What is the `installd` process, and why is it eating my CPU?

Question

My MacBook is frying my lap, and the CPU monitor is going crazy: over 200% CPU being used by a process named installd.

What is it? Can I kill it?

Sometimes CPU goes wild if something else is not responding. Like the RAM or the Hard Disk, so check those for high activity. — Jadav, Commented Mar 28, 2013 at 22:07
In addition to the good advice from Lauri Ranta - the installer program should also be running, and you can click on it's icon from the Dock and then press command L and command 3 to summon the install log file and enable all messages to be shown. You would expect to see pertinent install process while CPU is above 100% and consider killing the installer / looking deeper for error messages in the install log (Console app will show that log file as well once the installer exits). — bmike, Commented Mar 29, 2013 at 0:17
Don't kill it. It's most likely the software update is running background (it could be other installation tho). Also the reason why CPU goes up beyond 100% is that you have multi-core CPU. My Mac has 4 cores so it could go as high as 400%. — Kenji Noguchi, Commented Sep 27, 2013 at 6:03
Kenji is right on. I came to this page when my installd did the same thing. While I was reading, it finally stopped, and then i was immediately given the "updates available" notification. Why this process needs all available CPU on a quad-core i7 for several minutes is another question. — Dan Pritts, Commented Sep 22, 2014 at 13:44

kenorb · Accepted Answer · 2015-01-26 11:58:06Z

129

This is a daemon which is part of PackageKit framework and it's usually running as a background process for the "Software Update" GUI application. For example, if you open the Software Update application and check for updates, take a look at the Activity Monitor--you'll see the "installd" process doing a bunch of work.

The reason it pegs your CPU is because it must compile the current list of software installed on your computer, and compare with the current version list received from Apple's servers.

You can set the frequency of Software Update checks in System Preferences and Software Update.

The default settings are both to "Check for updates" and "Download updates automatically". You may adjust either setting, but I would not recommend turning it off altogether.

There's nothing wicked about this process - it's just set to download updates.

You can solve your CPU problem by lowering the priority of the process or by just killing the process in Activity Monitor.

Technical information:

The location in Lion OSX is in: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd

(if you have locate configured correctly, run: locate installd to find the right location).

edited Jan 26, 2015 at 11:58

answered May 21, 2013 at 10:14

kenorb

12.8k18 gold badges85 silver badges148 bronze badges

1

How do you set the priority of a process?
– hawk
Commented May 4, 2014 at 13:16
1

You can use renice command to change the priority for the process.
– kenorb
Commented Jul 11, 2014 at 9:30
7

Note that renice will lower the priority of a process but won't stop it from using all available CPU. If no other program is asking for CPU time, the system will still give all available CPU to the installd process.
– Dan Pritts
Commented Sep 22, 2014 at 13:42
4

On Mac OS 10.10.1, this setting is under System Preferences -> App Store. Looks like they re-enabled it without telling me when I upgraded to Yosemite.
– Ajay Gautam
Commented Mar 12, 2015 at 0:36
5

You don't need to use locate on macOS. Use mdfind -name installd instead, it uses Spotlight and is always available.
– neu242
Commented Dec 20, 2016 at 7:42

| Show 1 more comment

Lri · Accepted Answer · 2013-03-28 20:50:02Z

16

It's normally run when you for example install an App Store application or remove an application from Launchpad. It shouldn't stay running in the background or keep using that much CPU though. You can probably just force quit it from Activity Monitor or run sudo killall -9 installd.

The binary is in /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd in 10.8.

answered Mar 28, 2013 at 20:50

Lri

106k19 gold badges227 silver badges279 bronze badges

So, the question is, how long has it been doing this?
– GEdgar
Commented Mar 28, 2013 at 21:14
For me, several minutes, and then it went down, and then it started going again (even though I didn't install anything), and then it went down again. It's gone for now, but who knows if it'll return.
– Ken
Commented Mar 28, 2013 at 21:17
11

You could also run sudo opensnoop -n installd to see what files the processes access or search for installd in Console.
– Lri
Commented Mar 28, 2013 at 23:23
2

Don't just kill -9 a process. SIGKILL should be a last resort, since the process does not necessarily terminate in a well-defined or consistent state. Always try -15 (SIGTERM– terminate) and -6 (SIGABRT – abort process) first.
– oarfish
Commented Jan 26, 2015 at 14:42
3

@user495470 opensnoop does not work for me. I get dtrace: error on enabled probe ID 5 (ID 172: syscall::open:return): invalid user access in action #11 at DIF offset 24.
– Albert
Commented Oct 31, 2017 at 22:42

Add a comment |

Snowcrash · Accepted Answer · 2015-04-24 15:10:59Z

7

It's Apple's install process.

