Core networking

What is symptomsd?

Q: Is symptomsd malware?

The genuine macOS symptomsd is in /usr/libexec, signed by Apple and has a man page. Check the process path and signature if unsure.

Q: Is the analytics setting related to symptomsd?

Apple doesn't say. One of its services is named com.apple.symptom_analytics, but the name alone proves nothing.

symptomsd is part of macOS. Apple documents almost nothing about it. Its launchd file shows that it runs as the system's networking user and starts when the network changes.

Process: symptomsdMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS, barely documented. Apple says only that it provides services for the Symptom Framework. It runs as the networking user and reacts to network changes.

Block with care

Apple doesn't document what depends on it. Blocking it saves little data and may affect features that Apple doesn't name.

Path: /usr/libexec/symptomsd
launchd label: com.apple.symptomsd
Signing identifier: com.apple.symptomsd

What it is

The man page says only that symptomsd “provides services for the Symptom Framework”. It has no options, and users should not run it manually.

Apple publishes no documentation of the Symptom Framework. The program is /usr/libexec/symptomsd, signed by Apple.

Its launchd property list, com.apple.symptomsd, runs it as the _networkd user and group. It starts on the system's com.apple.network_change notification and when apps register or unregister.

The services it offers include com.apple.symptom_analytics and com.apple.symptoms.symptomsd.managed_events. Their names suggest network health and analytics, but Apple doesn't say what they do.

Why it uses the network

Not documented. Apple doesn't say why symptomsd would use the network. On a test Mac, nettop showed no internet traffic for it.
Network changes. Its launchd file starts it when the network changes. That explains why it is often running, not that it sends data.

How much is normal

It is part of macOS and usually shows little or no traffic of its own.

Seeing it in a process list, or in a firewall's list of processes, is normal.

If it moves a lot of data on your Mac, that is unusual. Measure it with the steps below and note the remote addresses.

When it uses a lot, and why

Not known. Apple documents no case where it moves much data. If you see it, check the remote addresses with lsof and send the details to Apple with Feedback Assistant.

Is it safe to block?

Block with care

Apple doesn't document what depends on it. Blocking it saves little data and may affect features that Apple doesn't name.

What breaks if you block it

Not documented. Apple doesn't say which features use the Symptom Framework.
Because it runs as the networking user and reacts to network changes, network features may be affected.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

There is no user setting for symptomsd.
If you share analytics with Apple, you can turn that off. Choose Apple menu › System Settings › Privacy & Security › Analytics & Improvements.
Don't quit symptomsd in Activity Monitor. macOS starts it again.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network, then search for symptomsd.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p symptomsd -P
```
List its open network connections, if any.
```
sudo lsof -nP -i -a -c symptomsd
```
Needs an administrator password.

With Kilobat

In the Kilobat app list, search for symptomsd. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'symptomsd'
```
Show its traffic over one day.
```
kilobat bandwidth 'symptomsd' day
```
Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

What isn’t documented

Apple publishes no documentation of the Symptom Framework or of what symptomsd sends.

This page describes only its man page and its launchd property list. Kilobat doesn't guess at the rest.

Questions

Is symptomsd malware?

The genuine macOS symptomsd is in /usr/libexec, signed by Apple and has a man page. Check the process path and signature if unsure.

Is the analytics setting related to symptomsd?

Apple doesn't say. One of its services is named com.apple.symptom_analytics, but the name alone proves nothing.

Sources

symptomsd(8), man page installed with macOS 27.2
launchd property list com.apple.symptomsd, macOS 27.2
nettop(1) and lsof(8), man pages installed with macOS 27.2
Apple Support: Share analytics information from your Mac with Apple

Checked on 1 November 2026.