gtyoung10

Q: What is process cfprefsd in Activity Monitor?

What is process cfprefsd in Activity Monitor?  It is being run by user _spotlight, root, and my admin login?

MacBook, OS X Mountain Lion (10.8.3)

Posted on Apr 9, 2013 7:22 PM

Close

Q: What is process cfprefsd in Activity Monitor?

  • All replies
  • Helpful answers

Page 1 Next
  • by Kappy,

    Kappy Kappy Apr 9, 2013 7:27 PM in response to gtyoung10
    Level 10 (270,831 points)
    Desktops
    Apr 9, 2013 7:27 PM in response to gtyoung10

    cfprefsd provides preferences services for the CFPreferences and NSUserDefaults APIs.

     

      There are no configuration options to cfprefsd manually.

     

    From OS X man pages.

  • by gtyoung10,

    gtyoung10 gtyoung10 Apr 9, 2013 7:30 PM in response to Kappy
    Level 1 (0 points)
    Apr 9, 2013 7:30 PM in response to Kappy

    I am worried about being hacked.  I know nothing about computers and trying to figure everything out. 

  • by Kappy,

    Kappy Kappy Apr 9, 2013 7:36 PM in response to gtyoung10
    Level 10 (270,831 points)
    Desktops
    Apr 9, 2013 7:36 PM in response to gtyoung10

    You aren't being hacked by that process. It's quite legitimate.

  • by gtyoung10,

    gtyoung10 gtyoung10 Apr 16, 2013 5:37 PM in response to Kappy
    Level 1 (0 points)
    Apr 16, 2013 5:37 PM in response to Kappy

    It's running now by user _lp which I've never seen before.  There are five processes run by this cfprefsd by different users???

  • by Kappy,

    Kappy Kappy Apr 16, 2013 8:25 PM in response to gtyoung10
    Level 10 (270,831 points)
    Desktops
    Apr 16, 2013 8:25 PM in response to gtyoung10

    Those are system usernames.

  • by gtyoung10,

    gtyoung10 gtyoung10 Apr 18, 2013 6:27 PM in response to Kappy
    Level 1 (0 points)
    Apr 18, 2013 6:27 PM in response to Kappy

    Why does cfprefsd run with 4 or 5 username like _Ip and sometimes it only runs on 3?  I don't understand that.

  • by shldr2thewheel,

    shldr2thewheel shldr2thewheel Apr 18, 2013 6:33 PM in response to gtyoung10
    Level 7 (25,881 points)
    Apr 18, 2013 6:33 PM in response to gtyoung10

    you are worried about nothing. stop over thinking things and enjoy using your mac,

  • by Kappy,Solvedanswer

    Kappy Kappy Apr 18, 2013 6:35 PM in response to gtyoung10
    Level 10 (270,831 points)
    Desktops
    Apr 18, 2013 6:35 PM in response to gtyoung10

    Each time it is used and launched by a different process it launches under a different specific system username. That's all there is to it.

  • by JSFapple,

    JSFapple JSFapple Jun 4, 2013 7:56 AM in response to gtyoung10
    Level 1 (0 points)
    Jun 4, 2013 7:56 AM in response to gtyoung10

    Hmmm. If I were a hacker and I didn't want people identifying these processes as hacks, I might tell people not to worry about it, too.  Just saying.

  • by LenTS,

    LenTS LenTS Aug 3, 2013 11:33 AM in response to JSFapple
    Level 1 (0 points)
    Aug 3, 2013 11:33 AM in response to JSFapple

    Totally agree. cfprefsd is showing up in activity monitor under all my account names, even ones that I have not logged in. I do not recall seeing this before. Also, my mac has become slow and unresponsive, without showing anything in activity monitor. My guess would be that as Apple moves towards a major release of OS X it has let into its software updates something that is causing this behavior because I've got waaay more processes running lateley than I used to. Course, I could have been hacked in some bizarre way

  • by Traderhut,

    Traderhut Traderhut Sep 4, 2013 3:47 PM in response to LenTS
    Level 1 (0 points)
    Sep 4, 2013 3:47 PM in response to LenTS

    I'm seeing this show up using 1GB of RAM, now you can tell me "oh, don't worry about it.", but ANYTHING taking 1GB of ram under the username 'nobody' is a RED FLAG to me!

     

    Sure, I still have 4GB of free mem (Apple lied about how much RAM these MacBook Pro's can use - I started running 16Gb and OMG it is nicer!  I was swapping at 8.5GB normally used, and now I've swapped a total of 78 *MB* in the last 2 weeks that I've been running this way.  Not sure why it would have ever gotten that high..

     

    But, processes like this one, run from launchd taking 1GB of ram could have sucked down all the RAM and caused the swapping or something.

     

       -Traderhut Games.  (iPhone games developer.)

  • by Traderhut,

    Traderhut Traderhut Sep 4, 2013 3:49 PM in response to Traderhut
    Level 1 (0 points)
    Sep 4, 2013 3:49 PM in response to Traderhut

    OOPS, misread the screen.  the screen showed "1,004" KB is the size of the app, so 1 MB, not 1GB of RAM.

     

    Still, who ran 'nobody' and who is 'nobody'?  If it is a real user, give it a real name.  If it is used by a system service, name it the name of the service.

     

      -Traderhut Games

  • by Pondini,

    Pondini Pondini Sep 5, 2013 2:52 AM in response to Traderhut
    Level 8 (38,747 points)
    Sep 5, 2013 2:52 AM in response to Traderhut

    That's one of many system user names, several rather cryptic.

     

    There's no indication of any hacking.

     

    See this thread: deleted user nobody

     

    Then let it go.

  • by Peter Crocker,

    Peter Crocker Peter Crocker Jan 28, 2015 6:45 AM in response to gtyoung10
    Level 1 (4 points)
    Mac OS X
    Jan 28, 2015 6:45 AM in response to gtyoung10

    For the record, cfprefsd is a fundamental part of the MacOS operating system. It's a tool developers use when they write their application, and allows an application to read/write/modify preferences files (like files ending in .plist, and others). MacOS couldn't work without it.

     

    So the more relevant question is which specific application is calling on cfprefsd to do something on it's behalf. This becomes a unix/MacOS lesson, about what unix utilities are at your disposal to look at the inner workings of applications as they run and interact with MacOS. For example, look at the command line tool called "fs_usage", it's one of many tools. Activity Monitor has some tools as well. But be prepared to have to learn loads about how unix-based OS's work to make sense of it.

     

    So in summary, seeing cfprefsd in Activity Monitor is normal, as just about any app could be interacting with it. If a hacker was trying to get in to your system, they wouldn't be leaving around obvious traces like preference files...

     

    More references:

    https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man8/cfprefsd.8.html

    Which leads to this:

    https://developer.apple.com/library/mac/documentation/CoreFoundation/Reference/C FPreferencesUtils/index.html

Page 1 Next