Activity Monitor on a MacBook: reading the five tabs without guessing

Activity Monitor opens on the CPU tab, sorted by nothing in particular, with a process called kernel_task near the top and a percentage next to it that changes every five seconds. The fan is loud, the battery is going faster than it did last month, and none of the five tabs says which of those two problems is on screen.

The tabs are not five views of the same thing. Each one answers a different question, and each one has exactly one reading that decides anything. The rest of the columns are for after a decision has already been made. Sorting that out takes about ten minutes, and it turns Activity Monitor from a wall of numbers into a short checklist.

What each tab is actually for

Activity Monitor ships with five tabs across the top: CPU, Memory, Energy, Disk and Network. The list of processes down the left stays the same in all of them. What changes is the columns, and with them the question being asked.

Tab	The question it answers	The one reading that decides something
CPU	What is doing work right now	The % CPU column, sorted descending
Memory	Does this Mac have enough RAM	The Memory Pressure graph colour
Energy	What is draining the battery	The 12 hr Power column
Disk	What is reading and writing	Data read and Data written per process
Network	What is sending and receiving	Data received and Data sent per process

The value of keeping those apart is that the wrong tab gives a confident wrong answer. A process at 90 percent CPU for four seconds while a page renders is normal and means nothing. The same process appearing at the top of the Energy tab over twelve hours is a real finding. CPU is a snapshot, Energy is a history, and the two disagree constantly.

A sixth tab, Cache, appears only under one condition, and there is a GPU view that is not a tab at all. Both are covered further down, because looking for them and not finding them is a common false alarm.

CPU: a snapshot, not a verdict

The three figures along the bottom of the CPU tab are the ones worth learning, because they say where the work is going rather than how much of it there is. Apple defines them plainly. System is "the percentage of CPU capability that's being used by processes that belong to macOS." User is "the percentage of CPU capability that's being used by apps you opened, or by the processes opened by those apps." Idle is "the percentage of CPU capability that's not being used."

That split does real work. A machine sitting at high User is busy with something that was asked for, and the process list will name it. A machine sitting at high System with nothing obviously running is a different situation, usually indexing, syncing, or a background service retrying something that keeps failing.

Two windows in the Window menu are more useful than the tab itself for anything intermittent. CPU Usage gives a small always visible meter, and CPU History gives a scrolling graph per core. A fan that spins up every few minutes shows as a regular pattern of spikes in CPU History, which is the difference between a real recurring job and one busy afternoon.

Sorting the % CPU column descending is the whole technique on this tab. Reading the numbers without sorting is how people end up worrying about kernel_task, which is the process that manages hardware on behalf of the system and is not a finding on its own.

Memory: read the graph, ignore the big number

The Memory tab is where the most misreading happens, because the largest number on it is the least useful. Memory Used counts memory that the system is holding on purpose and will hand back the moment something else needs it.

The terms underneath are worth knowing in Apple's own words. Physical Memory is "the amount of RAM installed." Cached Files is "the size of files cached by the system into unused memory to improve performance." Compressed is "the amount of memory that has been compressed to make more RAM available." Wired Memory is "memory required by the system to operate. This memory can't be cached and must stay in RAM, so it's not available to other apps." Swap Used is "the amount of space being used on your startup disk to swap unused files to and from RAM."

Cached Files is the reason a MacBook with 16 GB of RAM reports almost all of it used after a few hours of work. That is the intended behaviour, not a shortage. Unused RAM does nothing, so the system fills it with files it might need again.

The reading that actually decides something is the Memory Pressure graph, which Apple describes as a representation of "how efficiently your memory is serving your processing needs." The colours have documented meanings.

Green memory pressure: Your computer is using all of its RAM efficiently. Yellow memory pressure: Your computer might eventually need more RAM. Red memory pressure: Your computer needs more RAM. Source: support.apple.com, read September 27, 2026

Green with 15 of 16 GB used is a healthy machine. Yellow or red with plenty of memory apparently free is a problem. Swap Used rising steadily while the graph sits in yellow is the clearest sign that the workload no longer fits, because swap means the startup disk is standing in for RAM.

Whether anything can be done about it depends on the model. Holding Option and choosing System Information from the Apple menu, then Hardware and Memory, shows a Memory Slots pane with upgradeable memory information on Macs that have it. Machines with no such pane have memory that cannot be changed, which turns a red graph into a question about which apps stay open rather than a shopping decision.

Energy: the tab for battery complaints

Battery questions belong here and nowhere else. The CPU tab cannot answer them, because it has no memory of what happened an hour ago.

Energy Impact is "a relative measure of the current energy consumption of the app (lower is better)." The column next to it, 12 hr Power, is "the average energy impact of the app in the last 12 hours, or since the Mac computer started (lower is better)." That second column is the one to sort by. An app that appears near the top of it has been costing battery all day, whether or not it was ever in front.