What's annoying is:

Apple haven't (as yet) made this less CPU-intensive OR given you the option to do so. Note that the CPU-intensive stage is only at the initial part of the install and does stop.
you can't quickly see the progress of the Downloads

You can see progress but need to do the following:

Apple logo (top left) > App Store > Updates and click Update.

This will then reveal a progress bar with the current download state.

answered Apr 24, 2015 at 15:10

Snowcrash

6571 gold badge10 silver badges20 bronze badges

Add a comment |

mefepe · Accepted Answer · 2014-04-13 17:33:59Z

5

I used Activity Monitor to kill the process at once. And so:

CPU returned back to normal;
A notification from App Store showed up in Notification Center asking for when to install updates.

answered Apr 13, 2014 at 17:33

mefepe

511 silver badge2 bronze badges

Add a comment |

ijoseph · Accepted Answer · 2023-04-03 22:39:10Z

If you want to see exactly what installd (the "Software Update" GUI application) is doing, watch what files it's touching:

sudo lsof -p $(pgrep -x installd)

it's convenient to wrap that in a while loop to watch what's going on (while true; do <the above>; sleep 2; done).

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF                NODE NAME
installd 33160 root  cwd    DIR   1,18      640                   2 /
installd 33160 root  txt    REG   1,18   170768 1152921500312275954 /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd
installd 33160 root  txt    REG   1,18    51268           120667156 /Library/Preferences/Logging/.plist-cache.YFQq27g8
installd 33160 root  txt    REG   1,18   129672           124323933 /private/var/db/analyticsd/events.allowlist
installd 33160 root  txt    REG   1,18   234832            97228994 /private/var/db/timezone/tz/2022g.1.0/icutz/icutz44l.dat
installd 33160 root  txt    REG   1,18    32768           117755779 /private/var/db/mds/messages/se_SecurityMessages
installd 33160 root  txt    REG   1,18  1763679 1152921500312170469 /System/Library/Frameworks/Security.framework/Versions/A/Resources/SecErrorMessages.loctable
installd 33160 root  txt    REG   1,18    61010 1152921500312170467 /System/Library/Frameworks/Security.framework/Versions/A/Resources/SecDebugErrorMessages.strings
installd 33160 root  txt    REG   1,18 30407360 1152921500312435095 /usr/share/icu/icudt70l.dat
installd 33160 root    0r   CHR    3,2      0t0                 341 /dev/null
installd 33160 root    1u   CHR    3,2      0t0                 341 /dev/null
installd 33160 root    2u   CHR    3,2      0t0                 341 /dev/null

you can also look at its log:

sudo log show --info --predicate "process == 'installd'"

will spit out stuff like:

