Back to All Guides
Memory7 min read·September 9, 2026

Mach RSS vs. Virtual Memory: How to Track Down Real Memory Leaks on macOS

Why does Activity Monitor show 120 GB of virtual memory while your Mac has only 16 GB of physical RAM? Learn how Mach kernel physical RSS mapping reveals true memory hogs.

Marcus Chen
Marcus Chen
Systems Performance Architect · MacSentinel Engineering

## Why Activity Monitor's "Memory" Column Misleads You

Open Activity Monitor right now and sort by **Memory**. You will likely see processes claiming 4 GB, 8 GB, or even 30 GB of memory. Yet, your Mac only has 16 GB of unified RAM, and the system is not crashing.

Why? Because traditional tools conflate **Virtual Memory Size (VSIZE)** with **Physical Resident Set Size (RSS)**.

Virtual Memory (VSIZE):   |████████████████████████████████████████| (Address space reserved, mostly empty)
Resident Memory (RSS):    |████████| (Actual physical silicon transistors allocated)
Wired Memory:             |████| (Kernel locks that cannot be paged out)

---

The Three Layers of macOS Memory

To understand where your RAM actually goes, you must examine three metrics exposed by the Mach kernel:

1. **Physical RSS (`resident_size`)**: The actual physical bytes of RAM the process holds in hardware memory right now. 2. **Wired Memory (`wire_count`)**: Memory allocated by device drivers, audio engines, and the Darwin kernel that can never be swapped or compressed. 3. **Compressed Memory**: Memory pages compacted by the OS compressor to prevent disk swapping.

When an app has a memory leak, it rarely manifests as a clean spike in VSIZE. Instead, it slowly drives up **Anonymous Resident Pages** and fills the **Compressed Memory Pool**, triggering kernel page-fault thrashing.

---

Why Treemaps Are the Gold Standard for RAM Inspection

Tables with hundreds of scrolling rows make it impossible to grasp spatial hierarchy. A process allocating 6 GB across 14 helper processes (like Google Chrome, Slack, or Xcode) gets fragmented into dozens of small rows.

**MacSentinel groups processes hierarchically and renders them in an interactive Squarified Treemap:**

- **Visual Weight**: A 4 GB process occupies 25% of your screen visually. You don't have to read tiny numbers to identify hogs. - **Process Clustering**: All auxiliary renderer processes, language servers, and sandboxed daemons are grouped into their parent application container. - **Physical RSS Precision**: Colors reflect physical memory pressure, from cool cyan (healthy active memory) to glowing amber and crimson (wired memory pressure and runaway growth).

With MacSentinel, diagnosing a memory leak takes two seconds: you look for the largest colored rectangle on the canvas.

Native macOS App • Notarized by Apple

Inspect Your Mac with True Mach Precision

Stop relying on delayed polling averages or slow bloated utilities. Download MacSentinel and get real-time Apple Silicon execution deltas, RAM treemaps, and deep ~/Library uninstallation today.