Mac Running Slow? How to Find and Kill Resource-Hogging Processes

A slow Mac is almost always caused by one or more processes consuming too many resources — CPU cycles, RAM, or disk I/O. The fix sounds simple: find the offending process and kill it. But knowing which process to kill, and whether killing it is even the right move, is where most guides fall short. This article walks through every method available on macOS, from quick keyboard shortcuts to advanced diagnostic tools, so you can get your Mac back to full speed.

Quick Answer

• Fastest way to kill a frozen app: Press Cmd + Option + Esc to open Force Quit Applications, select the app, and click Force Quit.
• Find what’s using the most CPU/RAM: Open Activity Monitor (Applications → Utilities) and sort by CPU or Memory.
• Kill a process from Terminal: Run kill <PID> or kill -9 <PID> for an unresponsive process. Use killall <name> to kill by name.
• Deep diagnosis with real-time charts: Use ProcXray to monitor CPU, memory, and disk I/O simultaneously, see full process trees, and catch short-lived processes that Activity Monitor misses.

Why Is My Mac Running Slow?

macOS manages hundreds of processes at any given time — system daemons, background agents, and user applications all compete for three key resources:

1. CPU — When a process monopolizes CPU cores, everything else slows down. Common culprits include runaway browser tabs, build tools, and indexing services like mds_stores (Spotlight).
2. Memory (RAM) — macOS uses memory compression and swap to handle pressure, but once swap activity increases, disk I/O spikes and the entire system stutters. According to Apple’s Memory Usage Performance Guidelines, macOS begins compressing memory pages when physical RAM runs low, and only swaps to disk as a last resort — which is exactly when you feel the slowdown.
3. Disk I/O — Processes reading or writing large amounts of data (Time Machine backups, Xcode indexing, database engines) can saturate your storage bandwidth, causing apps to beach-ball even when CPU and RAM look fine.

The key to fixing a slow Mac is identifying which resource is the bottleneck and which process is responsible.

Method 1: Force Quit with a Keyboard Shortcut

The fastest way to kill a misbehaving app on macOS:

1. Press Cmd + Option + Esc (⌘ + ⌥ + Esc).
2. Select the unresponsive application from the list.
3. Click Force Quit.

Limitations

• Only shows user-facing applications — not background processes or daemons.
• No information about resource usage — you’re guessing which app is the problem.
• Cannot kill system processes or processes owned by root.

This method is best when a specific app is visibly frozen and you already know which one it is.

Method 2: Activity Monitor

Activity Monitor is Apple’s built-in process management tool. It shows all running processes with basic resource metrics.

How to Find and Kill a Process

1. Open Activity Monitor (press Cmd + Space, type “Activity Monitor”, press Enter).
2. Click the CPU tab and sort by % CPU descending to find the heaviest process.
3. Select the process and click the X button (Stop) in the toolbar.
4. Choose Quit first. If the process doesn’t stop, click Force Quit.

Check Memory Pressure

Switch to the Memory tab. The memory pressure graph at the bottom tells you the real story:

• Green — Plenty of free memory. Your slowdown is likely CPU or disk related.
• Yellow — Memory is under pressure. macOS is compressing pages. Performance may degrade.
• Red — Severe memory pressure. The system is swapping to disk. Kill or close large applications immediately.

Check Disk Activity

Switch to the Disk tab to see which processes are reading or writing the most data. Sort by Bytes Written to identify processes hammering your SSD.

Limitations

• No process tree view — you can’t see parent-child relationships, so you may kill a child process while the parent keeps spawning new ones.
• No short-lived process capture — processes that spawn, consume resources, and exit in under a second never appear.
• No real-time trend charts per process — you see a snapshot, not a trend.
• No environment variable or command-line argument inspection.

Method 3: Terminal Commands

The Terminal gives you precise, scriptable control over processes.

Find Resource-Heavy Processes

# Show top processes sorted by CPU usage (updates live)
top -o cpu

# One-shot snapshot of all processes with CPU and memory
ps aux --sort=-%cpu | head -20

Kill a Process by PID

# Graceful termination (SIGTERM) — lets the process clean up
kill 12345

# Force kill (SIGKILL) — immediate, no cleanup
kill -9 12345

Kill a Process by Name

# Kill all processes matching a name
killall Safari

# Force kill by name
killall -9 node

Find Processes Using Excessive Disk I/O

# Monitor disk I/O per process in real time (requires sudo)
sudo iotop

# Alternative: use fs_usage to trace file system calls
sudo fs_usage -f filesys | head -100

Limitations

• top and ps show snapshots — they don’t track trends over time.
• iotop requires sudo and can be hard to parse.
• No visual process tree — you need to chain pstree or ps -axjf and manually trace relationships.
• Short-lived processes are easily missed between refresh intervals.
• Killing the wrong PID can crash critical system services.

Method 4: ProcXray — Deep Process Diagnosis

When a slow Mac isn’t caused by an obvious runaway app, you need deeper visibility. ProcXray provides real-time monitoring of CPU, memory, and disk I/O in a single interface, along with tools that go well beyond what Activity Monitor and Terminal offer.

Real-Time Performance Charts

ProcXray’s toolbar shows CPU usage, memory pressure, and network I/O as live-updating indicators, and selecting a process reveals its History tab in the detail panel below with CPU and memory trend charts. Unlike Activity Monitor’s snapshot view, these charts show continuous trends — making it easy to spot a process whose memory usage climbs steadily (a likely memory leak) or one that spikes CPU periodically.

