I was able to gather some insight thanks to the execsnoop
tool. Description from the man page:
execsnoop prints details of new processes as they are executed. Details such as UID, PID and argument listing are printed out.
Example output:
[raul@~/bitbar$] sudo execsnoop -v STRTIME UID PID PPID ARGS 2016 Jan 14 17:56:09 0 1 0 launchd 2016 Jan 14 17:56:09 501 90311 1 influxd 2016 Jan 14 17:56:16 501 90312 321 kcc 2016 Jan 14 17:56:16 0 1 0 launchd 2016 Jan 14 17:56:16 0 90313 1 kcm 2016 Jan 14 17:56:19 0 1 0 launchd 2016 Jan 14 17:56:19 501 90314 1 influxd
execsnoop
uses DTrace, and I found this great post with some other scripts/tools: http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scripts-for-mac-os-x/.
In Mac OS X (Darwin) and *nix kernels, threads are represented as processes, and that's why the count towards the ulimit
and sysctl
limits.