The Silent Orchestrator
macOS relies on a vast array of background plugins to manage system events. When you plug in an external monitor, connect a Bluetooth headset, or when your laptop battery drops below 10%, macOS does not hardcode the response to these events in the kernel. Instead, it uses a central daemon called UserEventAgent.
The UserEventAgent process loads dozens of plugins (from Apple and third-party developers) and listens for hardware or software triggers. When an event occurs (e.g., “Battery = 10%”), the agent fires the corresponding plugin (e.g., “Display the Low Battery Warning notification”).
Because it manages so many diverse plugins, the UserEventAgent maintains a complex state cache in RAM and on the disk. If a third-party application installs a poorly coded plugin, or if the state cache becomes corrupted during an aggressive macOS update, the UserEventAgent will catastrophically crash into an infinite loop. The symptom is unmistakable: you will hear your Mac’s fans spin up to maximum speed, and checking Activity Monitor will show the UserEventAgent consuming 100% or even 200% of your CPU, draining your battery in under an hour. Force-quitting the process in Activity Monitor rarely fixes it permanently; you must clear its underlying cache via the Terminal.
Locating the Event Caches
The UserEventAgent manages states for both the global system (running as root) and the individual user (running under your username).
Therefore, you must clear caches in multiple locations to ensure the corrupted plugin state is entirely eradicated.
Purging the Cache via Terminal
You must use the Terminal with elevated (sudo) privileges to aggressively delete the cache and safely restart the daemon.
- Open the Terminal application.
- First, forcefully terminate all instances of the
UserEventAgentdaemon. This stops the runaway CPU usage immediately:
sudo killall UserEventAgentPress Enter, type your Mac’s administrator password (the characters will remain invisible), and press Enter again.
- Next, delete the temporary system-level caches associated with the agent. (macOS stores many of these in the highly randomized
/private/var/folders/directory, so we will use a wildcard purge):
sudo rm -rf /private/var/folders/*/*/*/com.apple.UserEventAgent*- Finally, delete any corrupted user-level preference states that might be triggering the loop:
sudo rm -f ~/Library/Preferences/com.apple.UserEventAgent.plistInvestigating Rogue Plugins (If the CPU Spike Returns)
If the UserEventAgent CPU spike returns a few hours after clearing the cache, you have a deeper problem: a third-party software plugin is actively injecting bad data into the agent. You must identify and delete the rogue plugin.
You can list all the third-party plugins currently hooking into the agent by checking the LaunchAgents and LaunchDaemons directories:
ls -la /Library/LaunchAgents
ls -la /Library/LaunchDaemons
ls -la ~/Library/LaunchAgentsLook for any .plist files belonging to old software you no longer use (e.g., an old VPN client, a legacy antivirus scanner, or an old Wacom tablet driver). If you spot a suspicious file (e.g., com.oldvpn.agent.plist), you must forcefully unload it and delete it.
sudo launchctl unload /Library/LaunchDaemons/com.oldvpn.agent.plist
sudo rm -f /Library/LaunchDaemons/com.oldvpn.agent.plistReboot your Mac. Upon restarting, the UserEventAgent will generate a clean cache and will only load healthy, validated plugins, permanently resolving the massive CPU drain.