Get told when something stays busy
Read what Diagnostics noticed, jump to that moment, and switch on notifications for the patterns you care about.
- Time
- 5 minutes
- Steps
- 7
What you need
- l/Activity open, with Monitor on.
Steps
Step 1. Open Diagnostics
Press ⌘9. Diagnostics watches for patterns that last: load that stays high, memory that keeps growing, peaks that keep coming back. A short spike on its own never appears here.
The stage says how many of them deserve a look (Warning or Critical), counts the rest as Info, and places each one on a strip of the last hour.
DiagnosticsSustained pressure, recurring spikes, and changes worth investigating.Search or jump to…⌘KPauseRecordLast hour · Live10:42:181 observation worth a look.Most severe: CPU demand stayed high, a Warning detected 10:31:08.Critical 0Warning 1Info 23 observations in viewEach observation’s measured window on one clock · click one to jump to itInfoWarningCriticalDetectedWarning · CPUInfo · CPUInfo · Memory60 min ago45 min30 min15 minNowCPU2GPU—Memory1Disk—Network—Thermal—Counts by resource · last hourSeverityAllResourceAll resources3 recorded observationsExportClearObservationsNewest first · each describes correlation, not causeCPU demand stayed highWarningCPUDetected 10:31:0811m agoTotal Mac CPU remained at or above 90% for at least 30 seconds. Lumen Edit had the largest measured CPU use at detection; this is correlation, not proof of cause.Savable detail: 10:30:02–10:31:38 · 49 samples. Live history is bounded; save this window to keep it.Observed 10:30:31–10:31:08· 37sShow in timelineSave detail windowLumen Edit’s CPU demand stayed highInfoCPUDetected 10:30:1212m agoAll measured member lifetimes continuously used at least 100% of one CPU core for 30 seconds. 100% equals one core; useful work may use several cores.Savable detail: 10:29:10–10:30:42 · 47 samples. Live history is bounded; save this window to keep it.Observed 10:29:40–10:30:12· 32sShow in timelineSave detail windowKite Browser’s measured memory is growingInfoMemoryDetected 10:12:4629m agoThe same process lifetimes grew by 412 MB over 122 seconds. Growth can reflect useful work or caching; this observation does not establish a memory leak. Group totals can overlap shared pages.Savable detail: 10:12:20–10:13:16 · 29 samples. Live history is bounded; save this window to keep it.Observed 10:10:44–10:12:46· 2m 2sShow in timelineSave detail windowAutomatically save incident detailsKeep incident detailsOptional, local recordings of new observations
At detection, saves up to three minutes already retained. Limited to 16 incident recordings and 64 MiB of compressed payload, plus SQLite indexes and metadata. Captures stop at the limit; existing recordings are never automatically deleted.Patterns over timeObservations use continuous measured windows. Pausing, waking, missing readings, and process restarts break those windows.
Active rulesGPU: ≥80% device utilization for 30 secondsDisk throughput: ≥100 MiB/s for 30 secondsPhysical network throughput: ≥26.2144 MB/s for 30 secondsCPU: ≥90% of the Mac for 30 secondsMemory pressure: warning or critical for 20 secondsThermal: serious or critical for 30 secondsMemory growth: ≥256 MiB and ≥20% over 120 seconds with the same process lifetimesRecurring CPU: 3 separate peaks ≥80% of one core within 300 secondsApp CPU: ≥100% of one core for 30 secondsCorrelation, not causeApp attribution names the largest measured user at detection. Throughput does not establish saturation, growth does not establish a leak, and client GPU time does not partition device utilization.Step 01 Step 2. Read one observation
Each card says what was seen, how serious it is (Info, Warning or Critical), when it was detected and for how long it was observed. Read the wording closely: it names the app that was using the most at the time. That is a lead, not a verdict.
