symptomsd is a macOS system daemon that runs as _networkd, the account macOS uses for networking services; its man page says only that it provides services for Apple's Symptom Framework and shouldn't be run by hand. It's part of macOS and low background activity is normal, so if it stays busy on a stable network, restart the connection or the Mac before looking further.
Last reviewed
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/symptomsd |
|---|---|
| Runs as | _networkd, a macOS system account |
| Signed by | Apple (Software Signing), identifier com.apple.symptomsd |
symptomsd is a macOS system daemon. Its man page says only that it provides services for Apple's Symptom Framework, that it has no configuration options, and that users shouldn't run it manually. It runs as _networkd, the account macOS uses for networking services, and is generally described as watching network connection quality; Apple doesn't document what it measures.
Elevated CPU usage during network transitions (Wi-Fi to Ethernet and vice versa)
Excessive network probing on metered connections
Background data usage for connectivity checks and diagnostics
High CPU when connected to unreliable or congested networks
Hold Option and click the Wi-Fi icon in the menu bar, then choose Open Wireless Diagnostics to test the connection. If it's unstable, fix that first: move closer to the router, or replace a faulty Ethernet cable.
Go to System Settings > Network and remove any network interfaces you don't use (old VPN configurations, unused Bluetooth PAN). Each interface adds monitoring overhead for symptomsd.
Turn Wi-Fi off and back on, or unplug and replug Ethernet. If symptomsd is stuck in a monitoring loop, resetting the active network interface forces it to re-evaluate connectivity from scratch.
As a last resort, move /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist and NetworkInterfaces.plist to the Desktop as a backup (administrator password needed), then restart. macOS rebuilds them, and you'll rejoin your Wi-Fi networks.
symptomsd running in the background with low resource usage is normal. Be concerned if it shows unusually high network activity that doesn't correspond to your usage, or sustained high CPU when connected to a stable network: check for a DNS server, proxy or VPN setting that keeps failing.
Many guides describe wifid as the Mac's Wi-Fi management daemon. On a Mac running macOS 26.5 (checked October 29, 2026) ...
rapportd is the macOS daemon that handles local device discovery and communication for Continuity features such as Hando...
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications....
Pirrit has been known on Windows since 2014, and a Mac version was spotted in 2016 (Check Point). Ch...
MITRE ATT&CK describes Bundlore as macOS adware in use since at least 2015 that, though categorized ...
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
symptomsd is a macOS system daemon that, per its man page, provides services for Apple's Symptom Framework. It runs as _networkd, the account macOS uses for networking services, and has no settings of its own. Apple doesn't publish more about what it does.
Apple doesn't document what symptomsd sends. Small, occasional traffic from a process running as _networkd from /usr/libexec/symptomsd is normal for macOS networking; if it uses a lot of data, look at what changed on your network first, such as a new VPN or DNS filter.
Yes. symptomsd is an Apple system process: on macOS 26.5 it runs from /usr/libexec/symptomsd as the _networkd system account, signed by Apple, in a folder System Integrity Protection guards.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser