What is backupd on Mac?

What backupd does

backupd lives in /System/Library/CoreServices/TimeMachine/backupd and runs as root. When a backup starts (hourly by default, or when you click Back Up Now), it:

1. asks fseventsd which folders changed since the last backup
2. takes an APFS snapshot of your disk so the copy is consistent
3. copies changed files to the backup disk and thins out old backups

You’ll also see backupd-helper, which schedules backups and handles local snapshots.

Why it uses CPU, disk and network

• The first backup: everything is new.
• Large files that change often: a Docker Desktop disk image (Docker.raw), VM disks from UTM or Parallels, and Photos or Music libraries. Each change to a 60 GB file can mean a large incremental copy.
• Lots of tiny files: node_modules, build output and caches. File count costs more than file size.
• Network destinations: a NAS or a Time Capsule adds encryption and network overhead.
• Thinning: deleting old backups on a nearly full disk takes time.

How to make it calm down

Check what it’s doing:

tmutil status
tmutil destinationinfo

Exclude folders that don’t need backing up. In System Settings › General › Time Machine › Options, add ~/Library/Containers/com.docker.docker, VM folders, ~/Library/Caches and build output. From Terminal, a sticky exclusion that follows the folder:

tmutil addexclusion ~/code/my-app/node_modules

Back up less often by turning off automatic backups and running tmutil startbackup when it suits you, or choose a daily schedule in Options.

Read Time Machine’s own log if a backup keeps failing:

/usr/bin/log show --last 2h --predicate 'subsystem == "com.apple.TimeMachine"' --style compact | tail -40

When to worry

backupd should only exist in the TimeMachine folder inside /System/Library/CoreServices and run as root. Confirm with ps -o user,command -p $(pgrep -x backupd). A backup that never completes and restarts every hour is a destination problem (a failing disk or flaky network share), not malware; run Disk Utility › First Aid on the backup disk.

Seeing it in Stat Space

Stat Space’s disk module shows read and write throughput live and keeps 30 days of history, so a Time Machine run is easy to spot as the reason your Mac felt slow at 3 p.m. Its Disk tab lists top apps by I/O, and when an eject fails it names the apps still holding the disk.