Using EtreCheck

Version 2
Last Modified: Feb 11, 2014 11:21 AM

About EtreCheck

Download EtreCheck


EtreCheck is a tool I wrote to help people on Apple Support Communities remotely debug problems with people’s computers. That can be a difficult task even when the machine is in front of you. Attempting it over an internet discussion forum is extremely difficult.


I strongly suggest that you post new questions here on Apple Support Communities with your EtreCheck results rather than e-mailing me directly. While I don't mind answering e-mails, there is no way that I can provide assistance that is as accurate or as timely as all of the people here on Apple Support Communities. The more exposure your problem can get, the greater the chance that someone will recognize your problem and contribute a solution.


EtreCheck is not an authoritative guide. It is more of a general overview of the state of your Mac. It is unlikely that any one entry really has any meaning. The idea is that the results, taken as a whole, will help to identify what is making your Mac run slowly or have kernel panics. As EtreCheck has grown more popular, I have added more information and it has gotten to the point that it needs some explanation.


EtreCheck mainly just runs the command-line version of the System Profiler tool and reports those results in more human readable form. It also tries to identify known problems. Finally, it consolidates all of this information into a story about all of the software that is running behind the scenes on your Mac. Some of that software may not be running nicely.


The following is an explanation of each non-obvious section of EtreCheck results:


  • Hardware Information:
    Basic Information about your machine. The number of processors, cores, and RAM. This section connects to Apple support servers to return the ”marketing name” of your machine that Apple now uses.
  • System Software:
    Your operating system version, including specific build version. Also reports the time since your machine has been rebooted. EtreCheck results will be more valuable if you run it before rebooting. It should take a snapshot of your machine while it is encountering whatever problem causes you to want to run EtreCheck.
  • Disk Information:
    This may include several hidden volumes used for startup and recovery. The most useful information here is the amount of free space on your startup volume. If it is too low, your machine has to do more work to keep enough free space to work with. If it drops to critically low levels, your machine may crash.
  • Kernel Extensions:
    Lists any 3rd party kernel extensions. These extensions actually modify your operating system. May may be necessary for software you want to run. However, because they run deep within the core of the operating system, they can destabilize your system. The most common result from misbehaving kernel extensions are kernel panics where “you need to restart your machine”.
    If you are experiencing problems, it is important to remove these 3rd party kernel extensions to clearly identify the cause of the problem. This must be done even if the extensions seem harmless or are necessary for what you need to do. Aside from misbehaving 3rd party kernel extensions, one of the most likely causes of kernel panics are hardware faults. If you do have a hardware problem, you need to eliminate any possible software suspects, and then get your machine repaired while it is still under warranty. Don’t wait to investigate kernel panics. Once your problem is resolved, you can reinstall any 3rd party kernel extensions you need. Finally, it is important to use the official, vendor-provided uninstaller or uninstallation instructions to remove this low-level software. Simply deleting files may leave your system in a worse state than when you started.
  • Problem System Launch Daemons:
    These are any low-level, Apple-provided parts of your operating system. Any failure that appears here may indicate a problem with your system. No 3rd party software should be listed here. That would a different problem.
  • Problem System Launch Agents:
    Same as above.
  • Launch Daemons:
    Same as above, but for 3rd party software. It is common for software to use 3rd party launch daemons. However, this software is always running in the background. The primary use of this information is to identify various types of "clean up" or scamware software that you really don’t need.
  • Launch Agents:
    Same as above.
  • User Launch Agents:
    Similar to the above. The biggest difference is that this software runs under your normal user account instead of as the super-user. Double-check this information for e-mail addresses and personal names. For some reason, software developers like to use private information as part of the file name in this section. EtreCheck tries to redact this information in some cases. Finally, there are some security implications with this section. While the Mac is not vulnerable to the types of viruses that people associate with Windows machines, this is one of the few places that Mac malware can install software. If there are any hidden files here, EtreCheck will report them and identify what they are doing. Sometimes this is completely legitimate, as with watched folders from Automator.
  • User Login Items:
    These are programs that start as soon as your login to the computer. If there are many items, you can run out of memory.
  • Internet Plug-ins:
    These items could impact your web browsing.
  • Old Applications:
    These are applications built for a much older version of OS X than you are currently running. There may be new versions of the applications available. If not, these applications may have been abandonned. Any applications listed here may be missing out on modern features of the operating system. You may need to look for newer, alternative applications. These applications may not run correctly if you update your operating system. If this is the case, you may need to export any document created by these applications to a portable format because you may not be able to open them in the future.
  • Time Machine:
    Time Machine is a complex system. It is primarily intended to alert people who aren’t even using Time Machine or whose backup drive may be too small. If you are already a heavy user of Time Machine, then this section may not be very useful.
  • Top Processes by CPU:
    These are the processes that are currently using the majority of your processing capacity. This is why it is best to run EtreCheck while your computer is running slowly. EtreCheck samples this data several times to correctly identify the processes using the most of your CPU.
  • Top Processes by Memory:
    Same as above, but for memory utilization.
  • Virtual Memory Information:
    Similar to the above. Again, this information is most useful if you haven’t restarted recently. It is important not to make any assumptions about this data. A low level of free RAM is not necessarily a problem. The operating system tries to make the best use out of the memory you have given it. Unused RAM is wasted RAM. The most important section here is Page-outs. If your machine is consistently making gigabytes of Page-outs you probably don’t have enough RAM for the software you are using.


Note: While EtreCheck has been reported to work on Snow Leopard, it is not supported on that version of OS X. Some features are known not to work.


Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.