---
title: "symptomsd on Mac: what Apple documents and what you can see · Kilobat Guides"
url: "https://kilobat.app/guides/what-is-symptomsd.html"
description: "symptomsd is a macOS daemon for the Symptom Framework. Apple documents very little about it. Learn what is known and how to see its traffic."
---

macOS processes

# What is symptomsd on Mac?

`symptomsd` provides services for Apple's Symptom Framework. Apple documents almost nothing else about it.

Process: `symptomsd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

## Where you see it

- `symptomsd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `symptomsd` can connect.

## What it is

The man page says only that symptomsd “provides services for the Symptom Framework”. It has no options, and users should not run it manually.

Apple publishes no documentation of the Symptom Framework. The program is `/usr/libexec/symptomsd`.

## Why it uses the network

- **Not documented.** Apple does not say why symptomsd uses the network. On this Mac, `nettop` showed no traffic for it.

## Is it normal?

It is part of macOS. If it moves a lot of data on your Mac, this is unusual. Measure it with the steps below.

## See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `symptomsd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p symptomsd -P
   ```

## Reduce or pause it safely

1. There is no user setting for symptomsd.
2. Do not quit `symptomsd` in Activity Monitor. It is part of macOS, and other features depend on it.

## With Kilobat

1. Open the Kilobat app list and search for `symptomsd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth symptomsd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `symptomsd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

## Questions

**Is symptomsd malware?**

No. It is part of macOS, in `/usr/libexec`, with a man page.

## Sources

- symptomsd(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [What are ReportCrash and SubmitDiagInfo on Mac?](https://kilobat.app/guides/what-is-reportcrash.html): ReportCrash saves crash reports on the Mac.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.