WebKit is quite heavily used, not just by Safari, but by many other apps like the Finder’s Quick Look and Mail, to preview web pages. I’ve been unable to find any documentation describing these lower-level subsystems in WebKit, but presume from their names that WebKit.Networking is mainly concerned with handling web and related protocols and the communications functions within WebKit, while WebKit.WebContent is more about handling and rendering web content. This is shown in my sample figures for a typical single log. In almost all log periods, the first process formed around 40% of the total log load, and the second came in a more distant second with around 8-10%. You may recall from the previous analysis that the two processes accounting for much, sometimes the majority, of the log load were and. These data were obtained from my iMac’s logd log as detailed in that previous article, and have been examined using Numbers. In my second dip into the log data for the last 3+ months, I’m going to look at WebKit internals, and some of the undocumented macOS scheduling and dispatching system, CoreDuet.
Last week I showed some simple analyses of log data which revealed how the macOS unified log can reflect activities and patterns of app usage from many weeks earlier.