DiagnosticsSustained pressure, recurring spikes, and changes worth investigating.Search or jump to…⌘KPauseRecordLast hour · Live10:42:181 observation worth a look.Most severe: CPU demand stayed high, a Warning detected 10:31:08.Critical 0Warning 1Info 23 observations in viewEach observation’s measured window on one clock · click one to jump to itInfoWarningCriticalDetectedWarning · CPUInfo · CPUInfo · Memory60 min ago45 min30 min15 minNowCPU2GPU—Memory1Disk—Network—Thermal—Counts by resource · last hourSeverityAllResourceAll resources3 recorded observationsExportClearObservationsNewest first · each describes correlation, not causeCPU demand stayed highWarningCPUDetected 10:31:0811m agoTotal Mac CPU remained at or above 90% for at least 30 seconds. Lumen Edit had the largest measured CPU use at detection; this is correlation, not proof of cause.Savable detail: 10:30:02–10:31:38 · 49 samples. Live history is bounded; save this window to keep it.Observed 10:30:31–10:31:08· 37sShow in timelineSave detail windowLumen Edit’s CPU demand stayed highInfoCPUDetected 10:30:1212m agoAll measured member lifetimes continuously used at least 100% of one CPU core for 30 seconds. 100% equals one core; useful work may use several cores.Savable detail: 10:29:10–10:30:42 · 47 samples. Live history is bounded; save this window to keep it.Observed 10:29:40–10:30:12· 32sShow in timelineSave detail windowKite Browser’s measured memory is growingInfoMemoryDetected 10:12:4629m agoThe same process lifetimes grew by 412 MB over 122 seconds. Growth can reflect useful work or caching; this observation does not establish a memory leak. Group totals can overlap shared pages.Savable detail: 10:12:20–10:13:16 · 29 samples. Live history is bounded; save this window to keep it.Observed 10:10:44–10:12:46· 2m 2sShow in timelineSave detail windowAutomatically save incident detailsKeep incident detailsOptional, local recordings of new observations
At detection, saves up to three minutes already retained. Limited to 16 incident recordings and 64 MiB of compressed payload, plus SQLite indexes and metadata. Captures stop at the limit; existing recordings are never automatically deleted.Patterns over timeObservations use continuous measured windows. Pausing, waking, missing readings, and process restarts break those windows.
Active rulesGPU: ≥80% device utilization for 30 secondsDisk throughput: ≥100 MiB/s for 30 secondsPhysical network throughput: ≥26.2144 MB/s for 30 secondsCPU: ≥90% of the Mac for 30 secondsMemory pressure: warning or critical for 20 secondsThermal: serious or critical for 30 secondsMemory growth: ≥256 MiB and ≥20% over 120 seconds with the same process lifetimesRecurring CPU: 3 separate peaks ≥80% of one core within 300 secondsApp CPU: ≥100% of one core for 30 secondsCorrelation, not causeApp attribution names the largest measured user at detection. Throughput does not establish saturation, growth does not establish a leak, and client GPU time does not partition device utilization.Step 02 Step 3. Jump to the moment
Click Show in timeline. History opens at the time of detection with the named app selected, so you can see what else was going on.
DiagnosticsSustained pressure, recurring spikes, and changes worth investigating.Search or jump to…⌘KPauseRecordLast hour · Live10:42:181 observation worth a look.Most severe: CPU demand stayed high, a Warning detected 10:31:08.Critical 0Warning 1Info 23 observations in viewEach observation’s measured window on one clock · click one to jump to itInfoWarningCriticalDetectedWarning · CPUInfo · CPUInfo · Memory60 min ago45 min30 min15 minNowCPU2GPU—Memory1Disk—Network—Thermal—Counts by resource · last hourSeverityAllResourceAll resources3 recorded observationsExportClearObservationsNewest first · each describes correlation, not causeCPU demand stayed highWarningCPUDetected 10:31:0811m agoTotal Mac CPU remained at or above 90% for at least 30 seconds. Lumen Edit had the largest measured CPU use at detection; this is correlation, not proof of cause.Savable detail: 10:30:02–10:31:38 · 49 samples. Live history is bounded; save this window to keep it.Observed 10:30:31–10:31:08· 37sShow in timelineSave detail windowLumen Edit’s CPU demand stayed highInfoCPUDetected 10:30:1212m agoAll measured member lifetimes continuously used at least 100% of one CPU core for 30 seconds. 100% equals one core; useful work may use several cores.Savable detail: 10:29:10–10:30:42 · 47 samples. Live history is bounded; save this window to keep it.Observed 10:29:40–10:30:12· 32sShow in timelineSave detail windowKite Browser’s measured memory is growingInfoMemoryDetected 10:12:4629m agoThe same process lifetimes grew by 412 MB over 122 seconds. Growth can reflect useful work or caching; this observation does not establish a memory leak. Group totals can overlap shared pages.Savable detail: 10:12:20–10:13:16 · 29 samples. Live history is bounded; save this window to keep it.Observed 10:10:44–10:12:46· 2m 2sShow in timelineSave detail windowAutomatically save incident detailsKeep incident detailsOptional, local recordings of new observations
At detection, saves up to three minutes already retained. Limited to 16 incident recordings and 64 MiB of compressed payload, plus SQLite indexes and metadata. Captures stop at the limit; existing recordings are never automatically deleted.Patterns over timeObservations use continuous measured windows. Pausing, waking, missing readings, and process restarts break those windows.
Active rulesGPU: ≥80% device utilization for 30 secondsDisk throughput: ≥100 MiB/s for 30 secondsPhysical network throughput: ≥26.2144 MB/s for 30 secondsCPU: ≥90% of the Mac for 30 secondsMemory pressure: warning or critical for 20 secondsThermal: serious or critical for 30 secondsMemory growth: ≥256 MiB and ≥20% over 120 seconds with the same process lifetimesRecurring CPU: 3 separate peaks ≥80% of one core within 300 secondsApp CPU: ≥100% of one core for 30 secondsCorrelation, not causeApp attribution names the largest measured user at detection. Throughput does not establish saturation, growth does not establish a leak, and client GPU time does not partition device utilization.Step 03 Step 4. Keep the evidence
Live history only lasts minutes. Save detail window keeps 30 seconds either side of the observation as a small recording. To have that done for every new observation, tick Automatically save incident details in the card Keep incident details.
DiagnosticsSustained pressure, recurring spikes, and changes worth investigating.Search or jump to…⌘KPauseRecordLast hour · Live10:42:181 observation worth a look.Most severe: CPU demand stayed high, a Warning detected 10:31:08.Critical 0Warning 1Info 23 observations in viewEach observation’s measured window on one clock · click one to jump to itInfoWarningCriticalDetectedWarning · CPUInfo · CPUInfo · Memory60 min ago45 min30 min15 minNowCPU2GPU—Memory1Disk—Network—Thermal—Counts by resource · last hourSeverityAllResourceAll resources3 recorded observationsExportClearObservationsNewest first · each describes correlation, not causeCPU demand stayed highWarningCPUDetected 10:31:0811m agoTotal Mac CPU remained at or above 90% for at least 30 seconds. Lumen Edit had the largest measured CPU use at detection; this is correlation, not proof of cause.Savable detail: 10:30:02–10:31:38 · 49 samples. Live history is bounded; save this window to keep it.Observed 10:30:31–10:31:08· 37sShow in timelineSave detail windowLumen Edit’s CPU demand stayed highInfoCPUDetected 10:30:1212m agoAll measured member lifetimes continuously used at least 100% of one CPU core for 30 seconds. 100% equals one core; useful work may use several cores.Savable detail: 10:29:10–10:30:42 · 47 samples. Live history is bounded; save this window to keep it.Observed 10:29:40–10:30:12· 32sShow in timelineSave detail windowKite Browser’s measured memory is growingInfoMemoryDetected 10:12:4629m agoThe same process lifetimes grew by 412 MB over 122 seconds. Growth can reflect useful work or caching; this observation does not establish a memory leak. Group totals can overlap shared pages.Savable detail: 10:12:20–10:13:16 · 29 samples. Live history is bounded; save this window to keep it.Observed 10:10:44–10:12:46· 2m 2sShow in timelineSave detail windowAutomatically save incident detailsKeep incident detailsOptional, local recordings of new observations
At detection, saves up to three minutes already retained. Limited to 16 incident recordings and 64 MiB of compressed payload, plus SQLite indexes and metadata. Captures stop at the limit; existing recordings are never automatically deleted.Patterns over timeObservations use continuous measured windows. Pausing, waking, missing readings, and process restarts break those windows.
Active rulesGPU: ≥80% device utilization for 30 secondsDisk throughput: ≥100 MiB/s for 30 secondsPhysical network throughput: ≥26.2144 MB/s for 30 secondsCPU: ≥90% of the Mac for 30 secondsMemory pressure: warning or critical for 20 secondsThermal: serious or critical for 30 secondsMemory growth: ≥256 MiB and ≥20% over 120 seconds with the same process lifetimesRecurring CPU: 3 separate peaks ≥80% of one core within 300 secondsApp CPU: ≥100% of one core for 30 secondsCorrelation, not causeApp attribution names the largest measured user at detection. Throughput does not establish saturation, growth does not establish a leak, and client GPU time does not partition device utilization.Step 04 Step 5. Turn on notifications
Open Settings (⌘,) → Alerts. Switch on Enable notifications and answer the macOS prompt. The line below should then read macOS notifications: Allowed by macOS.
SettingsMake l/Activity work the way you do.Search or jump to…⌘KSearch settingsGeneralDark · Dock and menu barPermissionsFinder not checkedMonitoringEvery 2 secondsHistory & Recording30 min live · 24 h maxStorage & CacheEvery hour · 1.8 GBAlertsNotifications onAbout & PrivacyVersion 2.39Changes save automaticallyAlertsControl observations and when they notify you.NotificationsNotify you about sustained pressure and recurring workload patternsEnable notificationsInclude warnings as well as critical eventsInclude memory growth and recurring CPU observationsmacOS notifications: Allowed by macOSOpen Notification SettingsRecheckExample notificationWarningWarnings like this one notify youObservation rulesChoose which measured conditions l/Activity highlights in Diagnostics9 of 15 rules onConfigure observation rulesValues within each field’s rangeSustained CPU demandMac CPU at least90%Continuously for30secondsSustained app CPU demandApp CPU at least100% of one coreContinuously for30secondsAll member processes must report continuously with unchanged lifetimes. 100% is one core.
