I am having trouble with some of the kernel extensions I am running as after a day or two of use, the memory usage of kernel_task grows to 1.2GB and stays there all the time. The problem is that I have a few third-party extensions installed and it would be a pain to try to remove them one-by-one, not to mention that the leak can actually be in some of the core modules.

So, is there a way to see per-kext memory consumption breakdown of that kernel_task total sum?

1 Answer 1


There is a command-line utility that allows you to look at memory wired for kernel extensions. However, a memory leak will often not show up as wired memory, but we can hope:

  1. Open Terminal

  2. Type kextstat

  3. If you don't see that the wired memory column is greater than the size column (the default memory size of the .kext) for any of your suspected culprit kernel extensions (or any .kext's) proceed to step 4.

  4. type man kextutil, read through this man page. I have successfully used this to help with correctly diagnosing the installation issues of a kernel extension. It can be useful, at the very least for your information.

    X. I'm not sure kextcache would help you. Also, as far as debugging the .kext in question, you'll need to use something like the Xcode development environment and have at least 2 machines available. Let me just say, be careful what you boot-args. Search Apple's own dev documentation to see how to do this on your platform(s). If you are involved in the coding of the kernel extensions you should already know how to do this. It's not for the light of keystroke.

Some points to remember:

  1. The OS will use more ram if it is available. Therefore, if you recently upgraded your ram from 8GB->16GB you might have noticed a big jump in kernel_task's memory usage.

  2. Integrated GPU's (graphics cards) share memory with kernel_task, so certain processes will cause the memory used to jump up. Most of the time, when the process quits, the memory is released by the GPU and kernel_task's memory consumption drops back down.

In the event that you cannot track this in in Terminal.app what I would do is this:

  • Download, and install fseventer, (then reboot the mac), then run fseventer.

  • Open Activity Monitor and see if you can find any related processes for these programs

  • Watching both programs side-by-side see if you can link a process to writing lots of data to the disk (HP printer software is kind of notorious bloatware that's frequently doing something). Then try quitting processes from AM and see if the activity in fseventer stops or if kernel_task's memory consumption drops off by some amount.

  • If you think you know the .kext but not sure which program, or know the program but not sure which .kext, then use Suspicious Package (also found in the SU question linked to below) to examine any of the .pkg/.mpkg files that you suspect might be associated with the .kext. You can also control-click/right-click on a .m/pkg file and click 'show package contents' to get inside.

  • Another way to find where some of the parts of a program are is by going into Terminal.app, type lsbom (with a space after it) and then drag a relevant file from /Library/Receipts then type delete once and then /Contents/Archive.bom and hit return. (This will not be available for many programs if they were migrated from another computer)

  • You can also use AppCleaner to assist in removal/investigation.

...it would also be helpful for helpers to know--> what Hardware/Software are you running? is all HW/SW up to date? Are all these .kexts to accomplish similar tasks? What are you doing? Do you have any big hardware attached (i.e. audio interfaces)?

If you cannot figure it out this way I would go through the checklist below and see if you can answer/eliminate/glean anything from them (unfortunately problems like this usually require some amount of investigation unless you're lucky and the program is really obvious in its resource consumption):

  • If your programs were migrated, it might be best to reinstall them. Migration, and even simply cloning a drive is not without its caveats.

  • A bad hard drive can also cause this to happen, or part of the logic board could actually be faulty or damaged (seen it happen with my own eyes). Run Apple Hardware Test (AHT) (should have come with the Machine on the original installer discs) (or Apple Service Diagnostics (ASD) if you have a friend that works at Apple, or just take it in)

  • Do you know for certain which programs have kernel extensions running? I have tons of third party apps running in the background in various stages of hiding/invisibility and most of them don't have kernel extensions installed.

  • Have you checked the Console.app in Applications>Utilities? If you haven't checked log files you should do so, it might provide a hint to you or a potentially helpful party, in which case you might be able to revise your question for specificity, unless you just decide to delete the culprit from your system.

  • The 'top' command in terminal can provide a little more detail than Activity Monitor.

  • I like the program Menu Meters, it can be useful for monitoring stuff while not keeping activity monitor open. Of course it's another third party program that will be running.

  • Have you started up in Safe Mode (disables extra kernel extensions)?

  • Is this a very "clean" installation in terms of fragmentation/days since re/install? (Obviously not in terms of # of third party apps running).

  • are you sharing lots of files backing up constantly or batch editing or a/v transcoding?

At first posting:

my kernel_task is using >800MB of real memory and >50MB of VM, according to Activity Monitor. The uptime is less than 6 hours. I just switched users and quit Aperture, that was using ~3GB of real memory and the kernel task dropped ~ 50MB off.

At Sept. 12, '12:

kernel_task is using 1.04GB of real memory 67MB VM. Uptime = ~5.5 days. Two users logged in, dozens of browser tabs across 5 different browsers on current user.

You might also want to look at this answered Question on SU and its accepted answer, as well as the software listed there all as tools to help you get to the bottom of this.

  • 2
    kextstat | awk 'NR==1{ printf "%10s %s\n", $5, $6; } NR!=1{ printf "%10d %s\n", $5, $6; }' | sort -n uses awk and sort to make the output from kextstat a bit easier to read and to sort the kexts by memory usage.
    – Isaac
    Aug 11, 2014 at 2:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .