UserEventAgent is the macOS daemon that loads Apple's event plug-ins to handle system events launchd can't watch directly, such as changes to input devices, Bluetooth and networks; one copy for you and one as root is normal, and it's part of macOS. If it uses a lot of CPU, look in Console for errors that name one of its plug-ins, then update macOS or the device involved and restart the Mac.
Last reviewed
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/UserEventAgent |
|---|---|
| Runs as | your user account and root |
| Signed by | Apple (Software Signing), identifier com.apple.UserEventAgent |
| Note | Two copies: one for the user, one as root. /System/Library/UserEventPlugins held 42 plug-ins. |
UserEventAgent is a macOS daemon that loads system-provided plug-ins to handle high-level system events that launchd can't monitor directly (its man page). The plug-ins live in /System/Library/UserEventPlugins; on a Mac with macOS 26.5 there were 42, with names such as AppleHIDMouseAgent, BluetoothUserAgent-Plugin, BonjourEvents, CaptiveUserAgent and MemoryMonitor. One copy runs for the logged-in user and one as root.
High CPU usage caused by a misbehaving plug-in loaded into the agent
Crashes or respawns logged in Console related to a specific plug-in bundle
Memory growth over a long uptime
Repeated error messages in system logs about plug-in initialization failures
Open Console.app and filter for 'UserEventAgent' to see which plug-in bundle is generating errors or crash reports. The plug-in name in the messages points at the subsystem involved, such as Bluetooth, the network or an input device.
Run 'ls /System/Library/UserEventPlugins' in Terminal. These are Apple's own plug-ins, in a folder System Integrity Protection guards, so you can't and shouldn't remove them; match the name from Console to see which one is involved.
If the plug-in in Console is tied to a device or accessory (a mouse, a Bluetooth device, a network adapter), update macOS and that device's software, or disconnect the device, and see whether the errors stop.
Run 'killall UserEventAgent' in Terminal. launchd will automatically restart it. This forces all plug-ins to reinitialize, which can resolve stuck states without requiring a full reboot.
UserEventAgent running quietly in the background with minimal resource usage is completely normal. Be concerned if it consistently uses more than 20% CPU or its memory grows above 200 MB over time, which indicates a plug-in is misbehaving. Multiple crash reports in Console.app for this process also warrant investigation.
launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management f...
loginwindow manages your macOS login session from start to finish. It presents the login screen, authenticates your cred...
distnoted is the macOS daemon that delivers distributed notifications between processes. When one application needs to n...
Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised on Telegram in Apri...
Realst is a macOS information stealer written in Rust. Security researcher iamdeadlyz first reported...
System Settings › Privacy & Security › Automation
No. UserEventAgent is a legitimate Apple system process that ships with every version of macOS. It is code-signed by Apple and protected by System Integrity Protection. It loads Apple's event plug-ins for things like input devices, Bluetooth and network changes. If you see it in Activity Monitor, it is behaving normally.
High CPU from UserEventAgent is almost always caused by a plug-in loaded into it, not the process itself. Check Console.app for errors mentioning UserEventAgent: the plug-in they name points at the event behind it. The plug-ins themselves are Apple's, in /System/Library/UserEventPlugins, so update macOS or the device involved rather than removing anything.
You should not disable UserEventAgent. It is a core system process that handles event-driven tasks for input devices, Bluetooth and the network. Disabling it could break system functionality. If it is causing problems, focus on identifying and fixing the specific plug-in at fault.
Its man page lists one folder: /System/Library/UserEventPlugins, Apple's own plug-ins. On macOS 26.5 that folder held 42, with names such as AppleHIDMouseAgent, BluetoothUserAgent-Plugin, BonjourEvents, CaptiveUserAgent, EAPOLMonitor and MemoryMonitor.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser