Skip to content
ProcessSpy Docs

Inspector Pane

Bottom pane shows detailed information about the selected process in the main table. It consists of multiple sections grouped by categories:

General

Section titled “General”

Identity and Time

Section titled “Identity and Time”
  • Name
  • PID
  • Start Time
  • Run Time
  • Last Seen (for finished processes, when the process was last observed before finishing)

Process Details

Section titled “Process Details”
  • Bundle ID
  • Main Executable (license only)
  • Format (license only)
  • Startup Entry (license only)
  • Launched By - shows the process which launched the given process. Taken from Parent ASN field in the process information. This can be different from the parent process shown in the Hierarchy section as it represents the process that directly launched the given process. Evaluated for GUI applications.

Security

Section titled “Security”
  • Sandboxed - shows whether the process is running with App Sandbox enabled.
  • Hardened - shows whether the process is using Apple’s Hardened Runtime security feature.
  • Signature
    • collapsed state: Signing Organization
    • expanded state: Detailed signature information about Issuer and Subject fields

Resource Usage

Section titled “Resource Usage”
  • CPU % - current CPU usage in percent. For multi-core systems, this value can exceed 100% with a maximum of (number of cores * 100)%.
  • CPU Time - total CPU time used by the process since it started in hh:mm:ss format
  • Memory - shows Resident Memory in bytes. Resident Memory is the portion of memory occupied by a process that is held in RAM. Equals to Real Mem in Activity Monitor.
  • Footprint - shows the memory footprint of the process in bytes. This is the amount of RAM currently used by the process, including compressed memory. Equals to Memory in Activity Monitor.
  • Threads

Disk I/O Activity

Section titled “Disk I/O Activity”
  • Read - total bytes read by the process since it started
  • Read per second - bytes read per second by the process
  • Written - total bytes written by the process since it started
  • Written per second - bytes written per second by the process

Hierarchy

Section titled “Hierarchy”
  • Parent process (Name and PID)
    • Parent is determined based on Parent PID or Responsible PID if Parent PID is not available.
  • Child processes (Name and PID)

Command

Section titled “Command”

Full command used to start the process including command line arguments.

Files

Section titled “Files”

File descriptors of type PROX_FDTYPE_VNODE opened by the process including Index and Path.

Right click on a file entry opens a context menu with the following items:

  • Show in Finder
  • Open With (generates a list of available applications to open the given file type)
  • Copy Path - copies full path to clipboard

Connections

Section titled “Connections”

File descriptors of type PROX_FDTYPE_SOCKET opened by the process including Local Address, Remote Address, Protocol and State.

Right click on a connection entry opens a context menu allowing to copy source or destination address to clipboard.

Dylibs

Section titled “Dylibs”

Loads dynamic libraries using the external tool vmmap. Shows file Path.

Right click on a dylib entry opens a context menu allowing to copy the path to clipboard or reveal the file in Finder.

Env Vars

Section titled “Env Vars”

Shows environment variables set for the process in KEY=VALUE format. Supports text search.

Entitlements

Section titled “Entitlements”

Shows entitlements of the process in JSON format. Supports text search.

Info.plist

Section titled “Info.plist”

Shows contents of the Info.plist file of the process in KEY=VALUE format. Supports text search.

History

Section titled “History”

When process history recording is enabled, shows historical values of CPU %, Resident Memory and Virtual Memory over time. See History recording for more information.