Using EtreCheck
About EtreCheck
EtreCheck is a tool I wrote to help people on Apple Support Communities remotely debug problems with people’s computers. That can be a difficult task even when the machine is in front of you. Attempting it over an internet discussion forum is extremely difficult.
I strongly suggest that you post new questions here on Apple Support Communities with your EtreCheck results rather than e-mailing me directly. While I don't mind answering e-mails, there is no way that I can provide assistance that is as accurate or as timely as all of the people here on Apple Support Communities. The more exposure your problem can get, the greater the chance that someone will recognize your problem and contribute a solution.
EtreCheck is not an authoritative guide. It is more of a general overview of the state of your Mac. It is unlikely that any one entry really has any meaning. The idea is that the results, taken as a whole, will help to identify what is making your Mac run slowly or have kernel panics. As EtreCheck has grown more popular, I have added more information and it has gotten to the point that it needs some explanation.
EtreCheck runs a number of low-level system tools, makes some direct queries, and consolidates all the information in more human readable form. It also tries to identify known problems. Finally, it prints all of this information into a story about what is going on behind the scenes on your Mac. EtreCheckPro might show that some things be awry. Then again, EtreCheck might report that everything looks good. Either way, this information is going to be very useful when trying to solve a problem with your Mac.
The following is an explanation of each section of your EtreCheck report. When posting you report, please do not omit any section.
- Header:
The EtreCheck version you are using. The date and time you ran your report. The time it took to generate your report. EtreCheck’s overall evaluation of the performance of your machine. The type of problem you are having. And last, but most important, your own detailed description of the problem.
- Major Issues:
Any significant problems that EtreCheck found during its analysis. These problems might be related to the problem you are having. These might be problems you didn’t know you had. Generally speaking, Major Issues need immediate attention.
- Minor Issues:
Other, minor problems that EtreCheck found during its analysis. Although you can, and probably should, fix these problems, they probably aren’t going to help. These are things you can do that might improve subsequent EtreCheck reports, might be problems in the future, or might satisfy people who obsess about their Mac. But generally, Minor Issues do not mean anything is broken.
- Hardware Information:
Basic Information about your machine. The number of processors, cores, and RAM. Also includes the health and age of your battery, if you have one.
- Video Information:
Your video cards, VRAM amounts, and attached displays.
- Drives:
This may include several hidden volumes used for startup and recovery. The most useful information here is the low-level structure of your file system. Apple’s file systems have grown increasingly complex over the years. This is becoming a source of problems for some people.
- Mounted Volumes:
The most useful information here is the amount of free space on your startup volume. If it is too low, your machine has to do more work to keep enough free space to work with. If it drops to critically low levels, your machine may crash. People sometimes choose clever and/or person names for volumes, so most volume names are obfuscated to protect your privacy.
- Network:
Your system network configuration. Includes information such as network proxies that are common on Macs used in large enterprises but unusual for people’s personal machines. The status of your iCloud account might be listed too.
- System Software:
Your operating system version, including specific build version. Also reports the time since your machine has been rebooted. EtreCheck results will be more valuable if you run it before rebooting. Ideally, run EtreCheck while or soon after encountering whatever problem causes you to want to run EtreCheck.
- Configuration files:
These are low-level changes to your machine’s configuration. There is nothing wrong with such changes, as long as you are the one who made them. Otherwise, they could be a sign of malware activity.
- Configuration profiles:
More low-level changes to your machine’s configuration. These are common on Macs used in large enterprises but unusual for people’s personal machines. They could be a sign of malware activity.
- Security:
The status of your Mac’s security. Gatekeeper and System Integrity Protection should always be enabled. There is lots of bad advice on the internet instructing people to completely disable Gatekeeper. Don’t do it!
Note: Security is special. Please look in EtreCheck’s top-level list of pages on the left-hand side of the EtreCheck window for the Security page. Many of these pages are part of EtreCheck’s paid Power User package, which is available as an in-app purchase, and are dimmed out and disabled. The Security page is enabled when EtreCheck is running in free mode so that you can easily remove adware files, if any are found.
- Adware:
This section lists any software that EtreCheck has determined to be adware. These should be removed using the Security page from the left-hand side of the EtreCheck window.
- Unsigned Files:
This section lists any software that does not have a valid digital signature that proves its authenticity. EtreCheck will try to make a guess about whether each item looks like something legitimate or adware/malware. Legitimate software might be older software or software from developers unfamiliar with the Mac. If you need help with anything here, please ask here on Apple Support Communities.
- 32-bit Applications:
These are any software apps that will not run in the future. Apple has said that macOS “Mojave” will be the last version of the operating system that will run 32-bit apps.
- Kernel Extensions:
Lists any 3rd party kernel extensions. These extensions actually modify your operating system. Many may be necessary for software you want to run. However, because they run deep within the core of the operating system, they can destabilize your system. The most common result from misbehaving kernel extensions are kernel panics where “you need to restart your machine”.