Three more columns explain specific complaints. Preventing Sleep shows "whether this app is preventing your Mac from going to sleep," which is what to check when a lid is closed and the machine is warm and flat later. Graphics Card shows "whether the app requires a high performance graphics card," which matters on models that have two. App Nap shows "whether App Nap is active for this app," and an app that never naps while sitting in the background is doing work it probably does not need to do.

At the bottom, Battery (Last 12 hours) plots "the battery charge level over the last 12 hours." A cliff in that graph at a time when nothing was being used is worth lining up against the 12 hr Power column, because the two together usually name the app.

This is also the tab where resident background apps stop being invisible. Utilities that live in the menu bar and run all day show up in 12 hr Power even though they were never opened, and reviewing that list is a sharper exercise than reviewing what is in the Dock. The features page covers the separate question of which of those need their icons on screen once a decision has been made about which of them stay installed.

Disk and Network: for when something is busy and nothing is on screen

These two tabs answer the same shape of question. A machine that is warm and slow with an idle CPU is usually moving data.

Apple's description of the Disk tab is short: "Activity Monitor tracks the number of times your Mac accesses the disk to read and write data, and shows the amount of data that's read or written to your disk." Sorting by Data written and seeing a cloud sync client, a backup agent or a photo library process near the top explains most mystery activity after a large import.

The Network tab is more precisely documented. Packets in and Packets out are "the total number of packets received and sent." Data received and Data sent are "the total amount of information moved (in megabytes)." Data received/sec and Data sent/sec are "the amount of information moved over time (in bytes per second), also called throughput." The graph at the bottom switches between packets and data through a pop-up menu, and data is the more readable of the two for anything involving a metered connection.

Both tabs are cumulative since launch, which is easy to forget. A large total next to an app that has been open for three days is not the same as the same total from this morning.

Quitting something, and the order that is safe

The stop button at the top left of the window offers two options, and the difference between them is not cosmetic.

Quit "is the same as choosing File > Quit within an app. The process quits when it's safe to do so. If quitting the process could cause data loss or interfere with another app, the process doesn't quit." Force Quit is blunter: "the process quits immediately. If the process has files open, you may lose data. If the process is used by other apps or processes, those apps or processes could experience problems."

Quit first, every time, and reach for Force Quit only when Quit visibly refuses. Processes that do not belong to the current user may ask for administrator authentication, which is a reasonable prompt to stop and reconsider rather than one to click through.

Before quitting something unfamiliar, the View menu has a hierarchical view that shows which process started which. A helper that looks idle on its own may be the only thing holding a running app together.

Four reports live behind the More button in the toolbar, and they are worth knowing about before a support conversation rather than during one. Sample Process "creates a report on a selected process over a period of 3 seconds." Spindump "creates a report for unresponsive apps that were terminated using force quit." System Diagnostics "creates a report based on different logs on your Mac." Spotlight Diagnostics "creates a report based on all the processes running on your Mac."

The tab that is missing and the view that is not a tab

Two things send people looking through the window for something that is not there.

Cache is a real tab, but it appears only on Macs with one setting turned on. Apple's instruction is exact: "If you don't see the Cache tab in the Activity Monitor window, choose Apple menu > System Settings, then click General in the sidebar. (You may need to scroll down.) Click Sharing on the right, then turn on Content Caching. After that, quit and then reopen Activity Monitor to view Cache information." Its columns describe a shared download cache, including Data Served From Cache, "amount of data the content cache has served from its cache," and Data Served From Origin, "amount of data the content cache downloaded over the internet." On a single MacBook with no other Apple devices on the network, there is nothing useful in it.

GPU activity is not a tab at all. It lives under Window and then GPU History, alongside the note that "if an Afterburner graphics card is connected to your Mac, choose Window > Afterburner History to display a graph that shows the Afterburner card usage." Anyone hunting for a GPU column in the process list will not find one.

One more control is worth knowing about. View and then Update Frequency changes how often the figures refresh. The default is every 5 seconds, and the faster settings give a more precise picture of a short spike at the cost of some processor time, which Apple notes may itself affect overall system performance. For anything intermittent, the CPU History window is the better instrument, because a slower refresh is not on offer.

What to change first

Stop opening the CPU tab for battery questions. Sort the Energy tab by 12 hr Power, check the Preventing Sleep column, then look at the Memory Pressure colour rather than at Memory Used, and the two most common complaints on a MacBook separate cleanly. If the list of all day background apps in the Energy tab turns out to be longer than expected, the next decision is which of them still need a permanent place at the top of the screen, and Koffret is for the ones that stay.