macOS Kernel – How to Identify Files and Programs Connected to the kernel_task Process

kernelmacos

I understand that the kernel_task process is linked to several .kext files found in System/Library/Extensions (and possibly Library/Extensions ?) How can I identify which files are contributing to the 400+ MB memory usage identified in Activity Monitor? Is there anything I can do to uninstall or delete unneeded processes to reduce memory usage here?

Best Answer

I looked for some generic commands that display/manipulate kernel extensions. kextstat got my attention and based on its output, the 4th column is

The number of bytes of kernel memory that the kext occupies. If this is zero, the kext is a built-in part of the kernel that has a record as a kext for resolving dependencies among kexts.

The only problem was that its size was in hexadecimal. So I converted the hexadecimal to decimal and printed only relevant information (like kext bundle id).

kextstat -l -k | awk '{n = sprintf("%d", $4); print n, $6}' | sort -n

Breaking it down:

  • kextstat -l -k - print a list of loaded non-built-in kexts
  • | awk '{n = sprintf("%d", $4); print n, $6}' - pipe the output to awk, convert the 4th "size" column from hexadecimal to decimal, print that and the kext bundle id.
  • | sort -n - pipe the output to sort command and sort the list using numerical comparison (so that "10" is not less than "1 ").

You can pipe the output to tail -n 3 to get top 3 memory hoggers. Here are mine:

1757184 com.apple.nvidia.driver.NVDAGK100Hal
2572288 com.apple.nvidia.driver.NVDAResman
3923968 com.apple.driver.AirPort.Brcm4360

Update: you can also pipe this to grep -v com.apple to see which non-apple kexts are loaded.

Related Question