macOS troubleshooting: Activity Monitor to logs

“My Mac is slow every afternoon” is the call a Mac desk takes most, and it hides four different causes: one app using a whole processor core, memory that has run out, a disk with errors, or a fault in the hardware. Each leaves its own trace, in Activity Monitor, in the memory readings, in the unified log or in a disk check, and the order in which you read them decides whether the ticket takes ten minutes or a week.

You will find the busy process and quit it safely, read memory pressure the way Apple means it, turn a user’s “around two o’clock” into a log show command, run First Aid in the right order, and pick the report an escalation needs without sending a whole Mac’s worth of personal data to someone who asked for one line.

Activity Monitor names the process behind a busy Mac

Most of the time a Mac’s processor does little, and a slow Mac usually has one process doing too much. Activity Monitor’s CPU tab lists every process with its % CPU; sorting that column puts the culprit at the top. The figures under the list split the load three ways, in Apple’s words: User, used by apps the person opened and the processes they start; System, used by macOS itself; and Idle, what is left.

The other tabs answer the next questions. Energy shows each app’s Energy Impact, lower being better, and whether it is preventing sleep, which explains a laptop that drains overnight. Disk and Network show what reads, writes, sends and receives. Step through the order this lesson works a slow-Mac ticket:

Stopping a process has two strengths. Quit asks it to close when that is safe, the same as File, Quit in the app, and it does not quit when closing could lose data. Force QuitForce Quit: Stopping an app or process at once, from Activity Monitor or with Option-Command-Esc, instead of asking it to quit. It can lose the files the app has open, so Quit is tried first. stops it at once and can lose the files it has open; Option-Command-Esc opens the Force Quit window for apps. A process marked Not Responding, in red, is the case for Force Quit, after the user’s unsaved work has been dealt with. Quitting a process that belongs to another user may ask for an administrator.

In Terminal, top -o cpu shows the same list busiest first (by default top sorts by process ID), and ps takes a snapshot of processes; both have manual pages on the Mac. They list every user’s processes and the commands that started them, which is why their output belongs on the technician’s screen, not in a shared ticket.

Memory pressure, not free memory, says whether a Mac needs RAM

A user reads “Memory Used: 47 GB of 48 GB” and asks for an upgrade. Apple’s guide answers that free memory does not by itself improve performance: macOS gets its best performance by using all of its memory. The measure that counts is memory pressurememory pressure: Activity Monitor's measure of how well a Mac's memory meets its needs, worked out from free memory, swap rate, wired memory and file-cached memory, and shown green, yellow or red., which Apple says is worked out from the free memory, the swap rate, the wired memory and the file-cached memory. Its graph in Activity Monitor’s Memory tab has three colours: green, all RAM used efficiently; yellow, the Mac might eventually need more RAM; red, it needs more RAM.

Terminal reads the same counts. The session below took four readings on the lesson’s Mac; they change from second to second, so the page shows one moment:

from session import run

# How much memory this Mac has and how it is being used right now: memory_pressure's total and free share, the swap
# in use, and four of vm_stat's page counts. The readings change from second to second while the Mac works.
run(
    """
memory_pressure -Q
sysctl vm.swapusage
vm_stat | grep -E '^Pages (free|active|wired down|occupied by compressor):'
"""
)

$ memory_pressure -Q
The system has 51539607552 (3145728 pages with a page size of 16384).
System-wide memory free percentage: 42%
$ sysctl vm.swapusage
vm.swapusage: total = 13312.00M  used = 12633.12M  free = 678.88M  (encrypted)
$ vm_stat | grep -E '^Pages (free|active|wired down|occupied by compressor):'
Pages free:                                    34819.
Pages active:                                 647057.
Pages wired down:                             301297.
Pages occupied by compressor:                1455051.

memory_pressure -Q starts with the total: 51,539,607,552 bytes in 3,145,728 pages of 16,384 bytes, exactly 48 GiB. Its second line is the share of memory the system counts as free, vm.swapusage says how much of the startup disk holds swapped memory, and vm_stat counts pages: free, active, wired down and those the compressor occupies. Compressing inactive apps’ memory is how macOS makes room for active ones, Apple says, so a large compressor figure with little free memory is no fault on its own; only pressure that stays red, with the swap growing, makes the case for more RAM.

