OS X is built as a multitasking, multi-user environment in which resources are "shared" between various processes and tasks, which enables simultaneous processing of tasks. Essentially, the whole system is a bunch of independent processes, and while some rely on others, only a minimum number of them are dependent on another. As such, many can be quit and relaunched without harming the system, but sometimes if a process is not coded properly, resources can be used up rather quickly and cause the system to hang. There are several indicators when this happens in OS X, including the affected application (or dependent applications) freezing and running slowly, and displaying the infamous spinning beach ball cursor.
Because of this, it is useful to know how processes are organized in OS X, so you can target them using Activity Monitor or terminal commands to either quit or relaunch them to clear a system hang.
For background, let's take a look at what happens when you start up your computer. Read the inset box for an in-depth view of the Mac boot process, or skip it for a shorter description.
After the hardware and firmware on your computer initializes, a boot device is found and a healthy kernel is started up. The kernel is the lowest level software interface on the computer, and which makes resources such as RAM, video, and hard drives available to the operating system and programs in ways that allows for resource sharing and multitasking.
When the kernel loads in OS X, it makes these hardware resources available to software and immediately starts up the launcher process ("launchd") that will handle initialization of all "userland" processes, which are processes that have user-based access privileges (i.e.: "root" or a human user). In addition to initialization, launchd offers scheduling options and configurations for running every process on the system. It is the parent process that umbrellas every other process underneath it, which is useful for the system to compartmentalize processes.
After launchd loads, it runs scripts that load the remainder of the system processes in proper sequence to the point where the login window loads and displays.
System process organization
The system is basically comprised of a bunch of independently running programs, each of which supply part of the OS X experience. For instance, to manage windows, the system uses the "WindowServer" process, and to manage "kerberos" single sign-on authentication the system has "krb5kdc" running. Likewise, the Dock, Finder, and user applications that you start up are all programs.
All system processes are run by the "root" user, which is the user invoked by the kernel to launch the first "launchd" process. The "root" user is just the system itself, but since unix is a multi-user environment, all processes are given some ownership and permissions attributes, which are by default "root" unless another user is logging in and launching programs. There are a variety of system users, such as "daemon", and "_windowserver", which are used to give these processes special permissions and utility without running as root.
These processes run parallel to each other, and if one is quit, then others will still run, but may lose the functionality provided by the closed process. Despite the stability of the system, we recommend you do not randomly quit system processes, especially those with lower PID (Process ID) numbers in Activity Monitor. However, some "root" processes like antivirus scanners can use up resources at times and become unresponsive, and quitting these can clear the problem.
User process organization
When you log in, a new "launchd" process is started for your user (unlike the parent one that is running as "root") and all tasks you perform will be run under this new (but smaller) launchd "umbrella." In a sense, this is similar to when the system boots and launches the "root" user's "launchd" process.
You can see this task organization in "Activity Monitor" by opening the main activity window and choosing to view "All Tasks, Hierarchically" from the drop-down menu, which will tab-indent processes under their parent processes. All processes will be under the root "launchd" with Process ID (PID) 1, and all user processes will be under the "launchd" process for that user.
With tasks organized like this, the computer can easily manage resources for users. For instance, if a problem ever occurs with a user's account, the main "launchd" process for that account can be shut down immediately without harming the system.
There are many processes that are launched by a user when that user logs in, including file indexers, spelling services, and background agents that help launch programs such as Dashboard, iTunes, and iChat. You may wonder why these and other system processes do not show up in the Dock, even though they technically are applications. Unlike other processes, applications that are invoked by a user will show up in the Dock because they are specifically coded to do so. When developers use Xcode and the carbon or cocoa APIs, they create an application that is "Windowed" and package it with the support files necessary to make it viewable in the Dock. Most underlying processes do not have this specific code, so even though they are running, they will not show in the Dock.As such, you may need to use Activity Monitor to see which processes may be hanging or causing problems, rather than quitting all open applications that you can see in the Dock.
Making use of it all
With knowledge of how processes are organized, you can troubleshoot when your system hangs by being able to better identify which processes are ones that belong to your user account, and which ones are system processes or those belonging to other users. If you have "fast user switching" enabled on your system, you can see if another account has a process running that hogs the CPU, and be able to deal with it. Apple's Activity Monitor and other activity viewer utilities are exceptionally useful interfaces for managing these processes, primarily by allowing you to target and quit any that are not functioning properly.
In addition, if you are having hardware troubles and cannot get past a certain part of the boot process, you can use knowledge of that sequence to better understand where the problem is occurring.
More to come: We plan on writing a few additional tutorial and info articles based off this information, which will hopefully help MacFixIt readers better understand and troubleshoot OS X. If you have comments or suggestions for future articles, please contact us: http://www.macfixit.com/contact
Click the following URL for part 2 of this series: About OS X System Processes
Click the following URL for part 3 of this series: Guide to Activity MonitorResources