Activity Monitor

Type top and a space, or pick Activity Monitor in the palette. The first row is a summary: memory in use, memory installed, core count. Below it every process, busiest first. The list resamples every couple of seconds, and rows hold their place while the numbers move, so nothing jumps out from under the pointer.

Apps, not processes

With nothing typed, each row is an app with its helper processes folded in: Chrome and its forty renderers show as one line reading “41 processes · 38% CPU · 3.2 GB”, with the app’s icon, which is the number that actually explains the fan. Return quits the app, and ⌘K offers its full process list. Type a name and the list drops back to individual processes, so helper still finds the one renderer that has gone wrong.

The detail pane

Selecting a row opens a pane on the right. It refreshes about once a second and shows:

A CPU trace built from the last forty samples, so a spike is visible as a shape rather than a number that has already changed. Memory in megabytes, plus what share of installed memory that is. Then the facts you would otherwise go to Terminal for: process state, owning user, thread count, scheduling priority, virtual memory, start time, how long it has been running, parent process id, and the full command with its arguments.

If the process is listening on a port, the pane lists it. Open file count appears for processes you own. For anything running as root the number is hidden rather than reported as zero, because an unprivileged lsof cannot see inside them.

Arrow through the list and the pane follows. If the process you were watching exits, the pane says so instead of freezing on stale figures.

Quitting something

Return sends the process a polite terminate signal. ⌘⏎ sends it a kill, which is the one to reach for when an app has stopped answering.

Cleat never appears in its own list, which saves an obvious mistake.

Where the numbers come from

The process list is ps, which is on every Mac and needs no permission. Memory pressure comes from host_statistics64, the same source Activity Monitor reads. Open files and ports come from lsof, which runs off the main thread because it is slow enough to notice.

Percentages are what ps reports, which is CPU time against a single core. On a machine with ten cores a busy process can read above 100%.

When to use the real Activity Monitor

For energy impact, disk and network columns, or sampling a hung process. Cleat answers “what is making the fan spin” and then tells you enough about the culprit to decide what to do, without replacing the whole application.