If your Mac starts up in Sonoma, have you noticed it using a lot of CPU, maybe with the fans blowing, for several minutes after you’ve logged in? This has commonly happened in the past, when Spotlight performs housekeeping on its indexes, but peek into the CPU view in Activity Monitor and you might be surprised to see different processes named CGPDFService responsible. This article looks at this newcomer to macOS 14 Sonoma, and what it’s up to.

Where to see it

If you haven’t come across CGPDFService before, it’s because it didn’t exist before Sonoma. In previous versions of macOS, when you opened Activity Monitor to its CPU view as soon as you had logged in after starting up or restarting, you’d be likely to see multiple mdworker processes and mds_stores towards the top of the list, as they perform a short housekeeping session on file metadata and update Spotlight’s indexes on each mounted volume. In Sonoma, they’re now joined by CGPDFService, which in some cases can be running at high load for many minutes after you logged in.

What it is

CGPDFService turns out to be quite a small background XPC process inside the CoreGraphics framework, located on the System volume (SSV) in the path /System/Library/Frameworks/CoreGraphics.framework/Versions/A/XPCServices/CGPDFService.xpc. The executable is around 313 KB, and is currently in version and build number 1, as it shipped with the first release of Sonoma. As an XPC service, other processes communicate with it using lightweight inter-process communication, and the only times you’ll get to see it are in Activity Monitor and the log.

Looking inside the executable, it appears to give lightweight access to Core Graphics features supporting PDF, as the name implies. Those can include the extraction of text from any text (vector graphics) layer in a PDF file, but not of course from a pure image layer.

How it works

Examining the log for a few seconds during the startup phase, when multiple CGPDFService processes are taking high CPU % according to Activity Monitor, demonstrates that those processes are indeed making many log entries too. These appear in close association with mdworker processes, which are also numerous, but tracing their relationship in the log at this stage isn’t easy, because of the profusion of entries.

CGPDFService processes encounter characteristic sandbox errors when trying to read data from ~/Library/Preferences/ByHost/.GlobalPreferences.[UUID].plist, ~/Library/Preferences/.GlobalPreferences.plist, ~/Library/Preferences/.GlobalPreferences_m.plist and /Library/Preferences/.GlobalPreferences.plist, and sometimes from other locations such as /private/var/db/timezone/tz/2023d.1.0/icutz/icutz44l.dat

Unlike mdworker processes in the past, their high startup activity doesn’t appear to result from repeated crashes.

To get a better idea of how CGPDFService processes now work in this role, you’ll need to examine a simpler situation, such as the creation and saving of a PDF document. When that occurs, new mdworker processes are spawned, leaving old ones to be SIGKILLed. mdworker processes then connect to CGPDFService processes via XPC, and they in turn spawn new CGPDFService processes.

CGPDFService processes reset their user defaults, then await XPC connections from mdworker and mdworker_shared processes. Once those have extracted data to be added to that volume’s Spotlight indexes, mds_stores compresses data passed to it by those mdworker processes. CGPDFService processes make few log entries, among them a report of “Out of bounds page index”, presumably once the text layer contents have been obtained.

Fixing problems

Although killing CGPDFService processes in Activity Monitor might be a satisfying way of trying to address sustained high levels of CPU %, that’s unlikely to fix any underlying problem. There are two main approaches for tackling this if the high CPU is unacceptable:

• Remove PDF Documents from the Search results list in Siri & Spotlight settings.
• Add the volume or folder containing the PDFs to the list that Spotlight ignores, through the Spotlight Privacy… button in those settings.

These both have the disadvantage of removing those files from Spotlight search. One solution for dealing with one or a few PDF documents that always choke CGPDFService processes is to isolate them in a folder that is excluded using the Spotlight Privacy list.

Why?

This change in Sonoma hasn’t been reported or explained by Apple, and doesn’t appear to be related to any known change in Sonoma’s features. It’s possible that this is the first step in preparation for more sophisticated methods of extracting text from PDFs, which might in the future include the use of Live Text OCR. However, there’s no indication that’s used at present. If you’re unaware of the additional complications incurred by that, my earlier account provides an outline, and Apple’s more detailed account of how it works in Sonoma should confirm that.