2023-03-31 19:11:21.594332-0700 0x113d531  Activity    0x1b55bf3            37396  0    installd: (Security) SecTrustSettingsXPCRead
2023-03-31 19:11:21.599929-0700 0x113d531  Activity    0x1b55bf4            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 19:11:21.660048-0700 0x113d531  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-03-31 19:11:21.660268-0700 0x113d531  Activity    0x1b55bf5            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 19:11:21.664108-0700 0x113d531  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:mds] Recording an MDS plugin: /System/Library/Security/ldapdl.bundle {87191ca6-0fc9-11d4-849a-000502b52122}
2023-03-31 19:11:21.664189-0700 0x113d531  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:mds] Recording an MDS plugin: /System/Library/Frameworks/Security.framework {87191ca0-0fc9-11d4-849a-000502b52122}
2023-03-31 19:11:21.724084-0700 0x113c55c  Error       0x0                  37396  0    installd: (Metadata) [com.apple.metadata:Metadata] unable to get a dev_t for store 1795162192.
2023-03-31 19:11:21.730298-0700 0x113c55c  Activity    0x1b55bf6            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 19:11:21.733041-0700 0x113c55c  Activity    0x1b55bf7            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 19:11:21.735240-0700 0x113c55c  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-03-31 19:11:21.735330-0700 0x113c55c  Activity    0x1b55bf8            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 19:11:21.968902-0700 0x113c55c  Activity    0x1b55bf9            37396  0    installd: (CoreFoundation) Loading Preferences From System CFPrefsD
2023-03-31 20:03:13.126812-0700 0x115502a  Activity    0x1b55bfa            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 20:03:13.133388-0700 0x115502a  Activity    0x1b55bfb            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 20:03:13.138923-0700 0x115502a  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-03-31 20:03:13.139094-0700 0x115502a  Activity    0x1b55bfc            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 20:03:13.207376-0700 0x115503a  Activity    0x1b55bfd            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 20:03:13.211029-0700 0x115503a  Activity    0x1b55bfe            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-03-31 20:03:13.215457-0700 0x115503a  Default     0x0                  37396  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-03-31 20:03:13.215628-0700 0x115503a  Activity    0x1b55bff            37396  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 06:49:21.910186-0700 0x12583ad  Default     0x0                  45718  0    installd: (CacheDelete) [com.apple.cache_delete:client] Registered: com.apple.installd.CacheDelete, result: 0
2023-04-01 11:46:21.984952-0700 0x12c93b3  Default     0x0                  33160  0    installd: (CacheDelete) [com.apple.cache_delete:client] Registered: com.apple.installd.CacheDelete, result: 0
2023-04-01 11:49:29.169598-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Daemon status changed from 0 to 1
2023-04-01 11:49:29.170246-0700 0x12cb3dc  Default     0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Received configuration update from daemon (initial)
2023-04-01 11:49:29.170591-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CarbonCore) [com.apple.CarbonCore:coreservicesdaemon] SCSession():SCSession( id=100, this=0x0x14b823b10 option=65538) created, forUID=0 mach_port_t=0x3807.
2023-04-01 11:49:29.170607-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CarbonCore) [com.apple.CarbonCore:coreservicesdaemon] SCSession():SCSession( id=101, this=0x0x14b823300 option=65538) created, forUID=0 mach_port_t=0x3603.
2023-04-01 11:49:29.170609-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CarbonCore) [com.apple.CarbonCore:coreservicesdaemon] connectToCoreServicesD():Instantiating server (coreservicesd based) SCSession, port=0x3807 serverOptions=0x10002.
2023-04-01 11:49:29.171199-0700 0x12cb3db  Activity    0x1c3caa0            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.175699-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn\'t used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.175838-0700 0x12cb3db  Default     0x0                  33160  0    installd: (Security) [com.apple.securityd:trustsettings] TrustSettingsUseXPC is enabled (via feature flags)
2023-04-01 11:49:29.175839-0700 0x12cb3db  Activity    0x1c3caa1            33160  0    installd: (Security) SecTrustSettingsXPCRead
2023-04-01 11:49:29.176879-0700 0x12cb3db  Activity    0x1c3caa2            33160  0    installd: (Security) SecKeychainAddCallback
2023-04-01 11:49:29.177093-0700 0x12cb3db  Activity    0x1c3caa3            33160  0    installd: (Security) SecTrustSettingsXPCRead
2023-04-01 11:49:29.181727-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.188072-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.188082-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.188175-0700 0x12cb3db  Activity    0x1c3caa4            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.246625-0700 0x12cb3db  Default     0x0                  33160  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-04-01 11:49:29.246687-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.246969-0700 0x12cb3db  Activity    0x1c3caa5            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.250494-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.252298-0700 0x12cb3db  Default     0x0                  33160  0    installd: (Security) [com.apple.securityd:mds] Recording an MDS plugin: /System/Library/Security/ldapdl.bundle {87191ca6-0fc9-11d4-849a-000502b52122}
2023-04-01 11:49:29.252344-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyMDSPluginCounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.252418-0700 0x12cb3db  Default     0x0                  33160  0    installd: (Security) [com.apple.securityd:mds] Recording an MDS plugin: /System/Library/Frameworks/Security.framework {87191ca0-0fc9-11d4-849a-000502b52122}
2023-04-01 11:49:29.252422-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyMDSPluginCounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.257843-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.260858-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.260892-0700 0x12cb3db  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.318949-0700 0x12c93b6  Error       0x0                  33160  0    installd: (Metadata) [com.apple.metadata:Metadata] unable to get a dev_t for store 1795162192.
2023-04-01 11:49:29.324567-0700 0x12c93b6  Info        0x0                  33160  0    installd: (CoreAnalytics) [com.apple.CoreAnalytics:client] Dropping com.apple.security.LegacyAPICounts as it isn't used in any transform (not in the config or budgeted?)
2023-04-01 11:49:29.326005-0700 0x12c93b6  Activity    0x1c3caa6            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.330049-0700 0x12c93b6  Activity    0x1c3caa7            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.333097-0700 0x12c93b6  Default     0x0                  33160  0    installd: (Security) [com.apple.securityd:SecError] Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]
2023-04-01 11:49:29.333213-0700 0x12c93b6  Activity    0x1c3caa8            33160  0    installd: (Security) SecTrustEvaluateIfNecessary
2023-04-01 11:49:29.598241-0700 0x12c93b6  Activity    0x1c3caa9            33160  0    installd: (CoreFoundation) Loading Preferences From System CFPrefsD

