If you want to know about anything, start by observation. For observing Macs and macOS there are two major tools: the Unified Log, which unfortunately is still poorly supported by the bundled browser, and Activity Monitor. This article looks at using the latter to learn more about what your Mac’s processor cores are up to, and what might be causing it problems.

Unlike the log, access provided by Activity Monitor is excellent; only developers with Xcode’s performance tools have any better, and then only for their own code. All you have to do is open Activity Monitor and select its CPU view. Understanding what you see is the next challenge.

The main window lists active processes and key values which normally include %CPU, CPU Time, Threads and more. You can customise which fields are shown by Control-clicking in the column headers, which pops up the menu of items you can include, and you can drag and drop the columns into the order that you want. In most cases, the defaults are an excellent start, and the %CPU column the most significant to watch. Click in its header once to sort the list of processes into order with the highest %CPU at the top. One snag of doing that is that the order keeps changing, of course.

You can also customise which processes get listed in this window, using the View menu. If you’re only interested in user processes, then turn off the clutter of All Processes, for instance.

The box at the foot of this window provides some useful global indicators of total CPU use and idle time, a basic plot of total CPU load over time, and the total number of threads and processes.

Most of this information is fairly straightforward to interpret. There are just two catches which still cause trouble. Most of us assume that %CPU should total 100, but the units here aren’t that precise, and refer more to the total core capacity. On a Mac with 8 cores, don’t be surprised to see processes with 400% or more in their %CPU, indicating that they’re loading most or all of the cores very heavily indeed. As relative measurements go, %CPU seems fairly quantitative and accurate.

The other is the hot Mac with an unusually high %CPU for kernel_task. Of course that process is always running, and its CPU Time should be one of the longest in the list. But kernel_task is used by your Mac’s Core Duet and environmental control system to block processor cores when they’re hot and overloaded. So a high %CPU here isn’t a symptom of overheating, but of one of the response measures your Mac uses to try to stay cool.

Select one of these processes and there are several things you can do with it: the tool with an X in it can force the process to quit. Some users love exercising this power in Activity Monitor, but unless you know what you’re doing you can easily cause problems. The tool with an i provides a useful window of information, including memory use, detailed statistics, and a list of open files and ports. That file listing can be invaluable when you’re trying to track Property Lists, dylibs, and other items which an app may have open. It’s also often very long. Finally, the … tool offers some more specialist features in its popup menu, which can be useful when that process is in trouble.

There are two other CPU windows which are also of great use, opened from the Window menu: CPU Usage and CPU History.

CPU Usage simply shows the loading on each core at an instant, when Activity Monitor was sampling for its last update. This example is taken from an Intel Mac with eight cores, and (as is typical) shows what appear to be 16 cores. Those in the odd-numbered positions from 1 to 15 are real, physical cores, and usually the ones to watch. Those in even-numbered positions are virtual cores which become loaded in hyperthreading, usually only when the cores are heavily loaded.

Even more useful is the CPU History window, which shows user and system load on each core with time. You can change the frequency at which Activity Monitor updates these and other information in the Update Frequency command in the View menu. It’s normally set to 5 seconds, which is good enough for most purposes, and allows Activity Monitor to steal relatively few cycles itself.

M1 Macs are essentially the same in almost every respect. However, they have eight real cores, so you’ll see their CPU Usage window behaving as you’d expect.

CPU History for an M1 Mac is currently one of the most interesting features in Activity Monitor, as we get to understand how its cores are used. They’re grouped into four Efficiency cores at the top, which are slower, use less power and generate less heat, and the four Performance cores at the bottom. Unlike the CPU Usage window, this can be resized to display longer history as you wish. Sadly there are currently no options to suppress its labels, nor to change the colours used for user (green) and system (red) load in the chart.

Once you know your way around Activity Monitor’s CPU windows, the next task is to familiarise yourself with how they respond to everyday events such as Spotlight indexing, Time Machine backups, even MRT’s malware scans. For it’s only through learning what’s normal that you’ll come to recognise the abnormal: start by observation.