macOS process library
What is logd on Mac?
logd is the daemon that runs the macOS unified log. Every app and system process sends it messages through the system’s logging API, and logd compresses them, keeps short-lived entries in memory, and writes the rest to files in /var/db/diagnostics.
- Part of
- The daemon behind macOS’s unified logging system.
- Safe?
- Yes. logd is part of macOS and runs on every Mac.
- Can I quit it?
- No. launchd restarts it immediately, and log messages can be lost in the gap.
The short answer
logd should always be running, and a little CPU is normal. When it climbs, the cause is almost always another process writing a flood of log messages, or logging that someone turned up for debugging. Find the noisy source instead of trying to stop logd.
Normal use
What logd usually looks like.
On a typical Mac, logd usually sits near 0 to 2% CPU and a modest amount of memory. It handles a huge volume of messages, but it is built for that, so most of the time you won’t notice it.
Short bursts are expected after startup, after waking from sleep, and while macOS installs updates. Those periods produce a lot of log traffic, and logd settles down when they end.
Why logd uses so much CPU or memory
- A process that logs too much
A misbehaving app, driver, or background service can write messages many times per second. logd has to receive and store every one, so its CPU rises with the noise.
- Debug logging left on
Developer tools and some configuration profiles turn on more detailed logging for a subsystem. That can multiply the volume logd handles.
- Live log streaming
Watching the log live in Console or with
log streamin Terminal asks logd to deliver messages as they arrive, which adds work while it runs. - Busy system moments
Startup, waking from sleep, and macOS updates generate a burst of messages from many processes at once.
How to calm logd down
Start at the top. Each step is more disruptive than the one before.
- Give it a few minutes
If you just started up, woke the Mac, or installed an update, wait. logd usually settles once the burst of activity passes.
- Close live log viewers
Quit Console and stop any
log streamcommands running in Terminal if you don’t need them. - Look for the noisy process
Check which apps or background tools were busy at the same time. A stuck app or a third-party driver that’s erroring repeatedly is a common source. Quit or update it.
- Check for logging profiles
In System Settings → General → Device Management, look for profiles you don’t recognize, such as debug logging profiles from a developer tool. Remove only profiles you installed yourself; ask your IT team about managed ones.
- Restart your Mac
A restart clears whatever stuck process was generating the flood. Save your work first.
Seeing it in Spare
Find what it’s reacting to.
logd’s CPU tells you that something is logging a lot, not what. Spare lists your apps, development projects, and AI agents side by side, so when logd climbs you can see which workload was busy at the same moment, such as a dev server stuck in a crash loop.
Spare treats macOS processes like logd as system tasks and never offers to stop them.
Common questions
About logd
Is logd a virus?
No. logd is the macOS logging daemon and lives at /usr/libexec/logd, a protected system location apps can’t modify.
Can I turn off logging on my Mac?
No. The unified log is built into macOS and can’t be switched off. You can reduce what it records by fixing the apps that log too much.
Where does logd store logs?
Mostly in /var/db/diagnostics, with extra data in /var/db/uuidtext. macOS removes old entries automatically, so you don’t need to clean these folders.
Why is logd using high CPU?
Usually because another process is writing a large number of log messages. logd’s usage follows that volume.
Related processes
Sources: Eclectic Light: Inside the Unified Log 1, goals and architecture. Reviewed October 6, 2026.
Get Spare
Free to use. Yours to explore.
Download Spare for Apple silicon, or explore the MIT-licensed source on GitHub. Free to use, with no subscription or account.
macOS 14+ · Apple silicon · Signed and notarized