What is fseventsd on a Mac?

fseventsd is the macOS process that keeps a record of file changes: files created, edited, renamed and deleted. Spotlight, Time Machine and many apps use that record to find out what changed without having to look through every folder. It is a normal part of macOS. It becomes busy during big file operations, and it calms down once they finish.

You almost never need to do anything about it. If it is using a lot of processor time, the useful question is what is changing so many files.

What fseventsd does

The name stands for “file system events daemon”. A daemon is a background process. Foreman shows it as “File change tracker” with the description “Records file changes for Spotlight, Time Machine and apps.”

The problem it solves is simple. Without it, an app that wants to know whether a folder has changed would have to scan the whole folder again and again. With it, macOS keeps one log of changes and apps ask for the entries they care about. That saves a great deal of work.

It is a quiet helper for a lot of everyday software.

• Spotlight uses file changes to know which files to read again for its search index.
• Time Machine uses them to know which files need to go into the next backup.
• Apps that watch folders, such as cloud storage clients, code editors, photo apps and build tools, rely on it to react when something in a folder changes.

Why it gets busy

fseventsd does more work when more files change. The usual causes are ordinary.

• Copying, moving or deleting a lot of files. Moving a folder with tens of thousands of small files creates tens of thousands of events.
• Unpacking a big archive or cloning a code repository.
• Installing or updating large apps, or a macOS update.
• A sync client catching up. If a cloud storage folder is downloading thousands of files, each one is a change to record.
• A build or export that writes many temporary files, as developers and video editors often have.
• Restoring from a backup or migrating to a new Mac.

In each case fseventsd is busy because the work you asked for is large. It is not the cause. When the operation finishes, the stream of changes stops and so does the load.

Because the same changes also wake Spotlight and Time Machine, you may see “Spotlight indexing” or “Time Machine backup” busy at the same moment. What is mds_stores on a Mac: Spotlight indexing explained covers the Spotlight side, and what is backupd on a Mac: Time Machine behind the scenes covers the backup side.

When it stays busy for too long

If fseventsd stays busy long after a big operation has ended, look for something still writing files.

1. Check what else is active. Sort a process list by Disk and by CPU. A sync client, a build tool or a download manager that is still working explains it.
2. Check the folder. Something may be writing to a folder in a loop, for example a program that logs every second or an app that keeps rewriting a cache.
3. Pause the sync, or quit the app. If the load drops straight away, you have found the cause.
4. Restart the Mac. It is the cheapest way to clear a stuck state.

How to find what’s writing to your Mac’s disk goes through this step by step.

Where it keeps its records

On each disk, macOS keeps the change log in a hidden folder named .fseventsd at the top level of the disk. You do not normally see it. The log is small compared with the files it describes and macOS manages it for you, so there is nothing to clean up, and you should not delete the folder by hand. If you are short of space, the place to look is General > Storage in System Settings, which shows what is taking room.

Can you end fseventsd

It runs as root, so ending it needs an administrator password, and macOS restarts it straight away. While it is down, apps that watch for changes may miss things, which can mean a search index or a backup that lags behind. Ending it will not make a big copy finish faster. The sensible move is to let the file operation finish, and if it is truly in your way, pause the app that caused it.

Seeing it in Foreman

In Foreman, fseventsd appears on the Processes page as “File change tracker”, with the real name in grey. You can sort by CPU and see it beside the apps, then look at who else is busy to find the cause. Foreman shows no disk figures for processes run by root, such as this one, so use the Disk graph on the Performance page to see how hard the disk is working, and sort by Disk to find the app under your account that is doing the writing. If the problem is a particular app, End Task asks it to quit the normal way, so it can offer to save work before closing.

Because fseventsd runs as root, Foreman asks for your administrator password before it ends it, and it does not offer Efficiency Mode for it: macOS only lets an administrator slow down processes owned by root or a system account. If the app causing the changes runs under your account, Efficiency Mode is available for that app instead. Foreman costs $12 once and is free for 24 hours, on up to 3 Macs.

The short version

fseventsd records file changes for Spotlight, Time Machine and apps. It is busy when many files change, and the fix is to let the big operation finish or pause whatever started it. Leave the process and its hidden folder alone. Foreman shows it by its plain name, next to whatever is making the changes.