The unified log is read by time first, then by process

macOS writes the messages of the system and of apps into one unified logunified log: The single store of log messages that macOS and its apps write. Console shows it, and log show reads it in Terminal, narrowed by time and by keys such as process or subsystem.. Console shows it: pick the device, click Start, and each message has a type, marked by a dot, yellow for errors and red for faults. Apple notes that a user who is not an administrator must enter an administrator’s name and password to see the messages. Searching works on text, and the search field’s filters can keep one process or leave one out.

The same messages come out in Terminal with log show, and man log on the Mac lists what narrows them. Time comes first, because a Mac writes thousands of messages a minute:

A log predicatelog predicate: A filter for log show or log stream that compares keys of each message, such as process, subsystem or messageType, with values, as in process == "Mail". compares those keys with values, as process == "Mail"; messageType takes default, info, debug, error or fault. The program below turns three tickets into commands. The predicate goes inside single quotes so the shell hands it to log in one piece, and names with spaces go inside double quotes:

"""Three tickets turned into log show commands. Each ticket gives the window to read, in the date and time form
man log accepts ("YYYY-MM-DD HH:MM:SS" followed by the UTC offset, such as +05:30), and a process or a subsystem to keep. The predicate is
built from the keys man log documents, and the whole predicate is wrapped in single quotes so the shell passes it to
log in one piece, with names that contain spaces inside double quotes."""

TICKETS = [
    ("Photo Booth closes when the camera starts", "2026-09-14 14:00:00+05:30", "2026-09-14 14:20:00+05:30",
     {"process": "Photo Booth"}),
    ("Mail stopped fetching after lunch", "2026-09-14 13:30:00+05:30", "2026-09-14 14:00:00+05:30",
     {"process": "Mail"}),
    ("An app's own messages, by subsystem", "2026-09-14 09:00:00+05:30", "2026-09-14 09:15:00+05:30",
     {"subsystem": "com.example.notes"}),
]


def predicate(keep):
    """One clause per key, joined with &&, each value in double quotes (a double quote inside is escaped)."""
    clauses = []
    for key in ("process", "subsystem"):
        if key in keep:
            value = keep[key].replace("\\", "\\\\").replace('"', '\\"')
            clauses.append(f'{key} == "{value}"')
    return " && ".join(clauses)


for title, start, end, keep in TICKETS:
    print(f"# {title}")
    print(f"log show --style compact --start '{start}' --end '{end}' --predicate '{predicate(keep)}'")

# Photo Booth closes when the camera starts
log show --style compact --start '2026-09-14 14:00:00+05:30' --end '2026-09-14 14:20:00+05:30' --predicate 'process == "Photo Booth"'
# Mail stopped fetching after lunch
log show --style compact --start '2026-09-14 13:30:00+05:30' --end '2026-09-14 14:00:00+05:30' --predicate 'process == "Mail"'
# An app's own messages, by subsystem
log show --style compact --start '2026-09-14 09:00:00+05:30' --end '2026-09-14 09:15:00+05:30' --predicate 'subsystem == "com.example.notes"'

Each command reads only the minutes the user described, with the UTC offset the ticket gives, so the window is the same whatever time zone the Mac is set to. The offset follows the ZZZZZ form of Unicode’s date patterns, such as +05:30. A user’s “around two” in India becomes --start '2026-09-14 14:00:00+05:30', and the timezone converter checks the same moment for a user in another city.

First Aid and Apple Diagnostics rule out the disk and the hardware

When the log shows file errors, or apps quit at random, the disk is next. Apple’s Disk Utility guide says First Aid can fix certain problems, such as apps that quit unexpectedly, a corrupted file or a Mac that will not start up, though not all. The order is exact: First AidFirst Aid: The Disk Utility function on a Mac that checks a volume, a container or a whole storage device for errors and repairs what it can. Apple's order is each volume, then the container, then the device. on each volume of the device in turn, then on each container, then on the storage device itself. The startup disk is checked from macOS Recovery, and the order of those steps is in boot problems and recovery.

