Mac’s Hidden Daemons: Should You Be Exorcising ‘cfprefsd’ and ‘cloudd’?

The Mac, and for that matter most computing platforms, are just chock full of daemons. Daemons, not to be confused with demons, are usually small programs that run in the background with no direct interaction with the computer user. They are often used to implement or help provide a service that operating systems or applications need.

The word daemon comes from an ancient Greek belief, and is used to describe a supernatural being that works on tasks between the gods and man. If we replace man with computer user, and gods with the operating system or applications, we get a reasonable idea of what all these Mac daemons are doing: performing repetitive tasks that provide a service to the operating system, an app, or the user.

Activity Monitor and Daemons
Daemons have no visible interface; they run in the background and are usually independent of other apps and programs. That makes them hard for the user to directly interact with, or even know they’re present. But without them, your Mac would likely grind to a halt or freeze up, possibly without even displaying the usual spinning beach ball of doom.

For the most part, daemons should be left alone; they’re perfectly happy performing their assigned tasks. But if you’re curious, you can use Activity Monitor, an app included with the Mac, to see how the various daemons, and other programs that are running, are making use of your Mac’s resources.

In this example, we’re going to use Activity Monitor to look at what two common Mac daemons are up to: “cfprefsd” and “cloudd.” We chose these two daemons because there have been a few questions floating around the Internet about what they do, as well as questions about these daemons using excessive resources.

You may notice that our two daemons have names that end with a “d.” This is a developer convention, where all daemons’ names should end with a “d.” Just as important, the rest of the daemon name should loosely describe its function. If we apply this developer logic to our two example daemons we come up with:

cfprefsd: A background process (a daemon because of the d at the end of the name) having something to do with cfprefs. Scratching our heads a bit, we can guess that this daemon has something to do with preferences, and if we knew a bit more about Mac development, we could guess the cf stood for Core Foundation.

Launch Terminal, located at /Applications/Utilities, and enter the following at the Terminal prompt:

man cfprefsd

Terminal will tell us that, “cfprefsd provides preference services for the CFPreferences and NSUserDefaults APIs.” If we wanted to find out more, we could look up CFPreferences and NSUserDefaults in Apple Developer documentation. Essentially, cfprefsd helps an app or the system to read or write to preference files. When you open an app and change one of its preferences, it’s likely that cfprefsd is the daemon being asked to make the changes to the app’s preference file.

cloudd: A daemon having something to do with macOS cloud services. A little more investigating using Terminal and the technique we outlined above tells us that this is the daemon used by CloudKit, a developer’s API used to transfer data between an app and Apple’s iCloud service.

To check on this daemon’s activity, launch Activity Monitor, located at /Applications/Utilities.

When the Activity Monitor window opens, we’re going to be interested in the resources each daemon is making use of.

In the Activity Monitor window, select the CPU button in the toolbar.

You’ll see a long list of processes running on your Mac. You may notice a few daemons, processes whose names end with d, present in the list. But you probably won’t see cfprefsd or cloudd unless you scroll around a bit to find them. An easy way to see each daemon is to enter one of their names in the Search field in the top right corner of the Activity Monitor window.

For this example, enter cfprefsd in the search field.

Activity Monitor will list any matching process names that are running. You may see multiple daemons with the same name, indicating that multiple users (system, user, or other apps and processes) are making use of the daemon. In my case, I have three copies of the cfprefsd daemon running; one that my logged-in user is using, one the root user is using, and one that locationd (another daemon) is using.

The most important columns in Activity Monitor to examine are the %CPU and Threads columns. In this example, there is 0 CPU being used by any of the cfprefsd daemons, and only two threads in use.

If the %CPU or Threads count were high, and stayed high for a long period, that could indicate a problem with the daemon, or more likely, the app or process that is using it.

Select the Memory button in the Activity Monitor window.

Daemons generally do not use a great deal of memory for long periods of time. They can certainly need memory resources while actively performing their tasks, but usually for short durations. If you see a large amount of memory in use by a daemon, and it stays that way for a long period of time, you may have an issue with the app or process that is using the daemon.

Clear Activity Monitor’s search field to see the full list of active processes. Or, you can enter the name cloudd to view the resources being used to support iCloud.

What to Do if a Daemon is Abusing Resources
First off, be patient; most daemons only use memory or processor resources for short durations. There are some exceptions; for instance with cloudd, if you’re syncing a large collection of files, memory resources could peak for a time while the transfers take place.

With cfprefsd, its task is fairly basic: reading and writing to preference files. If cfprefsd is using excess resources, chances are a corrupt plist fileis causing the issue; or, if you have recently installed or updated an app, it may be modifying its plist files. As with the cloudd daemon, it’s a good idea to wait and see if the resource usage subsides.

If CPU or memory usage remains high for the daemon in question, you may want to quit the app that is suspected to be using the daemon. However, figuring out which app is the cause can be very difficult, unless you happen to notice the issue occur after launching an app or using a specific feature in an app.

Which brings us to the question: should you use Activity Monitor to kill the daemon? Generally the answer is no; many daemons will re-spawn when needed, but some require specific parent tasks to initialize and launch them. In some cases, these parent tasks are only run when your Mac starts up or a new user logs in. Killing a daemon could have unexpected consequences, including freezes and general slowdowns.

If you feel the need to kill a daemon, an alternate choice would be to gracefully close all running apps to see if this clears the problem. If not, try restarting your Mac.

I Really Want to Exorcise the Daemon…
OK, but you’ve been warned:

Launch Activity Monitor, and select either the CPU or Memory button in the toolbar.

Located the daemon you wish to kill in the Process list. You may find entering the daemon’s name in the search field a quicker way to find it.

Highlight the daemon in the list by clicking on its name.

Click the Quit button (it looks like a circle with an X in it), or select Quit Process from the View menu.

A sheet will drop down, asking if you’re sure you want to quit the selected process. Click the Quit button.

If the daemon fails to quit, you may need to repeat the process and instead click the Force Quit button in the sheet that drops down.

Final Word on Mac Daemons
If there are other daemons you have questions about, remember you can use the Terminal “man” command to find out what task a system daemon is designed to do, the Apple Developer documentation websiteto look up functions listed in the daemon’s man page, and Activity Monitor, to determine how much the daemon is impacting your Mac’s resources.

Other Topics You Might Like:

Watch ‘A New Hope’, Play Tetris Directly from a Mac’s Terminal Safe Mode & Single-User Mode: What They Are, How to Use Them Access Your Hidden Library Folder With These Five Easy Tricks Rocket Yard Guide: How Two-Factor Authentication for Apple ID Works