activity monitor

When I look at the Activity Monitor processes list on my Mac (which is running Ventura),

• I see many processes owned by the user root. On Unix systems, root is the name of the superuser, and root processes run with full privileges to control the machine. Many of these processes have names that suggest which part of macOS they represent, like "storagekitd" (Storage Kit daemon), "fseventsd" (Filesystem Events daemon), "usbd" (USB daemon), and so on. The trailing "d", for "daemon", is an old BSD Unix convention for naming processes (especially system processes) that are meant to hang around running in the background.
• I also see a number of user names that begin with "_". Three of these "_" users are _spotlight, _coreaudiod, and _nsurlsessiond (as in "ns" for NextStep, one of the OSes Apple used to create Mac OS X, plus "url" as in Uniform Resource Locator; plus "session"; plus "d" as in "daemon"). Spotlight, Core Audio, and Web services are all parts of macOS, so these particular user names do not look especially alarming.
• There appear to be something like 31 – 32 unique user names beginning with "_". At the moment. There may be others that would show up if I turned on more services in System Settings.

My guess is that most of the time, if you see a user name in Activity Monitor that begins with a "_", you're looking at an internal user created by macOS. My guess is that in these cases, the corresponding code is running with fewer privileges than it would get if it was running as root. Thus the plethora of user names very likely reflects an effort to isolate some parts of the system for security hardening reasons.

I think what is going on is that the OP is seeing lots and lots of normal system and applications processes listed in Activity Monitor. Some of them may even be running under special user names created solely for them, reflecting Apple’s attempts to partition off some parts of the operating system and run those parts with reduced privileges.

Someone with no software development background might have a hard time figuring out which processes and user names are legitimate, and might become alarmed even if their system had not been compromised and there was nothing to worry about.

Conniechung wrote:

thank you. My issue was not so much the root ones or things like that the _nearby and some others especially when I see so much activity running when I don’t have anything open , after ing having done force quit, turned off my wifi and Bluetooth etc. I understand things are always running in the background servicing but to have triple digit KBs active with users other than myself and Apple associated ones running seemed suspect. Not that I have too much sensitive but I still don’t need someone coming in and looking at my cat’s veterinary files- he’s a very private feline 😼

If I tell Activity Monitor to show "Other User Processes" (View > Other User Processes), and sort by the Memory column, I only see three processes owned by "_" users that are taking up more than 10 MB of memory.

These are:

• WindowServer (owned by "_windowserver") – 657.5 MB
• coreaudiod (owned by "_coreaudiod") – 31.1 MB
• softwareupdated (owned by "_softwareupdate") – 19.2 MB

There are a lot of processes taking up about 1 MB – 5 MB of memory each.

Sorry, but that is just not enough information in order for us to be able to assist you with a potential solution.

• Writing an effective Apple Support Communities question - Apple Support Communities