How to enable process accounting on macOS

Solution 1:

You can either use an app to turn on process accounting or use command line tools:

1. App: Onyx

   

2. CLI:

   • Open Terminal and enter:

     sudo mkdir /var/account
     sudo touch /var/account/acct
     sudo accton /var/account/acct
     

   • With sa you can print the system accounting statistics. Check man sa

Solution 2:

1. Activity Monitor is your first item to track down CPU usage.
2. Next is to get Xcode and use Instruments. That can do far deeper introspection and trace in to the system and apps.
3. The deepest level is dtrace where you can literally pick apart system calls.

You should use these in order since the second and third need you to relax system integrity or enable a privileged helper. It's not really a huge security risk, but if you can get the accounting you need from Activity Monitor - better to keep all macOS security in place.