Getting more from Activity Monitor: Memory

Memory is one of the most precious resources in our Macs, and one of the most complicated to understand and manage. When most Macs could have their memory upgraded, one of the most popular ways to improve performance was to add more memory modules. Now we can’t do that, making the most of the memory our Macs have becomes even more important. This article concentrates on basics, aiming to improve understanding so you can tackle memory problems better.

If you have an Apple silicon Mac, you’ll be aware that it has Unified Memory, which means that, instead of having dedicated graphics and other memory in its chip, (almost) all its memory is in one place, where it’s accessed by the CPU, GPU, and other systems such as the Neural Engine. Intel Macs may have separate graphics memory, if they have a separate graphics card, or that memory may be allocated from main memory, in which case it doesn’t work the same as Unified Memory. There are also smaller specialised memories dedicated to the support of specific chips, such as cache memory for CPU cores. This article concentrates exclusively on main system memory.

Kernel and extensions

Managing system memory is one of the main tasks of the macOS kernel. To do that, and its other functions, the kernel dedicates some memory for its own use, and use by kernel extensions, known as Mach zones. These consist of pools of pre-allocated memory in a range of fixed sizes that can be used very quickly. There are hundreds of different zones, each of which is allocated early during the kernel phase of booting.

Exceptionally, the kernel or one of its extensions can leak memory from these Mach zones, by using it but failing to free it properly. This last happened in a release version of macOS back in Catalina 10.15.6, and caused kernel panics. Investigating Mach zones isn’t easy: the best way to get an overview is with the sudo zprint command.

User memory

The remainder of main system memory is available for use by apps and other processes, and is our main concern here. Activity Monitor provides a good overview and plenty of useful detail on memory use in its Memory tab, particularly when you list processes in order of their memory use, by clicking the column header Memory to sort them with the largest at the top. In the View menu, ensure that All Processes is ticked, or system processes will be hidden. Confirm that the window title reads Activity Monitor All Processes.


With my normal working apps open, the largest user of memory is Postbox, but none takes more than 600 MB. Looking at the detail at the foot of the window, you’ll see a value for the physical memory installed in your Mac, how much memory is used, whether there are any files which are cached to disk storage, and any swap memory usage.

Memory used is broken down into App and Wired memory, and the amount that’s compressed to save space. The breakdown given at the foot of the Memory view includes:

  • Memory Used, the total amount of physical (real) memory being used by the system and apps, which for Apple silicon Macs should include that being used by the GPU.
  • App Memory, the total amount of physical memory allocated to system processes and apps, which might or might not include that being used by the GPU in Apple silicon Macs.
  • Wired Memory, physical memory which can’t be either compressed or swapped out to disk, which should include all that being used by the GPU in Apple silicon Macs.
  • Compressed, physical memory which hasn’t been used recently, so has been compressed to save space. That shouldn’t include any being used by the GPU in Apple silicon Macs.

This article looks in greater detail at Unified Memory.

macOS tries to make best use of the physical memory installed, and use a minimum of swap, as the latter is slower to access as it has to be read back from disk into memory first. In this case, there’s ample free physical memory, and the chart at the bottom left shows no memory pressure at all. That all looks generally healthy.

macOS supports the extension of memory to include disk storage, so-called virtual memory. This is managed by a combination of hardware and software, which enables some of the memory being used to be swapped out to disk, rather than occupying physical memory. There are complex trade-offs in putting what should be in physical memory into disk storage, and how much physical memory to keep free. These are normally managed expertly by macOS, and shouldn’t be meddled with.

Apps and processes

Even when you don’t have many of your own apps open, Activity Monitor lists a great number of active processes using memory. Making sense of them is half the battle, and for the sake of this example I’ll consider one app, Safari.

Open a few pages in different tabs in Safari. Then with Activity Monitor listing All Processes, you’ll see that Safari itself isn’t taking much memory, here a mere 131.7 MB. But further down the list you can see what appears to be one of the open pages, named using its URL and taking over 100 MB. That’s because Safari opens pages in their own process, making it harder to get a full picture of how much memory it’s using in total.


Now go up to the View menu and change the setting there from All Processes to All Processes, Hierarchically. That sorts the list of processes according to their parent, and groups them together. Scroll down to locate Safari and open its disclose triangle to see all its child processes, and the true memory use of the whole app, which is a great deal more than 131.7 MB.


An even better example is my virtualiser Viable, which itself has a small memory footprint. But it runs VMs which can swallow 8 GB or more memory, and are listed separately when displaying All Processes without their hierarchy.

Regular offenders

Several processes often run towards the top of the list, no matter what other apps you might be using.

WindowServer is responsible for compositing all the windows into the image to be displayed via the GPU onto the display. At times it can use well over 1 GB, and can appear alarming. If that happens, the simple solution is to close any windows you’re not using, and you should see its memory use fall steadily. Unfortunately, unlike an app that you can quit, you can’t stop WindowServer or restart it without restarting your Mac.

The Finder shouldn’t normally use a great deal of memory, even with several large windows open. In Monterey, though, it can suffer a memory leak, described below. That’s easier to deal with, as there are several different ways to force the Finder to restart, either in the Force Quit dialog (Command-Option-Escape), or by switching to the Finder, holding the Option and Shift keys while opening the Apple menu, and using the Force Quit Finder command there.

mds_stores and its relatives are parts of the macOS Metadata Services, better known through Spotlight. Sometimes their CPU and memory use can get out of hand. If they don’t settle, you may be tempted to force them to quit by selecting a process and using Activity Monitor’s Stop tool. As they’re running as root, you should think twice, as that can cause problems, and you could find them having to rebuild indexes before Spotlight search works properly again. It may be better to restart when the time is convenient.

User apps can consume huge amounts of memory at times. The best solution then may be to save your documents, close their windows, and if necessary quit the app to free its memory up. If this happens regularly, you should inform the app’s developer.

Memory leaks

A memory leak occurs when a process obtains memory for a purpose, uses it, but once that’s complete it never frees that memory by returning it to macOS. This is more than just high memory use: the longer you use that app, the higher its memory use climbs, and closing documents and windows doesn’t help at all. The only solution is to quit the app altogether.

This is easy to demonstrate on many Macs in Monterey’s Finder, using its Find command. Open a Finder window and set it to Find files. Type one or two letters into its search box, and watch what happens to the Finder’s use of memory.


The memory used by the Finder quickly starts to climb, here reaching over 1 GB, and continues to rise as long as the Finder continues to search for files.


As it sails past 2.85 GB, note how the figure for total Memory Used also rises, as does App Memory. Memory pressure remains in the green, though, as we started with so much free.


In this particular search, memory used by the Finder reached a maximum of 3.11 GB. Not only that, but closing the Find window didn’t recover any of that used memory: from now on, that’s the Finder’s starting point. Perform another Find and the memory used by the Finder will soar again, and never fall. It will do that, voraciously consuming memory, until the Finder is restarted.

This doesn’t happen on every Mac, though. If yours has relatively few files and each search returns just a few hundred hits, you won’t see it. If your Mac has hundreds of thousands of documents and those searches run on for many seconds, the leak is likely to be more apparent and larger in size.

If you ever encounter what you think might be a memory leak, it’s essential to confirm its behaviour using Activity Monitor, and then to inform the developer so that bug can be identified and fixed.

Healthy memory use

It’s easy to develop memory angst, install a tool to constantly monitor your Mac’s memory use, and even try those claimed to free up or clean memory. None of those are necessary, as macOS has over 20 years experience of managing memory, and usually does so far better than anything else can.

Ideally, you should aim to use virtual memory very little and only infrequently, if at all. If you find that your Mac is regularly having to use it, as you’re unlikely to be able to add more memory now, all you can do is use the memory your Mac has as best as you can. Reduce the number of apps you have open at the same time, and the number of open documents and windows within those apps. If you can switch to using apps with a lower memory footprint, that can make a big difference too.

Heavy use of virtual memory doesn’t just slow your Mac down, but it can also shorten the working life of its internal SSD. When specifying a Mac, you should never be too frugal with its memory, or the long-term consequences can be damaging. At the same time, it’s a waste of money to have 64 GB of fast, expensive memory sat there doing nothing much of the time. Gauging how much memory is an art, and not easy when you’re making the transition to Apple silicon.