You can pin suspect processes and watch their individual resource trends over time, which is critical for diagnosing intermittent slowdowns that disappear the moment you open Activity Monitor.

Process Tree View

Toggle to tree view to see the full parent-child hierarchy. This matters because:

• A build tool like xcodebuild might spawn dozens of child processes (clang, ld, swift-frontend) that collectively saturate your CPU. Activity Monitor shows them as separate entries with no relationship.
• A runaway shell script might fork child processes endlessly. Killing the children is futile — you need to kill the parent.
• Browser processes (Chrome, Electron apps) spawn one process per tab. The tree view shows you exactly which tab or extension is the culprit.

Short-Lived Process Capture

ProcXray highlights newly spawned processes in green and recently exited processes in red, keeping them visible even after they terminate. This catches short-lived processes — compiler invocations, shell helpers, cron jobs — that consume significant resources but exit before Activity Monitor can display them.

Smart Process Management

Right-click any process for context actions:

• Terminate — Graceful quit (SIGTERM), equivalent to kill <PID>.
• Suspend — Freeze the process without killing it (SIGSTOP). Useful when you want to pause a resource hog temporarily and resume it later.
• Send HUP/QUIT signals — Reload configuration or trigger a core dump for debugging.
• Reveal in Finder — Jump to the executable to verify what the process actually is.
• Copy Command Line — See the exact arguments the process was launched with.

Diagnose Disk I/O Bottlenecks

Open the Connections tab for any process to see all open file descriptors — every file the process has open for reading or writing. If a process holds hundreds of open files, it’s likely the source of your disk I/O bottleneck. This is equivalent to running lsof -p <PID> but in a structured, filterable interface.

Environment Variable Inspection

Sometimes a Mac runs slow because of a misconfiguration — a background process running in debug mode, a build tool with verbose logging enabled, or an app loading an enormous plugin directory. ProcXray’s Environment tab shows every environment variable a process inherited, and you can export them as JSON with one click for further analysis.

How to Systematically Fix a Slow Mac

Rather than blindly killing processes, follow this diagnostic workflow:

Step 1: Identify the Bottleneck

Step 2: Find the Culprit

• If CPU: Look for processes using more than 100% CPU (on multi-core Macs, one process can use 200%, 400%, etc.). Common offenders: mds_stores, kernel_task, WindowServer, browser renderer processes.
• If Memory: Sort by memory footprint. Check if total memory usage exceeds your physical RAM. Look for apps with steadily growing memory (potential leak).
• If Disk I/O: Look for processes with high bytes written. Check open file descriptor count. Common offenders: backupd (Time Machine), mds (Spotlight), bird (iCloud sync).

Step 3: Decide — Kill, Suspend, or Investigate?

Comparison: Mac Process Killer Methods

FAQ

Why is my Mac slow but Activity Monitor shows low CPU usage?

The bottleneck may not be CPU. Check memory pressure (yellow or red means the system is swapping to disk) and disk I/O (a process saturating your SSD). Also, short-lived processes that spike CPU and exit quickly won’t appear in Activity Monitor’s refresh cycle. ProcXray captures these transient processes and shows them even after they exit.

Is it safe to force kill a process on Mac?

Force killing (kill -9 or Force Quit) sends SIGKILL, which terminates the process immediately without giving it a chance to save data or clean up. For user apps like browsers or editors, you may lose unsaved work. For system processes, force killing can cause instability. Always try a graceful quit first (SIGTERM via kill <PID> or the regular Quit command), and only force kill if the process is completely unresponsive.

How do I stop kernel_task from using high CPU?

kernel_task is macOS’s way of throttling CPU when the machine overheats. You cannot and should not kill it. Instead, address the root cause: disconnect peripherals that may be causing thermal issues, ensure vents are not blocked, reset SMC (Intel Macs), or check for a malfunctioning sensor. Apple’s support article HT207359 covers this in detail.

What is the difference between Quit, Force Quit, and Kill on macOS?

• Quit (Cmd + Q) — Sends a polite request. The app can prompt you to save files before closing.
• Force Quit (Cmd + Option + Esc) — Sends SIGTERM. The app should terminate, but can still refuse.
• Kill (kill -9) — Sends SIGKILL. The OS terminates the process immediately. The process cannot catch, block, or ignore this signal.

How do I find what process is using all my disk I/O?

In Activity Monitor, switch to the Disk tab and sort by Bytes Written. In Terminal, run sudo iotop for real-time per-process disk I/O monitoring. In ProcXray, select a process and open the Open Files tab in the detail panel below to inspect all open file descriptors, seeing exactly what files it’s reading or writing.

Can I kill a process and all its child processes at once?

In Terminal, you can use kill -- -<PGID> to kill an entire process group, but finding the PGID requires additional commands. ProcXray’s tree view shows the full hierarchy — right-click the parent to terminate it, which causes macOS to clean up orphaned children automatically for well-behaved processes.

Sources and References

• Apple — Memory Usage Performance Guidelines
• Apple Support — If kernel_task uses a large percentage of Mac CPU
• Apple Support — How to use Activity Monitor
• kill command reference
• macOS Process Monitoring Guide
• ProcXray vs Activity Monitor: Full Comparison

Download ProcXray → — free 14-day trial, macOS Sonoma+, Apple Silicon & Intel.