Mac Overheating with High CPU Usage: Diagnose and Fix from the Terminal

What this covers

A hot Mac with roaring fans is almost always one process working far too hard. This guide walks you from identifying the culprit to fixing the most common terminal-fixable causes and confirming the machine has cooled down.

Symptom

Take a one-shot CPU snapshot to find the culprit

When your Mac runs hot and the fans spin up, the first question is which process is burning CPU. A single sorted report gives you the top consumers instantly without watching a live screen. It worked if you can see one or two process names at the top of the list with high CPU percentages.

$ top -l 1 -o cpu

Search the full process list for suspicious names

Once you have a suspect process name from the snapshot, confirm it in the complete process list and note its exact PID. This also reveals helper or duplicate instances you might have missed. It worked if you get a line with the process name and a PID you can use in the next step.

$ ps aux | grep -i "<name>"

Watch live CPU, memory and disk in one screen

If the one-shot snapshot is not conclusive — for example the load comes and goes — a live monitor lets you see spikes as they happen and correlate them with what you are doing. It worked if you can reproduce the heat-up and see which widget or process reacts at the same time.

$ btm

Trace what the busy process is actually doing on disk

A process pegging the CPU is often doing heavy filesystem work, like indexing or syncing thousands of files. Tracing its file activity tells you whether the load is legitimate work or a loop stuck on one folder. It worked if the trace shows the process reading or writing files, and you can judge whether that activity makes sense.

$ sudo fs_usage -w -f filesys | grep -i Documents

Check whether the hot process is also chattering on the network

Cloud sync clients, backup agents and runaway update checks often combine high CPU with constant network traffic. A single per-process network report tells you if the culprit is talking to the internet nonstop. It worked if you can match the top talker to the CPU hog you identified earlier.

$ nettop -P -l 1

Stop Finder from churning on network and USB drives

If your trace pointed at Finder constantly touching network shares or USB disks, hidden .DS_Store writes can keep the disk and CPU busy. Disabling those writes removes the churn. It worked if the defaults commands succeed and Finder stops hammering the external volume — verify with another CPU snapshot.

$ defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true && defaults write com.apple.desktopservices DSDontWriteUSBStores -bool true

$ defaults delete com.apple.desktopservices DSDontWriteNetworkStores && defaults delete com.apple.desktopservices DSDontWriteUSBStores

Review sleep and power settings that keep the Mac awake

Overheating is worse when the Mac never idles down. Reading the live power configuration shows whether aggressive wake settings or disabled sleep keep the CPU working around the clock. It worked if you can read the settings and spot anything that prevents normal sleep.

$ pmset -g custom

Confirm the suspect process has settled down

After quitting or fixing the offending app, check that specific process again by its PID. A much smaller footprint — or the process being gone — confirms the problem source is addressed. Re-run the CPU snapshot as well; the machine should cool down and the fans quiet within minutes.

$ ps -o pid,rss,comm -p <PID>

How to confirm it worked

Re-check the suspect process by PID and take a fresh CPU snapshot: usage should be low, the chassis should cool and the fans should quiet within a few minutes.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

$ defaults delete com.apple.desktopservices DSDontWriteNetworkStores && defaults delete com.apple.desktopservices DSDontWriteUSBStores

Review before running — some steps may not be independent.

Sources

• top — display and update sorted information about processes (macOS)
  SS64 · technical · 2026-09-17
  Evidence: The page documents -l for logging mode (one shot) and notes that -u is an alias equivalent to "-o cpu -O time", confirming -o cpu sorts by CPU usage.
• ps — process status (macOS)
  SS64 · technical · 2026-09-17
  Evidence: The page documents the BSD flags that make up 'aux': -a (other users' processes), -u (user-oriented output with %CPU and %MEM), and -x (processes without a controlling terminal).
• macOS fs_usage — report system calls and page faults related to filesystem activity
  SS64 · technical · 2026-09-17
  Evidence: Documents fs_usage's filesys filter, -w wide output and -f filter classes.
• top(1) man page
  manpagez.com · technical · 2026-09-17
  Evidence: The synopsis shows -l <samples> ("Use logging mode and display <samples> samples") and -o <key> for the sort-order column, with cpu as a valid key.
• bottom documentation
  bottom · vendor-doc · 2026-09-20
  Evidence: Official bottom docs covering widgets and flags.
• nettop(1) — display network activity by process
  Xcode man pages (mirror of Apple's) · technical · 2026-09-17
  Evidence: Documents nettop -P aggregating traffic per process and -l 1 taking a single sample instead of an animated display.
• PS(1) — macOS man page
  KEITH · technical · 2026-09-17
  Evidence: The BSD ps man page lists the -a, -u and -x options whose combination 'aux' shows every process on the system with CPU, memory and command columns.
• Homebrew formula: bottom
  Homebrew · vendor-doc · 2026-09-20
  Evidence: Installs bottom, which provides the btm binary.

Last verified: 2026-09-21

Related guides