I have a mystery process visible in Activity Monitor, simply called "-i" - don't remember ever seeing this before. Its parent process is launchd, and belongs to root.

  • Persists between reboots;
  • Sometimes high CPU use.

Can't find any reference to it online anywhere either!

enter image description here

Macos 10.13.6

  • And when you press "quit"...? – Mateus Ribeiro Nov 30 '18 at 23:36
  • what does it say when you run Sample process on it ? – Ruskes Dec 1 '18 at 0:02
  • 3
    In Terminal run sudo /Applications/Utilities/Activity\ Monitor.app/Contents/MacOS/Activity\ Monitor to launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint. – Redarm Dec 1 '18 at 0:16
  • The 'open files and ports' option is not something I've tried, works as well as the lsof command. – Simbamangu Dec 1 '18 at 1:04

The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.

Then open Terminal.app and execute the following command:

sudo lsof -p 1234

where 1234 should be replaced with the PID number you've found in Activity Monitor.

The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.

The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.

This should tell you which program is running as "-i".

  • 2
    This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before. lsof is a great tool, thanks for the tip. – Simbamangu Dec 1 '18 at 1:02
  • 1
    Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort. – Wowfunhappy Dec 1 '18 at 1:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .