Every macOS developer eventually runs into the same frustration: Activity Monitor shows you a process is eating CPU, but gives you almost no actionable data to find out why. This guide covers everything you need to know about monitoring processes on macOS — from the basics to the advanced techniques that actually help you debug.
What Is a Process?
On macOS, every running program is a process with a unique Process ID (PID). When you open your browser, macOS spawns a parent process, which may spawn dozens of child processes — renderer processes, GPU processes, extension processes, and more. Understanding this hierarchy is the first step to effective monitoring.
The Basics: Activity Monitor
Apple’s built-in Activity Monitor (/Applications/Utilities/Activity Monitor.app) gives you:
- Real-time CPU and memory usage per process
- Basic network and disk I/O stats
- The ability to force-quit a misbehaving app
It’s fine for casual use. For developers, it falls short almost immediately.
What Activity Monitor Can’t Do
Here’s what you’ll hit quickly as a developer:
No process tree view. Activity Monitor shows a flat list. When a shell script spawns five helper processes that spawn more children, you see chaos. You can’t tell what spawned what.
No environment variables. When debugging why NODE_ENV or DYLD_LIBRARY_PATH is wrong inside a process, you have no way to inspect the actual environment the process was launched with.
No real-time regex search. Filtering 300 processes by name requires careful typing and resets frequently.
Short-lived processes are invisible. A build system spinning up and tearing down compiler processes in milliseconds? Activity Monitor never catches them.
Using the Command Line
ps, top, lsof, and dtrace fill some gaps:
# Show process tree
ps auxf
# List all open files for a process
lsof -p <PID>
# Show environment variables for a process
ps eww -p <PID>These are powerful but awkward. ps eww dumps the environment as an unreadable wall of text. lsof output can be thousands of lines.
A Better Approach: ProcXray
ProcXray is a native macOS app built specifically for developers who need more than Activity Monitor provides. It surfaces the data you actually need:
Process Tree View
Toggle between a flat list and a live process tree. See parent-child relationships instantly — crucial when debugging shell scripts, build tools, or multi-process apps like Chrome or Electron.
Environment Variables Inspector
Click any process and switch to the Environment tab. Every environment variable the process was launched with is listed, searchable, and copyable as JSON. No more ps eww parsing.
Real-time Regex Search
Type a regex pattern and the list filters instantly across process names, PIDs, command-line arguments, and paths. Find node.*server or python3.*manage in milliseconds.
Short-lived Process Capture
ProcXray highlights newly spawned processes in green and retains exited processes in red for a configurable window. You’ll finally see those transient compiler and linker processes that vanish before Activity Monitor refreshes.
Code Signature Verification
For security audits, ProcXray shows whether each process is signed, by whom, and what entitlements it holds — all without touching the terminal.
When to Use What
| Scenario | Tool |
|---|---|
| Quick CPU/memory check | Activity Monitor |
| Debug a runaway process | ProcXray |
| Inspect process environment | ProcXray |
| Find what spawned a process | ProcXray |
| Security audit for unsigned processes | ProcXray |
| Scripted/automated monitoring | ps, top, dtrace |
Getting Started
Download ProcXray — it’s free, code-signed, and Apple-notarized. Requires macOS 14 (Sonoma) or later on Apple Silicon or Intel.
Once installed, it replaces your daily Activity Monitor habit with something that actually helps you move faster.