Before any of that, read what the drive says about itself:

from session import run

# The internal storage device and the volume the Mac runs from, read without changing anything. SMART Status is the
# drive's own health verdict, which Disk Utility also shows.
run(
    """
diskutil info disk0 | grep -E "Device / Media Name|Protocol|Solid State|SMART Status"
diskutil info / | grep -E "Volume Name|File System Personality|Volume Read-Only"
"""
)

$ diskutil info disk0 | grep -E "Device / Media Name|Protocol|Solid State|SMART Status"
   Device / Media Name:       APPLE SSD AP1024Z
   Protocol:                  Apple Fabric
   SMART Status:              Verified
   Solid State:               Yes
$ diskutil info / | grep -E "Volume Name|File System Personality|Volume Read-Only"
   Volume Name:               Macintosh HD
   File System Personality:   APFS
   Volume Read-Only:          Yes (read-only mount flag set)

The internal device is an APPLE SSD AP1024Z over Apple Fabric, solid state, with SMART Status Verified, and the startup volume is the read-only APFS volume Macintosh HD. When Disk Utility reports instead that a disk is about to fail, Apple’s advice is short: back up the data and replace the disk, because it cannot be repaired.

When nothing points at the disk but the Mac still misbehaves, Apple DiagnosticsApple Diagnostics: Apple's built-in hardware test for a Mac, started from the startup options with Command-D on Apple silicon or by holding D on an Intel Mac, to find which component may be at fault. helps find which hardware component is at fault. On Apple silicon, hold the power button until the startup options appear, then hold Command-D; on an Intel Mac, hold D as it starts. The preparation and what to do with its results are in hardware faults. Safe mode, which separates a fault in the system from one in what was added to it, is in the boot lesson too.

An escalation carries the report it needs, and no more

A ticket that goes to the next tier, to Apple or to a vendor needs evidence, and every report trades detail against personal data. System Information, and system_profiler in Terminal, export a Mac’s hardware and software. Its manual lists a detail level, mini, described as a report with no personal information. The session shows the difference without printing anything personal: first the names of the fields the full software report fills in, then the report at mini:

from session import run

# What a System Information software report would carry. The first line prints only the names of the fields the full
# report fills in; the second prints the report at the detail level system_profiler's manual calls "mini", which it
# describes as a report with no personal information.
run(
    """
system_profiler SPSoftwareDataType | cut -d: -f1 | sed "s/^ *//" | grep -v "^$"
system_profiler -detailLevel mini SPSoftwareDataType | grep -v "Time since boot"
"""
)

$ system_profiler SPSoftwareDataType | cut -d: -f1 | sed "s/^ *//" | grep -v "^$"
Software
System Software Overview
System Version
Kernel Version
Boot Volume
Boot Mode
Computer Name
User Name
Secure Virtual Memory
System Integrity Protection
Time since boot
$ system_profiler -detailLevel mini SPSoftwareDataType | grep -v "Time since boot"
Software:

    System Software Overview:

      System Version: macOS 26.7.1 (25G241)
      Kernel Version: Darwin 25.6.0

The full report has a Computer Name and a User Name among the eleven names it prints; the mini report keeps the macOS and kernel versions, and the time since the last start, left out here because it changes. The largest report is a sysdiagnosesysdiagnose: A macOS tool, run as root, that gathers a large archive of a Mac's state, logs, crash reports and configuration for Apple or a vendor to investigate a problem. archive, which man sysdiagnose says gathers a great deal of the system’s state: a spindump, several seconds of top, recent system logs, a System Profiler report, recent crash reports, disk usage and network status. It runs as root and saves the archive in /var/tmp. Activity Monitor offers a smaller tool, Sample Process, a report on one process over 3 seconds.