If you are experiencing problems, it is important to remove these 3rd party kernel extensions to clearly identify the cause of the problem. This must be done even if the extensions seem harmless or are necessary for what you need to do. Aside from misbehaving 3rd party kernel extensions, one of the most likely causes of kernel panics are hardware faults. If you do have a hardware problem, you need to eliminate any possible software suspects, and then get your machine repaired while it is still under warranty. Don’t wait to investigate kernel panics. Once your problem is resolved, you can reinstall any 3rd party kernel extensions you need. Finally, it is important to use the official, vendor-provided uninstaller or uninstallation instructions to remove this low-level software. Simply deleting files may leave your system in a worse state than when you started.
- System Launch Agents:
These are any low-level, Apple-provided parts of your operating system. Any failure that appears here may indicate a problem with your system. No 3rd party software should be listed here. That would a different problem. EtreCheck just lists the total number of tasks not loaded, loaded, and running.
- System Launch Daemons:
Same as above.
- Launch Agents:
Same as above, but for 3rd party software. It is common for software to use 3rd party launch daemons. However, this software is always running in the background. The primary use of this information is to identify any 3rd party system modifications that are running in the background. Pay attention to install dates to see if they correspond to when you started having problems.
- Launch Daemons:
Same as above.
- User Launch Agents:
Similar to the above. The biggest difference is that this software runs under your normal user account instead of as the super-user.
- User Login Items:
These are programs that start as soon as your login to the computer. If there are many items, you can run out of memory.
- <various> Plug-ins:
These items could impact your web browsing or other areas.
- Safari Extensions:
This section lists all 3rd party extensions to the Safari web browser. Unfortunately, EtreCheck is only able to check Safari. Furthermore, Apple has made this information increasingly hard to find. EtreCheck’s list of Safari extensions may be incorrect. If you use Google Chrome, Firefox, or Opera, you will have to manually check extensions in those browsers.
- Time Machine:
Your Time Machine information.
- Performance:
Your machine’s overall system load, file system performance, and hard drive performance. Ideally, system load should be a low, single digit. File system performance should be 60 seconds or less. Hard drive performance depends on what kind of internal hard drive you have. Mechanical hard drives should be at least 60 MB/s. An older SSD should be over 400 MB/s. Apple’s latest SSDs should report 3000 MB/s or higher. These values can fluctuate. You may need to run EtreCheck a few times to get a consistent reading.
- CPU Usage:
Your overall CPU usage. Normally, this will be very low because modern Macs can have 8 or more CPU cores.
- Top Processes by CPU:
These are the processes that are currently using the majority of your processing capacity. This is why it is best to run EtreCheck while your computer is running slowly.
- Top Processes by Memory:
Same as above, but for memory utilization.
- Top Processes by Network use:
Same as above, but for network usage.
- Top Processes by Energy use:
Same as above, but for energy usage.
- Virtual Memory Information:
Similar to the above. Again, this information is most useful if you haven’t restarted recently. It is important not to make any assumptions about this data. A low level of free RAM is not necessarily a problem. The operating system tries to make the best use out of the memory you have given it. Unused RAM is wasted RAM. The most important section here is Swap Used. If your machine is consistently having gigabytes of Swap Used you probably don’t have enough RAM for the software you are using. If you have a mechanical hard drive, Swap Used can make your machine extremely slow.
- Software Installs:
A list of software recently installed. Note that adware and some scam-ware may not be listed. Pay attention to install dates to see if they correspond to when you started having problems.
- Clean up:
These are launchd config files that point to software that cannot be found. Usually this is the result of attempting to uninstall software by hand. Uninstalling software on a Mac can be difficult or impossible. Always use vendor-provided uninstallers or uninstallation instructions. Never use an “app zapper”. Never try to delete files from hidden directories by hand. But if you try, this section can help. Note: Items listed here do not cause any problems with your machine. They only clutter up your EtreCheck report. Using the “clean up” feature will “clean up” your EtreCheck report but will not fix any problem or speed up your machine.
- Diagnostics Information:
Any log files relating to application or system crashes. Any useful information from the log files is extracted and printed. This information is not available if you run your machine under a “Standard” user account. If you run under a “Standard” user account, it may be best to run another EtreCheck report under an “Administrator” account to collect this information.
Disclaimer: EtreCheck is free but does have in-app purchases available. Additionally, there are other links on my site that could give me some form of compensation, financial or otherwise.
Note: You do not need to purchase anything to use EtreCheck. It was designed to generate a report that you can use to get help here in Apple Support Communities. Click on the “Share” button in EtreCheck’s toolbar to copy your EtreCheck report to the clipboard. Then use the “Note” control at the bottom of an Apple Support Communities’ Edit Window to post your EtreCheck report.
If you want to run EtreCheck more often to learn more about your Mac, you may find the Power User package useful. If you don’t want to post a message here on Apple Support Communities, the Power User package can also provide a computer-generated solution. This solution is designed to be the same kind of information that someone might post in reply to your EtreCheck report if you did post it here on Apple Support Communities. A human is probably going to be able to understand your EtreCheck report better than any algorithm - and they will do it for free.
