The Activity Monitor in MacOS displays a list of all the apps you are running. This is useful for stopping CPU-hungry processes. It also raises a number of system processes, some of which may not be safely terminated. To recognize the difference:
Who are all these users?
First, you should check who owns the process. Processes in macOS (and any other Unix-like operating system, including Linux) own owners, which associate each process with the user account that started the process. While you recognize your user account, there are many other users on your computer, most of which are managed by the system.
You can see here that in a standard installation of macOS over 250 users are managed by The system, most of which start with an underscore:
Macs have due to the How many permissions exist in macOS so many user accounts, and each user has specific permissions. For example, _dock would have permission to access files related to the dock, not much else. This will keep your system safer by keeping the low-level system processes in their own containers.
Important: Since most system processes are pure system processes, it is best to never end a process whose owner has a
It is probably safe to have all the processes under your system User account names because most of them are automatically restarted when needed. However, you should not be too insane and close everything to save system performance because most processes on your computer are idle. It's much better to leave them where they are needed rather than spending extra resources to reopen.
Processes with an icon next to their name indicate apps that can normally be closed. You can sort by "% CPU" to see the apps that consume the most resources:
Some of these programs, such as: Google Chrome, for example, uses help processes to improve performance. You should quit apps like Chrome by using the Force Quit menu rather than the Activity Monitor.
If the app has one of the two icons shown below, you should be aware of the following:
The icons you should look out for are one white sheet with a pencil, a brush and a ruler in the form of an "A". or a sign.
The first is the default icon for an app without an app. This may mean that it is a background process that does not require an icon for the user. The latter is a symbol specific to Apple user-level processes such as Siri, Finder, and the Dock.
What is "root"?
Next comes root, the user account with the most system permissions. This is a bit crazier because most system processes in the root account handle processes. However, some things that you start are started as root, especially things that need to access child system resources. These are harder to recognize because you need to know what you're looking for:
Here's an example: ckb-next is a third-party driver for my Corsair USB mouse, so I know that the root-run ckb-next-daemon is a helper process for this app. If I closed it, my mouse would stop working. If you see something running as root, closing may be safe, but most of the processes in this category are system features that you should not touch.
The View menu in the top menu bar lets you change which processes are displayed. You can choose to show only processes with windows displaying the same list as in the Force Quit menu. You can also see processes that have been started by you, by the system, and by those that are active or inactive.
The useful part of these filter views is that you can also sort by% CPU. For example, you can view the longest-running system processes by selecting "System Processes" as the filter and "CPU Time" as the sort.
Whatever you want to stop, you can not really hurt your Mac. Any damage can be resolved by a simple reboot. In fact, the best way to clean up the process list is to reboot your computer, which eliminates a few unnecessary things. Find apps that start right away and uninstall those you no longer need.