App exceptionsAdd App…Lumen EditRemoveapp:/Applications/Lumen Edit.appExclude app-specific observationsCustom CPU threshold400% of one coreCustom disk thresholdShared: 25 MiB/sCustom network thresholdShared: 10.48576 MB/sRepeat cooldown300secondsRules differ from the defaultsRestore Default RulesStep 05 Step 6. Choose what counts
Open Configure observation rules. There are fifteen rules. Each has a switch, a threshold and a time it must hold for. Eight are on to begin with, for example Mac CPU at 90% or more for 30 seconds.
SettingsMake l/Activity work the way you do.Search or jump to…⌘KSearch settingsGeneralDark · Dock and menu barPermissionsFinder not checkedMonitoringEvery 2 secondsHistory & Recording30 min live · 24 h maxStorage & CacheEvery hour · 1.8 GBAlertsNotifications onAbout & PrivacyVersion 2.39Changes save automaticallyAlertsControl observations and when they notify you.Observation rulesChoose which measured conditions l/Activity highlights in Diagnostics8 of 15 rules onConfigure observation rulesValues within each field’s rangeSustained CPU demandMac CPU at least90%Continuously for30secondsSustained GPU activityDevice GPU at least80%Continuously for30secondsSustained disk throughputRead + write at least100MiB/sContinuously for30secondsSustained network throughputPhysical traffic at least26.2144MB/sContinuously for30secondsThroughput is measured activity; these rules do not establish saturation or the cause of a slowdown.
Sustained app CPU demandApp CPU at least100% of one coreContinuously for30secondsAll member processes must report continuously with unchanged lifetimes. 100% is one core.
Sustained app disk throughputRead + write at least25MiB/sContinuously for30secondsSustained app network trafficReceive + send at least10.48576MB/sContinuously for30secondsRequires enabled process network accounting and complete rates. Only independent network captures advance the window; missing rates and changed lifetimes reset it.
Sustained app memoryApp memory at least4,096MiBContinuously for30secondsRequires every member’s measurement and unchanged process lifetimes and memory sources. The process total is not unique system memory.
Low available volume spaceAvailable space at most10GiBContinuously for60secondsWritable local volumes, checked every 15 seconds. Uses cached available blocks, excluding purgeable space. APFS volumes can share a container.
Measured sensor temperatureTemperature at least90°CContinuously for30secondsEach measured sensor must stay above the threshold independently. Requires hardware sensors; uses their existing capture cadence. This is not a hardware safety limit.
Step 06 Step 7. Watch one app more closely
Switch on Sustained app CPU demand. It applies to every app, so set its threshold high. Then, under App exceptions, click Add App…, pick the app you care about and give it a lower Custom CPU threshold.
Observations about a single app are Info level. To be notified about those too, switch on Include memory growth and recurring CPU observations in the Notifications card.
SettingsMake l/Activity work the way you do.Search or jump to…⌘KSearch settingsGeneralDark · Dock and menu barPermissionsFinder not checkedMonitoringEvery 2 secondsHistory & Recording30 min live · 24 h maxStorage & CacheEvery hour · 1.8 GBAlertsNotifications onAbout & PrivacyVersion 2.39Changes save automaticallyAlertsControl observations and when they notify you.NotificationsNotify you about sustained pressure and recurring workload patternsEnable notificationsInclude warnings as well as critical eventsInclude memory growth and recurring CPU observationsmacOS notifications: Allowed by macOSOpen Notification SettingsRecheckExample notificationWarningWarnings like this one notify youObservation rulesChoose which measured conditions l/Activity highlights in Diagnostics9 of 15 rules onConfigure observation rulesValues within each field’s rangeSustained CPU demandMac CPU at least90%Continuously for30secondsSustained app CPU demandApp CPU at least100% of one coreContinuously for30secondsAll member processes must report continuously with unchanged lifetimes. 100% is one core.
App exceptionsAdd App…Lumen EditRemoveapp:/Applications/Lumen Edit.appExclude app-specific observationsCustom CPU threshold400% of one coreCustom disk thresholdShared: 25 MiB/sCustom network thresholdShared: 10.48576 MB/sRepeat cooldown300secondsRules differ from the defaultsRestore Default RulesStep 07
02Good to know
The small print, in plain words
Note1 / 3
What an observation claims, and what it does not
An observation says a measured pattern happened and which app was using the most at that moment. It does not claim to know the cause, and it never calls growing memory a leak.
Note2 / 3
Why you may see no banner
Notifications are off until you turn them on, need permission from macOS, and are limited to one a minute. Info-level observations need their own switch.
Note3 / 3
Observations last for the session
The list covers the time since you opened l/Activity. Save a detail window, or export a diagnostic report, for anything you want to keep.
03Keep going