Two questions about the escalation decide what to send:

In short: a colleague gets the mini report and a log excerpt for the minutes that matter; a 3-second sample serves an app that is stuck now; a sysdiagnose goes only to Apple or a vendor who asked for it, with the user’s consent, through the channel the organisation allows.

Practise: a log window for any time zone

A user’s “around 14:05” has to become two exact times before log show can use it. Write the function that turns a reported time and its UTC offset into the --start and --end values, for any number of minutes either side and across midnight, and that refuses a negative window or a time in the wrong form. The self-check after it covers every section.

def log_window(reported, offset, minutes_before=10, minutes_after=5):
    """Return the --start and --end strings for log show around a reported time, such as ("... 13:55:00+05:30", ...)."""
    return ("", "")

from log_window import log_window


def raises_value_error(*args):
    try:
        log_window(*args)
    except ValueError:
        return True
    return False


def test_the_default_window():
    assert log_window("2026-09-14 14:05", "+05:30") == ("2026-09-14 13:55:00+05:30", "2026-09-14 14:10:00+05:30")


def test_a_wider_window():
    assert log_window("2026-09-14 14:05", "+05:30", 30, 15) == ("2026-09-14 13:35:00+05:30", "2026-09-14 14:20:00+05:30")


def test_a_negative_offset():
    assert log_window("2026-03-02 08:00", "-05:00", 5, 5) == ("2026-03-02 07:55:00-05:00", "2026-03-02 08:05:00-05:00")


def test_crossing_midnight():
    assert log_window("2026-09-14 23:58", "+00:00") == ("2026-09-14 23:48:00+00:00", "2026-09-15 00:03:00+00:00")
    assert log_window("2026-09-15 00:04", "+00:00") == ("2026-09-14 23:54:00+00:00", "2026-09-15 00:09:00+00:00")


def test_a_zero_window():
    assert log_window("2026-09-14 14:05", "+05:30", 0, 0) == ("2026-09-14 14:05:00+05:30", "2026-09-14 14:05:00+05:30")


def test_negative_minutes_are_refused():
    assert raises_value_error("2026-09-14 14:05", "+05:30", -1, 5)
    assert raises_value_error("2026-09-14 14:05", "+05:30", 5, -1)


def test_bad_forms_are_refused():
    assert raises_value_error("14:05 on 14 September", "+05:30")
    assert raises_value_error("2026-09-14 14:05", "IST")
    assert raises_value_error("2026-09-14 14:05", "+0530")

Interview questions

Warm-up (fresher): why does a Mac with almost no unused memory not prove that it needs more RAM?

Because macOS uses spare memory on purpose. Apple’s Activity Monitor guide says unused memory does not by itself make a Mac faster, and that macOS performs best by using and managing all of its memory, for instance by keeping recently used files cached and by compressing memory that inactive apps hold. The measure that matters is memory pressure, which Apple works out from the unused memory, the swap rate, the wired memory and the file cache, and shows as a graph: green when the RAM is used efficiently, yellow when the Mac might eventually need more, red when it needs more RAM. So I would watch the pressure graph while the user does their normal work, check whether swap keeps growing, and only ask for an upgrade when the pressure stays red.

Two harder calls follow: a Mac that is slow every afternoon and fine in the morning, and a vendor who asks for a sysdiagnose from a finance user’s Mac. Note the single reading you would take first on each, then see whether its page opens the same way:

Key takeaways

• Activity Monitor’s CPU tab, sorted by % CPU, names the busy process; Quit comes before Force Quit, because Force Quit can lose open files.
• Memory pressure, green, yellow or red, says whether a Mac needs RAM; low free memory on its own does not.
• The unified log is narrowed by time first, with --start and --end or --last, then by a predicate on the process or subsystem.
• First Aid runs on each volume, then each container, then the device; a disk Disk Utility says is about to fail is backed up and replaced, and Apple Diagnostics tests the rest of the hardware.
• An escalation carries the smallest report that answers its question, and a sysdiagnose, which gathers a great deal of the Mac’s state, goes only to someone who asked for it.