Currently Being Moderated

Using EtreCheck

About EtreCheck

Download EtreCheck


EtreCheck is a tool I wrote to help people on Apple Support Communities remotely debug problems with people’s computers. That can be a difficult task even when the machine is in front of you. Attempting it over an internet discussion forum is extremely difficult.


I strongly suggest that you post new questions here on Apple Support Communities with your EtreCheck results rather than e-mailing me directly. While I don't mind answering e-mails, there is no way that I can provide assistance that is as accurate or as timely as all of the people here on Apple Support Communities. The more exposure your problem can get, the greater the chance that someone will recognize your problem and contribute a solution.


EtreCheck is not an authoritative guide. It is more of a general overview of the state of your Mac. It is unlikely that any one entry really has any meaning. The idea is that the results, taken as a whole, will help to identify what is making your Mac run slowly or have kernel panics. As EtreCheck has grown more popular, I have added more information and it has gotten to the point that it needs some explanation.


EtreCheck mainly just runs the command-line version of the System Profiler tool and reports those results in more human readable form. It also tries to identify known problems. Finally, it consolidates all of this information into a story about all of the software that is running behind the scenes on your Mac. Some of that software may not be running nicely.


The following is an explanation of each non-obvious section of EtreCheck results:


  • Hardware Information:
    Basic Information about your machine. The number of processors, cores, and RAM. This section connects to Apple support servers to return the ”marketing name” of your machine that Apple now uses. This section also includes handy links Apple's Technical Specifications, User Guide, and Warranty & Service options for your machine.
  • Video Information:
    Your video cards, VRAM amounts, and attached displays.
  • System Software:
    Your operating system version, including specific build version. Also reports the time since your machine has been rebooted. EtreCheck results will be more valuable if you run it before rebooting. It should take a snapshot of your machine while it is encountering whatever problem causes you to want to run EtreCheck.
  • Disk Information:
    This may include several hidden volumes used for startup and recovery. The most useful information here is the amount of free space on your startup volume. If it is too low, your machine has to do more work to keep enough free space to work with. If it drops to critically low levels, your machine may crash.
  • Possible adware:
    This section lists any software that is known adware or unknown software that needs to be researched. Because adware has become such a problem, EtreCheck will help you to disabled any adware in this section by clicking on the “Remove/Report” button. Please note that EtreCheck will NOT uninstall adware. It merely disables it. Other adware removal software may report an infection and offer to remove the adware.
  • Clean up:
    These are launchd config files that point to software that cannot be found. Usually this is the result of attempting to uninstall software by hand. Uninstalling software on a Mac can be difficult or impossible. Always use vendor-provided uninstallers or uninstallation instructions. Never use an “app zapper”. Never try to delete files from hidden directories by hand. But if you try, this section can help. Note: Items listed here do not cause any problems with your machine. They only clutter up your EtreCheck report. Using the “clean up” feature will “clean up” your EtreCheck report but will not fix any problem or speed up your machine.
  • Kernel Extensions:
    Lists any 3rd party kernel extensions. These extensions actually modify your operating system. Many may be necessary for software you want to run. However, because they run deep within the core of the operating system, they can destabilize your system. The most common result from misbehaving kernel extensions are kernel panics where “you need to restart your machine”.
    If you are experiencing problems, it is important to remove these 3rd party kernel extensions to clearly identify the cause of the problem. This must be done even if the extensions seem harmless or are necessary for what you need to do. Aside from misbehaving 3rd party kernel extensions, one of the most likely causes of kernel panics are hardware faults. If you do have a hardware problem, you need to eliminate any possible software suspects, and then get your machine repaired while it is still under warranty. Don’t wait to investigate kernel panics. Once your problem is resolved, you can reinstall any 3rd party kernel extensions you need. Finally, it is important to use the official, vendor-provided uninstaller or uninstallation instructions to remove this low-level software. Simply deleting files may leave your system in a worse state than when you started.
  • System Launch Agents:
    These are any low-level, Apple-provided parts of your operating system. Any failure that appears here may indicate a problem with your system. No 3rd party software should be listed here. That would a different problem. Usually, EtreCheck just lists the total number of tasks not loaded, loaded, and running.
  • System Launch Daemons:
    Same as above.
  • Launch Agents:
    Same as above, but for 3rd party software. It is common for software to use 3rd party launch daemons. However, this software is always running in the background. The primary use of this information is to identify any 3rd party system modifications that are running in the background.
  • Launch Daemons:
    Same as above.
  • User Launch Agents:
    Similar to the above. The biggest difference is that this software runs under your normal user account instead of as the super-user. Double-check this information for e-mail addresses and personal names.
  • User Login Items:
    These are programs that start as soon as your login to the computer. If there are many items, you can run out of memory.
  • Internet Plug-ins:
    These items could impact your web browsing.
  • Safari Extensions:
    This section lists all 3rd party extensions to the Safari web browser. Unfortunately, EtreCheck is only able to check Safari. If you use Google Chrome, Firefox, or Opera, you will have to manually check extensions in those browsers.
  • Top Processes by CPU:
    These are the processes that are currently using the majority of your processing capacity. This is why it is best to run EtreCheck while your computer is running slowly. EtreCheck samples this data several times to correctly identify the processes using the most of your CPU.
  • Top Processes by Memory:
    Same as above, but for memory utilization.
  • Virtual Memory Information:
    Similar to the above. Again, this information is most useful if you haven’t restarted recently. It is important not to make any assumptions about this data. A low level of free RAM is not necessarily a problem. The operating system tries to make the best use out of the memory you have given it. Unused RAM is wasted RAM. The most important section here is Page-outs. If your machine is consistently making gigabytes of Page-outs you probably don’t have enough RAM for the software you are using.
  • Diagnostics Information:

Any log files relating to application or system crashes. This information is not available if you run your machine under a “Standard” user account. If you run under a “Standard” user account, it may be best to run another EtreCheck report under an “Administrator” account to collect this information.


Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.


  • 0 Replies:

Delete User Tip

Are you sure you want to delete this user tip?