Getting Started

What is System Guardian?

System Guardian is a native macOS menu bar app that monitors CPU, GPU, memory, and swap in real time. It provides local alerts and user-controlled actions for resource management.

What are the system requirements?
  • macOS: 13.0 (Ventura) or later
  • Architecture: Apple Silicon (M1 or later)
  • Disk Space: ~6 MB
  • RAM Overhead: ~15-25 MB
How do I install it?
  1. Download from the App Store or from the GitHub releases page.
  2. If using the DMG, open it and drag System Guardian to your Applications folder.
  3. Launch the app — a shield icon appears in your menu bar.
  4. Optionally enable "Launch at Login" in Settings.
Does it require administrator privileges?

No. System Guardian runs entirely in user space and does not require administrator access for normal operation.

Who is System Guardian designed for?

System Guardian is useful in resource-intensive workflows such as local AI model inference, development environments, and other compute-heavy applications where memory pressure changes quickly during active work.

Dashboard

What is the Dashboard?

The Dashboard is a resizable window with a full overview of your system. It contains a health gauge ring, a pressure sparkline chart, detailed memory/CPU/GPU cards, a process list with inline controls, and an events log.

What does the health gauge ring show?

The ring fills based on the ratio of used memory to total memory. Colors: Green (nominal, under 75%), Orange (warning, 75-90%), Red (critical, over 90%). The icon inside changes accordingly.

What is the pressure sparkline?

A small area chart tracking memory trend over the last 5 minutes (up to 60 samples). It uses Catmull-Rom interpolation for smooth curves and colors match the current pressure level.

Can I resize the Dashboard window?

Yes. The Dashboard window can be resized from 360×500 (minimum) up to 800×1200 (maximum). The content reflows to fit.

Memory Monitoring

What memory metrics does System Guardian track?
MetricDescriptionSource
Strict FreeImmediately unused memory (free + speculative)host_statistics64
AvailableStrict Free plus reclaimable cache/purgeable memoryhost_statistics64
UsedMemory actively in useTotal minus Available
WiredKernel-locked memoryhost_statistics64
CompressedRAM compressed to save spacehost_statistics64
SwapMemory written to disksysctl vm.swapusage
VirtualTotal virtual address spacehost_statistics64
TotalPhysical RAM installedProcessInfo.physicalMemory
How is memory pressure calculated?

System Guardian uses a hybrid absolute + ratio approach to prevent false positives on high-RAM machines. Critical, warning, and nominal thresholds adapt to your total RAM amount, preventing false "warning" alerts on machines with 128+ GB where having 20 GB free is perfectly healthy.

What does "Free" really mean on macOS?

On macOS, "free" memory includes both truly free pages and "speculative" pages (loaded speculatively, instantly reclaimable). System Guardian counts both as free because they are functionally available.

What is compressed memory?

macOS compresses inactive memory pages rather than writing them to swap. This is faster than disk I/O but uses CPU. High compression ratios (above 25% of total RAM) can indicate memory pressure even when "free" memory looks adequate.

Memory Actions

macOS manages memory automatically. Memory actions adjust cache behavior and memory pressure; effects vary by workload.

What does the Standard action do?

The Standard action calls malloc_zone_pressure_relief(nil, 0), which asks all malloc zones in every running process to release pages they are holding but not actively using. This is a lightweight operation that completes in about 1 second.

What does the Intensive action do?

The Intensive action performs a stronger memory action than the Standard action. It may take longer and can temporarily reduce responsiveness while it runs.

  1. Runs multiple internal memory-pressure cycles with safety limits
  2. Releases temporary allocations when each cycle completes
  3. Refreshes memory metrics and reports completion in-app

Results vary by workload and current memory state.

Is Intensive mode safe?

Intensive mode is designed with safety limits, but it can temporarily increase resource usage while running. Use it only when needed and avoid running it during latency-sensitive work.

Why does the app use "Standard" and "Intensive" labels?

The labels are intentionally plain:

  • Standard Memory Action — lightweight cache-pressure cycle.
  • Intensive Memory Action — stronger cycle with higher temporary system load.
  • Process Memory Limit Action — optional automatic force-quit action for eligible user processes above your configured limit.
Why can a memory action report "no significant change"?

If an action reports "no significant change," the system may already be in a healthy state with little reclaimable cache at that moment.

Can I trigger memory actions from the menu bar?

Yes. You can trigger memory actions from the menu bar or from the Dashboard.

CPU Monitoring

How is CPU usage calculated?

System Guardian reads per-core tick counts from host_processor_info(PROCESSOR_CPU_LOAD_INFO) twice (with a delay), then calculates the delta between samples. This provides a near real-time CPU estimate based on sample deltas, not cumulative averages. Reported values include User, System, and Total percentages.

What does "100% CPU" mean on macOS?

