Mac OS X What Are All Those Processes?

What Are All Those Apple OS X Processes

*AppleFileServer* (AFP over IP) personal file sharing uses AFP, it should only be running if file sharing is enabled (via the System Preference Sharing pane)
autodiskmount – responsible for mounting removable disks and media
automount – automatically mounts and dismounts (NFS and AFP) file systems as they are accessed / left idle
configd - maintains dynamic configuration information about the computer and its environment (mainly the network)
CrashReporter – logs information about program crashes, it can be configured (via editing /etc/hostconfig in OS X 10.1+) and the Console utilities preferences on OS X 10.1+) to log crashes in ~/Library/Logs or not.
cron – crontab executes scheduled programs and tasks, mostly to perform routine maintenance scripts periodically on the computer. There are scripts that run on a daily, weekly and monthly basis to archive and clean up the system log files.
DirectoryService – this process maintains service location, users, groups and authentication services by gathering information from plugins and protocols and communicates that information to whichever task needs that information
DesktopDB – keeps track of known applications and their document types, used by the Finder application to handle file associations
distnoted – provides distributed notifications service
ftpd – FTP Daemon, created dynamicallyby xinetd or inetd and will only execute whenever someone or a program is accessing or attempting to access your computer using the FTP protocol.
dynamic_pager – assist the kernel with managing the swap files for virtual memory
httpd - Apache Web Server, it should only be running if web sharing is enabled via System Preference’s panes, if it is running it is common for there to be more than one process running with this name
init – master process that is responsible for spawning (creating) processes at boot time via /etc/rc* and StartupItems, after boot time it is responsible for monitoring and restarting the background processes
inetd – responsible for starting and looking after some of the Internet services (mainly FTP and telnet), in OS X 10.2 it was replaced by xinetd which was then replaced by launchd (launchctl) in OS X 10.3
ipconfigd - OS X 10.0 – 10.1.1 only, automatically configures the network, now merged with configd since OS X 10.1.2
KernelEventAgent – handles notifications about file system status
kextd - responsible for loading and unloading kernel extensions (device drivers)
launchd – OS X 10.4+, replaces init and mach.init and takes over most of the functions of cron and xinetd
lookupd – handles DNS and NetInfo lookup tasks, resolves names and communicates with the DirectoryService
mach_init – 10.0 – 10.3 only, the mach kernel’s bootstrap port server, this is the first process created during bootup and it creates the BSD init process (which then in turn starts up everything else). In OS X 10.3 it also created several of the daemons that used to be created via StartupItems, replaced by launchd in OS X 10.4
mDNSResponder – multicast DNS (component of Bonjour / Rendezvous) responder; this process advertises network services such as AFP file sharing, serves up the “.local” name and it executes using the unix account “nobody” for security reasons.
netinfod - services NetInfo data, there will be one process for each NetInfo domain serviced by the local computer (normally just one process).
nfsiod - services async requests to an NFS server, its normal for there to be more than one
nibindd – finds, creates and destroys NetInfo servers (i.e. netinfod), this process will only execute if there is something for it to do
notifyd – passes event notifications between processes
ntpd – network time protocol daemon
pitond – retrospect client (only present if Retrospect Client is installed)
pmTool - a user process that happens to execute as root, activity monitor uses it to collect information on running processes
portmap – dynamically assins RPC (network remote procedure calls) services such as NetInfo and NFS to TCP/UDP ports
slpd – Service Location Protocol (SLP) responder, this advertise such services as AFP file sharing, has been replaced by Bonjour/Rendezvous but is kept active for compatibility with other OS X software releases
slpdLoad – frequently shows up as a Zombie in Activity Monitor
sshd - secure shell server, listens for and services incoming SSH connections, it was added to OS X 10.0.1 and should only be running if “Allow Remote Login” is enabled in System Preferences, in OS X 10.3, sshd no longer runs continuously listening for incoming connetions, instead xinetd (v10.3) or launchd (v10.4) does the listening, only starting sshd when its actually needed
syslogd - logs and or dispatches system status and error messages
telnetd – handles incoming telnet (remote login) connetions, its enabled by “Allow remote login” in the System Preferences Sharing Pane. This process is dynamically created by inetd so it should only appear when it has work to do like when someone is remotely connection to your machine or is attempting to
update – responsible for keeping disks synchronized with the file system cache, keeping data loss to a minimum
xinetd – responsible for starting and looking after some internet services (mainly ssh, FTP and telnet) provided by a computer. This is an extension of the inetd, in OS X 10.4 it was mostly replaced by launchd but is kept around for compatibility

*User Processes*
ATSServer - Apple Type Solution Server – responsible for managing the available fonts and making them available to the applications
Dock – maintains and displays the Dock
DocklingServer – keeps docklings’ status and displays up to date
Finder – the Finder
hdid - handles mounted disk images (.dmg and .img) files
LaunchCFMApp – applications in the old-style Macintosh format (Code Fragment Manager format, aka CFM, aka PEF) will show up in Process Viewer under this name LaunchCFMApp is actually a wrapper program provided for compatibility with this old application format; Process Viewer just can’t see through the wrapper to the actual process or application inside
loginwindow – this is only partly a user process, it starts before anyone logs into the computer and is responsible for displaying the login screen (or not, it autologin is set). It also acts as a process monitor for user processes, restarts the Dock or Finder if they crash or quit and implements the Force Quit Applications window, it handles logout, restart and shutdown procedures
pbs – the pasteboard server
pmTool – background process that the Activity Monitor users to collect information on running processes, runs as root
SystemUIServer – OS X 10.1+, maintains the menu items in the right of the Dock
TruBlueEnvironment (or “(null)”) – Classic OS 9 compatibility environment, single process that includes OS 9 and all running Classic applications. The name derives from the early Apple code-name for the Classic environment: “the Blue Box”, for some reason Activity Monitor under OS X 10.3 has trouble reading this process’s name and tends to display it as “(null)”
WindowServer aka Window Manager – responsible for managing the computer’s display and mediating between the various applications and other processes that want to display information on it. It does all of the grunt work of launching new user applications, so most user processes are actually its children in the process hiearchy.

Main entry continued