--- title: "symptomsd: what it is, what Apple documents, and whether to block it · Kilobat" url: "https://kilobat.app/processes/symptomsd" description: "symptomsd provides services for Apple's Symptom Framework on a Mac. What Apple documents about it, what its launchd file shows, and what to do if it uses data." --- Core networking # What is symptomsd? `symptomsd` is part of macOS. Apple documents almost nothing about it. Its launchd file shows that it runs as the system's networking user and starts when the network changes. Process: `symptomsd` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS, barely documented. Apple says only that it provides services for the Symptom Framework. It runs as the networking user and reacts to network changes. Block with care Apple doesn't document what depends on it. Blocking it saves little data and may affect features that Apple doesn't name. Path `/usr/libexec/symptomsd` launchd label `com.apple.symptomsd` Signing identifier `com.apple.symptomsd` ## What it is The man page says only that `symptomsd` “provides services for the Symptom Framework”. It has no options, and users should not run it manually. Apple publishes no documentation of the Symptom Framework. The program is `/usr/libexec/symptomsd`, signed by Apple. Its launchd property list, `com.apple.symptomsd`, runs it as the `_networkd` user and group. It starts on the system's `com.apple.network_change` notification and when apps register or unregister. The services it offers include `com.apple.symptom_analytics` and `com.apple.symptoms.symptomsd.managed_events`. Their names suggest network health and analytics, but Apple doesn't say what they do. ## Why it uses the network - **Not documented.** Apple doesn't say why `symptomsd` would use the network. On a test Mac, `nettop` showed no internet traffic for it. - **Network changes.** Its launchd file starts it when the network changes. That explains why it is often running, not that it sends data. ## How much is normal It is part of macOS and usually shows little or no traffic of its own. Seeing it in a process list, or in a firewall's list of processes, is normal. If it moves a lot of data on your Mac, that is unusual. Measure it with the steps below and note the remote addresses. ## When it uses a lot, and why - **Not known.** Apple documents no case where it moves much data. If you see it, check the remote addresses with `lsof` and send the details to Apple with Feedback Assistant. ## Is it safe to block? Block with care Apple doesn't document what depends on it. Blocking it saves little data and may affect features that Apple doesn't name. What breaks if you block it - Not documented. Apple doesn't say which features use the Symptom Framework. - Because it runs as the networking user and reacts to network changes, network features may be affected. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. There is no user setting for `symptomsd`. 2. If you share analytics with Apple, you can turn that off. Choose Apple menu › System Settings › Privacy & Security › Analytics & Improvements. 3. Don't quit `symptomsd` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network, then search for `symptomsd`. 2. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p symptomsd -P ``` 3. List its open network connections, if any. ``` sudo lsof -nP -i -a -c symptomsd ``` Needs an administrator password. ## With Kilobat 1. In the Kilobat app list, search for `symptomsd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'symptomsd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'symptomsd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## What isn’t documented Apple publishes no documentation of the Symptom Framework or of what `symptomsd` sends. This page describes only its man page and its launchd property list. Kilobat doesn't guess at the rest. ## Questions **Is symptomsd malware?** The genuine macOS symptomsd is in `/usr/libexec`, signed by Apple and has a man page. Check the process path and signature if unsure. **Is the analytics setting related to symptomsd?** Apple doesn't say. One of its services is named `com.apple.symptom_analytics`, but the name alone proves nothing. ## Sources - symptomsd(8), man page installed with macOS 27.2 - launchd property list com.apple.symptomsd, macOS 27.2 - nettop(1) and lsof(8), man pages installed with macOS 27.2 - [Apple Support: Share analytics information from your Mac with Apple](https://support.apple.com/guide/mac-help/share-analytics-information-mac-mh27990/mac) Checked on 1 November 2026. ## Related - [analyticsd](https://kilobat.app/processes/analyticsd): Part of macOS. It collects diagnostics and usage data on the Mac for users who opted in to sharing analytics. - [configd](https://kilobat.app/processes/configd): Part of macOS. It keeps the Mac's network configuration and gets its IP addresses with DHCP, so it sends small amounts of traffic to the router.