On macOS, CPU percentage is measured per-core. 100% means one core is fully utilized. A machine with 10 cores can reach 1000% total. System Guardian's total CPU figure is a weighted average across all cores (0-100%).

What is the CPU highlight threshold?

In Settings → Advanced, you can set a per-process CPU highlight limit. Processes exceeding this limit appear with a red dot in the menu bar and dashboard. The value is shown as "N×core" (e.g., "2×core" = 200% = 2 full cores).

GPU Monitoring

What GPU metrics does System Guardian show?
MetricDescription
Device UtilizationOverall GPU usage percentage
RendererGPU time on fragment/pixel shading
TilerGPU time on vertex processing and tiling
In-Use MemoryVRAM currently consumed
How is GPU data collected?

System Guardian reads GPU telemetry from IOKit's IOAccelerator service, querying the PerformanceStatistics dictionary. This works with Apple Silicon GPUs (M1 and later).

Why does GPU show 0%?

If your computer's GPU is idle (no rendering, no compute), utilization will naturally be 0%. This is normal. GPU utilization spikes during video playback, 3D rendering, Metal compute workloads, or window compositor activity.

Process Management

How does System Guardian find running processes?

System Guardian lists running processes with their current CPU and memory usage so you can identify heavy resource consumers.

Can I force quit a process from the app?

Yes. You can force quit supported user processes from the app interface. Unsaved work in that process may be lost.

What does "Force Quit" do?

Force Quit immediately terminates the selected process. Any unsaved data in that process will be lost.

Can I manage system processes?

You can only manage supported processes for your current user account. Critical system processes are protected.

Automation & Alerts

What is Low Memory Automation (Optional)?

When enabled, System Guardian can notify you when available memory drops below your configured threshold and optionally run a memory action.

What is Auto Force Quit (Advanced)?

When enabled, System Guardian can apply an automated process memory-limit action to selected eligible user processes based on your configured limit and policy mode. Enabling this feature requires explicit user confirmation. Protected system processes are excluded. Process control scope depends on macOS permissions and distribution type (for example App Sandbox vs Developer ID).

What Process Memory Limit Action policy modes are available?

System Guardian supports two policy modes in Settings → Advanced for Process Memory Limit Action:

  • Allowlist Only (default) — only processes matching your allowlist entries are eligible.
  • Never-Kill List — eligible processes above threshold are killable except entries in your never-kill list.
What is CPU Spike Alert?

When enabled (Settings → Advanced), System Guardian monitors overall CPU usage and sends a notification when CPU stays above your threshold for a configurable duration (e.g., above 90% for 30 seconds).

Are there cooldowns to prevent alert spam?

Yes. Cooldown periods are applied to automated actions and alerts to reduce repeated notifications and repeated actions.

Scheduled Actions

How do scheduled actions work?

System Guardian can run memory actions on a recurring schedule (Settings → Advanced). Two modes:

  • Interval Mode — Cycles at a fixed interval (15 minutes to 8 hours)
  • Time-of-Day Mode — Runs once per day at a specific time you set
Can I choose the action method for scheduled actions?

Yes. You can choose the scheduled memory-action method independently from low-memory automation settings.

Will a scheduled action run if one is already in progress?

No. If a manual or automatic action is already running, the scheduled action is skipped. There is also a 5-minute cooldown between scheduled actions.

Notifications

What notifications does System Guardian send?
NotificationTrigger
Low Memory Automation AlertAvailable memory dropped below threshold and a memory action was triggered
Process Memory Limit ActionA configured process memory limit was exceeded
CPU Spike AlertCPU stayed above threshold for the configured duration
How do I configure notifications?

Enable/Disable: Settings → General → "Enable Notifications." Click "Configure in System Settings..." for macOS-level control over banners, sounds, and Do Not Disturb behavior.

Can I disable specific notification types?

Each automation feature has its own toggle. You can disable specific automation and alert types independently.

Settings — General Tab

Launch at Login

When enabled, System Guardian automatically starts when you log into your computer. This uses the SMAppService API (the modern macOS method). Verify in System Settings → General → Login Items & Extensions.

Poll Interval

How often System Guardian refreshes all metrics. Range: 2 to 60 seconds. Default: 5 seconds. Lower values give more responsive monitoring but use slightly more CPU. Recommended: 3-10 seconds.

Notifications toggle

A master toggle to enable or disable all macOS notifications from System Guardian. The "Configure in System Settings..." button opens macOS Notification preferences for fine-grained control.

Settings — Advanced Tab

Auto Force Quit (Advanced)

Per-process memory limit with an enable/disable toggle. Selected eligible user processes over this limit may be force quit (with protected system processes excluded).

Per-Process CPU Highlight

Sets the threshold for red highlighting in the menu bar and dashboard. Displayed as "N×core" where 1×core = 100%. This is a visual indicator only — it does not trigger any automatic action.

CPU Spike Alert

Overall CPU threshold and duration for alert notifications. Spike duration range: 10 to 120 seconds, step: 5 seconds.

Scheduled Memory Actions

Enable and configure automatic memory actions on a schedule. Choose between interval mode (15 min to 8 hours) or time-of-day mode (once daily at a specific time).

What is Diagnostics Snapshot?

In Settings → Advanced, Diagnostics shows the latest automated-action timestamps and reasons (Low Memory Automation action, scheduled action, process action, CPU spike alert). Use "Copy Diagnostics Snapshot" to export this information for support.

Events Log

What is the Events Log?

A timeline of actions and alerts. Each event has an icon, a message, and a relative timestamp. The log keeps the 50 most recent events in memory (ring buffer). Events are not persisted to disk.

What events are logged?
  • Manual memory actions
  • Scheduled memory action triggered + result
  • Low Memory Automation action triggered
  • Manual process force quit actions
  • Automated process memory-limit actions
  • CPU spike alert triggered

Hardware-Aware Defaults

What are hardware-aware defaults?

On first launch, System Guardian detects your computer's total RAM and core count and sets sensible default thresholds. Defaults are tuned to the detected hardware profile.

SettingDefault FormulaExample (32 GB / 10 cores)
Low Memory threshold15% of total RAM (min 2 GB)4.8 GB
Per-process memory limit25% of total RAM (min 2 GB)8 GB
CPU highlight12.5% of total cores (min 200%)200%
Can I change the defaults?

Yes. All thresholds are fully adjustable through sliders in Settings. The hardware-aware values are only applied on first launch.

Are my settings validated?

Yes. On every launch, System Guardian clamps all persisted settings to valid ranges to protect against corrupt UserDefaults. Poll interval: 2-60s, RAM thresholds: 1 GB to 75% of total, CPU thresholds: 100% to (cores × 100)%.

Privacy & Security

Does System Guardian connect to the internet?

No. System Guardian makes zero network requests. There is no analytics, no telemetry, no update checks, no cloud sync. Your system data never leaves your computer.

What data does it access?
  • System statistics APIs — Memory and CPU metrics
  • IOKit GPU telemetry — GPU utilization and VRAM (read-only)
  • Process list — Running process resource usage
Does it store any data on disk?

System Guardian stores only your settings preferences in the standard macOS UserDefaults system. No logs, no databases, no other files are created.

Technical Details

What APIs does System Guardian use?
SubsystemAPIFunction
MemoryMach kernelhost_statistics64(HOST_VM_INFO64)
CPUMach kernelhost_processor_info(PROCESSOR_CPU_LOAD_INFO)
GPUIOKitIOAcceleratorPerformanceStatistics
Swapsysctlvm.swapusage
ProcessesSystem APIsUsage listing and manual actions
Memory ActionsSystem memory APIsUser-triggered and optional automated actions
Login ItemServiceMgmtSMAppService.mainApp
NotificationsUserNotificationsUNUserNotificationCenter
How much CPU does System Guardian use?

At the default 5-second poll interval, approximately 0.1-0.3% CPU on average. Kernel API calls take less than 1ms each. Process scanning via ps is the slowest operation and runs on a background thread.

How is the app structured?

~2,400 lines of Swift across 7 source files. No external dependencies.

  • SystemGuardianApp — App entry point, NSStatusItem, menu bar
  • AppState — Central @Published state hub, polling, memory actions
  • SystemMonitor — Kernel APIs: host_statistics64, host_processor_info, IOKit
  • ProcessManager — Process listing and control actions
  • Watchdog — Optional automation, notifications
  • DashboardView — SwiftUI dashboard with Swift Charts
  • SettingsView — General + Advanced settings tabs

Troubleshooting

The menu bar icon is missing

Make sure System Guardian is running (check Activity Monitor). If you have many menu bar items, macOS may hide some — try closing other menu bar apps or using a menu bar management tool.

Memory actions do not always show large gains

This can be normal when the system is already in a healthy state. Results depend on current workload and reclaimable cache.

A process still appears high usage after action

Some workloads naturally remain high for a while (for example compiling or rendering). Wait for the next poll cycles and verify usage trends over time.

Can I monitor processes owned by other users?

No. System Guardian is limited to supported processes under your current user account and cannot control protected system services.

Settings reset after update

System Guardian stores settings in macOS UserDefaults. These persist across updates as long as the bundle identifier remains the same. If settings appear reset, the hardware-aware defaults may have been reapplied due to a migration flag.

The app won't launch — "damaged" or "unidentified developer"

System Guardian is signed and notarized by Apple. If you see this warning:

  1. Right-click the app → Open (bypasses first-launch Gatekeeper check)
  2. Or go to System Settings → Privacy & Security → scroll down and click "Open Anyway"

This only happens once per downloaded version.