will tell you, but you need to know how to read it — and what to do when the culprit is a system process you can’t just quit.

The standard approach

1. Open Activity Monitor (Applications - Utilities, or cmd+space and type "Activity Monitor").
2. Click the CPU tab.
3. Click the %CPU column header to sort descending — biggest hogs at the top.
4. Watch for a minute. Spikes are normal; sustained usage is the signal. The number can exceed 100% — that's per-core, so 400% means a process is fully using four cores.
5. Note the process name and PID for any process sitting above 50% sustained.

The Terminal way

Sometimes you want this without GUI overhead. Run:

top -o cpu -stats pid,command,cpu,mem

Press q to quit. For a one-shot snapshot:

ps -arcwwwxo pid,command,%cpu,%mem | head -20

This sorts by CPU and shows the top 20.

Reading process names

Most of the offenders fall into recognisable patterns:

• WindowServer high — usually means a display driver issue, an external monitor problem, or a graphics-heavy app. Restarting that app usually fixes it.
• mds, mds_stores, mdworker — Spotlight indexing. Wait it out; it stops when done.
• kernel_task high — usually a thermal protection mechanism. The kernel intentionally burns cycles to slow the system and let it cool.
• photoanalysisd — Photos analysing your library. Pauses on battery; resumes on power.
• backupd — Time Machine. Pause it from the menubar if you need the CPU.
• cloudd, bird — iCloud sync. Catches up after big changes.
• A browser helper named after a tab — kill that tab.

When the culprit disappears

A common frustration: you open Activity Monitor and the process you saw is gone. macOS process scheduling can hide short-lived spikes, and looking sometimes changes what’s running. A persistent monitor catches these.

The top command keeps running, so leaving a Terminal tab open with top -o cpu works. So does a menubar app. Beacon shows the top CPU consumers and total load in the menubar without you opening anything — $14.99 lifetime. Download Beacon if you find yourself running Activity Monitor more than twice a day.

What to do once you find it

If it’s a user app, quit and relaunch. If it’s a tab, close it. If it’s a system daemon doing legitimate work (Spotlight, photo analysis, backup), let it finish — killing it just means it restarts. If a daemon is stuck in a respawn loop and burning CPU forever, that’s worth a restart or a bug report.

Catching it before it hurts

The fastest fix is the one you make before noticing. A menubar that shows total CPU at a glance lets you spot a runaway process the moment it starts — usually before the fans ramp up.