Quick Guide

Process Details: Threads

Threads are displayed with the following color coding:
- a thread is currently running.
- a thread is waiting on I/O in a system call (uninterruptible).
- a thread is halted or stopped.
- a thread is suspended.
- a thread is idle (sleeping).
- thread state is unknown.

A small 'i' in thread state column indicates that the thread is running an idle loop (used for putting a CPU core into sleep mode). Such threads can be seen in the kernel task.

Process Details: Open Files & Sockets

Open file descriptors are displayed with the following color coding:
- this is a regular file.
- this is a network socket (TCP or UDP).
- this is a UNIX pipe.
- this is a UNIX socket or a kernel queue.
- this is a kernel control descriptor.
- this is a kernel event descriptor.

Process Details: Mach Ports

Open ports are displayed with the following color coding:
- this port has SEND and RECEIVE rights.
- this port has a RECEIVE right.
- this port has a SEND right.

Process Details: Loaded Modules

Loaded modules are displayed with the following color coding:
- this module is loaded from a .dylib file. Mapped size and reference count are provided.
- this module is loaded from the dynamic library cache – a large file where all built-in system libraries (private and public) are combined to improve performance.