interpreting any of this, of course, is its own question.

watch is not included in macOS (anymore?) so you may need to install it. For example: brew install watch. — Daghall, Commented Apr 3, 2023 at 11:46
DAMN! So close to something that had no onerous dependencies. tbh let me edit this so it doesn't use watch — ijoseph, Commented Apr 3, 2023 at 22:37

nohillside · Accepted Answer · 2013-04-30 08:39:20Z

0

Mine was installd and storeagent - so I just killed them:

sudo killall -9 installd
sudo killall -9 storeagent

edited Apr 30, 2013 at 8:39

nohillside♦

103k42 gold badges219 silver badges271 bronze badges

answered Apr 30, 2013 at 8:36

user48412

1

7

What is the impact of killing these? Does it crash or corrupt anything?
– mmmmmm
Commented Apr 30, 2013 at 9:31
1

Mac OS X installers typically do lengthy operations (unpacking, compiling) on install files in a temporary location, and spend relatively little time actually moving the files into place. You can see this for yourself if you run an installer that reports its progress. This suggests that there is a unlikely but existent chance it might leave your system in an inconsistent state. In addition, the last step of install is writing a "install completed" receipt, so if that doesn't get written, it'll just probably try to install the software again later, fixing the inconsistency.
– interestinglythere
Commented Aug 16, 2014 at 19:10
2

Also, I believe the super risky can-leave-your-system-dead-if-killed updates are the ones that require restart and install only when all users are logged out.
– interestinglythere
Commented Aug 16, 2014 at 19:11
1

There's no real guarantee what will happen if you shoot down a process like this. Probably nothing, but you may corrupt something, so try other signals before killing with -9.
– oarfish
Commented Jan 27, 2015 at 7:11

Add a comment |

Brice · Accepted Answer · 2013-04-23 16:24:01Z

-8

Installd is a process run by Sophos anti virus. The process is called by InterCheck which is a process related to Sophos's active scanning.

answered Apr 23, 2013 at 16:24

Brice

1

3

acutally it seems to be a core component of the operating system that is launched after you authenticate the Installer program to perform an installation. There are issues of it creeping up to hog too much CPU power for some users of Sophos AV for Mac. Edit your answer so that it is suggested as a possibility, one of many, and you'll probably get some upvotes.
– NOTjust -- user4304
Commented Apr 23, 2013 at 17:12

Add a comment |

Stack Exchange Network

What is the `installd` process, and why is it eating my CPU?

7 Answers 7

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
activity-monitor
macos
.

Linked

Hot Network Questions

What is the `installd` process, and why is it eating my CPU?

7 Answers 7

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged activity-monitormacos.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
activity-monitor
macos
.