MacOS – OSX – find out what starts a process

Check with this command (will show more processes):

sudo ps -awxm -o %mem,rss,comm | sort -nr | head

if won't help, check with fs_usage to display system calls and page faults related to filesystem:

sudo fs_usage -f filesys,diskio

especially page in and out by appending the following to above command:

| egrep -i "page_|pgin|pgout"

^{Add extra | grep -v kernel to ignore kernel process or | grep -v 0.00 to show these with higher time spent.}

If your swap is big, you can force disk cache to be flushed and emptied by: sudo purge.

Based on my experience, OS X have some issues with managing the memory after higher uptime (when it used all of free memory), so sometimes only full restart may help.

Check also sudo iotop or sudo vm_stat 1 commands which may help.

See also: How to investigate high kernel task memory usage?

You can grep the output of launchctl list for the pid:

$ pgrep -fl foo
40679 bash /tmp/foo
$ launchctl list|grep 40679
40679   -   com.example.foo

Then for example look for a file named com.example.foo.plist in ~/Library/LaunchAgents/, /Library/LaunchAgents/, or /Library/LaunchDaemons/.

Edit: the Disabled key can be overridden in /var/db/launchd.db/com.apple.launchd/overrides.plist, which is modified when launchctl load -w is run as root, or in /var/db/launchd.db/com.apple.launchd.peruser.$UID/overrides.plist, which is modified when launchctl load -w is run as the user.

If the Apache plist that comes with OS X was enabled, you can disable it by running sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist.