WhatsRunning - Know what's running on your Android device

en ru

What does WhatsRunning do?
Process Details
More Details
Filtering, Sorting and Search
Process Watcher
Integration with PMX
Using WhatsRunning with ADB
WhatsRunning Versions
- Paid Features
FAQs
Downloads / Screenshots
Ratings / Reviews
Contact Us

More FAQs

What does WhatsRunning do?

WhatsRunning shows you what's running on your device, which includes:

Processes
Almost everything about native processes:
- PPID, PID, UID, GID, groups, child count, thread count
- SELinux context, Linux capabilities, CGroups
- CPU usage, RAM usage, SWAP usage
- CPU priority, I/O priority, OOM kill score
- Commandline, executable path, age, I/O (storage) usage
Android apps
Details about framework, system and user apps:
- App name, package name, importance, last active time
- Tasks (activities) names, running status, last active time
- App services names, types, running status, number of clients, start time, last active time
- Init and framework services, if applicable
Memory usage
- Total, free and sparable RAM
- RAM used by active apps, cached apps, non-app processes, kernel and ZRAM
- Total Swap, usage by apps and non-app processes
These details are definitely going to clear many of your confusions you might have since ever about Android's memory management e.g.
- Why your RAM is always full, even when you are not using many apps?
- Which apps' processes are not killed even when you are not using them?
- What are cached apps and which of them is on the hit list of Android operating system to be killed next?
System Services
Init (native) and framework (Java) services which keep on running forever.
App Services
Background (started and bound), foreground and persistent services running inside app processes.
Active Apps
Apps actively running in background or foreground, or in cached state.
App State Log
A timestamped log showing apps switching between active and inactive states.
Scheduled Tasks
Alarms which may wakeup the device repeatedly, and scheduled jobs the apps run in background.
Auto-Starting Apps
Apps which start on device boot.
Wake Locks / Wakeup Calls
Apps which have been keeping the device awake. Also a count showing how many times an app awoke the device from sleep.
Battery Hogs
A list of the apps running in foreground and/or background longer than the others.
Battery State
A service notification showing current state of battery including battery level, temperature, (dis)charge rate, estimated time, average drain rate with display on, off and in doze mode.
See screenshots for more details.
Processes State
A service notification showing count of running / dead processes and system / user alive apps. See Process Watcher for more details.

Also see Github README.

Process Details

Process name (commandline)
PID
UID / GID
CPU usage
RAM / swap usage
Android app packages count
App tasks (activities) count
App services count
Process age

For more verbose details, please see screenshots.

More Details

Memory Info

Please see the details here.

App Services

App name
Service name
Service type: background, foreground, system, persistent etc.
No. of client apps bound to the service
When the service was started
When the service was last active
App UID
App state: running or stopped

Active Apps

App name
Count of activities (screens) and services running in the app
App importance
When the app started
When the app was last active
App UID
App state: very active, less active, or inactive
Kill score - chances of the app being killed when the device needs to spare RAM

App State Log

App name
Timestamp - when the app changed its state
New state (of app package)
New state (of app UID)
App UID
App process PID

Summary view

Summary view shows how many times the app has switched to a state since the App State Log was enabled.

App name
New state
App UID
Count

The screenshot shows that the Telegram app has switched to "Foreground Service" state 41 times while the Firefox was opened (switched to "Foreground" state) 35 times.

Alarms

App name
If the alarm will wake up the device
When will alarm fire

Scheduled Jobs

App name
UID
Job service name
Conditions which must meet before the job is run

Auto-Starting Apps

App name
Broadcast receiver(s) name
UID

Wake Locks

App name
UID
Wake lock name
Duration (for how long the lock was held)
Count (how many times the lock was held)

Wakeup Calls

App name
UID
Alarm name which woke up the device
App package name
Wakeup count

Battery Hogs

App name
UID
CPU and network usage
App's active usage duration
App's foreground (high priority) and background (low priority) activity duration
Started services total duration
Started services count
Started service (shown only if enabled in drop-down menu)
App name
Service name
Started service duration
Service start count

Battery Watcher service shows a persistent notification with battery stats:

Battery drain or charge rate; temperature; level; and estimated time (to fully drained or fully charged)
How long the device has run on battery out of total time
Battery time when display was on; percentage battery drop per hour
Battery time when display was off; percentage battery drop per hour
Battery time when device was dozing
Average battery time per percentage battery drop
Average network usage per percentage battery drop

Battery stats can be reset from the top right menu of Battery Hogs screen.

Filtering, Sorting and Search

You can filter out the processes and apps you are not interested in.

There's a long list of keywords you can use to search the specific things in the process list you are concerned about.

And an even longer list of parameters you can apply to sort the process list.

Type: Types defined in the process filters. Please see the screenshot above.
Memory: RAM
CPU Usage / CPU Impact: Please see What's the difference between "CPU Usage" and "CPU Impact"?
I/O: Data read from storage and written to storage. See proc(5).
PPID / PID / UID / Age: Parent process id, process id, UNIX user id, and age of the native Linux process. See proc(5).
Packages / Activities / Services: Number of apps, their visible tasks, and services running inside the native process.

Process Watcher

Did you ever wonder:

Which apps are not sleeping when you are sleeping? And they keep on starting and dying, and doing their work without your knowledge? When do they start, which components they use, for how long they are running, how much resources they use, and when they die?
Or which app or process is misbehaving on your device, killed and started again and again, wasting your precious battery and other resources? How may times did it restart in the last 24 hours?
Or which process looks like an alien, a malware, a threat to your privacy?

Process Watcher is a single and simple answer to all of these questions. It keeps running in the background with your consent, watching processes continuously. A notification is persistently showing a brief summary of the processes life and death.

You tap on the notification or "Show watcher data" menu item to see which processes have started and stopped since the watcher was started. Simple!

Use the menu items to see the list of all processes or those with some change in their state.

PID field shows how many times the process has been recreated since the watcher started.

In this mode an average consumption of resources (CPU, RAM etc.) is shown for every process instead of the instantaneous values.

Please note that due to the limitations of common Android devices, Process Watcher is not a realtime Linux process tracker. So it can miss very short-lived processes. If you are interested in the technical details, please read this great article: The Difficulties of Tracking Running Processes on Linux.

Integration with PMX

WhatsRunning is integrated with PMX so you can open one from the other.

So from WhatsRunning you can switch to PMX to find out what permissions a running (or dead) app is granted.

Similarly, from PMX you can switch to WhatsRunning to find out if an app with restricted permissions is still running. If yes, in what state it is and how much resources it is using.

This is particularly helpful when analyzing the effect of permissions like RUN_IN_BACKGROUND.

Using WhatsRunning with ADB

Limitations of ADB

ADB is not as powerful as root is. In our case, for instance, WhatsRunning takes more time to build the list of processes when it's running with ADB.

Additionally, on some OEM ROMs the ADB functionality might be crippled due to lacking permissions or other restrictions. You can check the current status of what ADB can do in About -> Privileges (menu item):

Unfortunately we cannot do anything about it. And therefore some features are available only on rooted devices.

Specifically the following information is available only on rooted devices:

Process I/O (Input/Output) size and I/O priority
ZRAM size and usage details (swap)
Process exe (executable) path

However some OEMs add extra settings to control ADB's privileges. For instance "Disable Permission Monitoring" on Oppo phones and "Allow granting permissions" in Security Settings on Xiaomi phones. See this question for more details.

The following instructions apply to near-AOSP ROMs. Customized ROMs might have different or missing settings.

Android 10 and below

So here we start how you can make WhatsRunning work with ADB.

If your device is not rooted, you need to turn Wireless ADB on before using WhatsRunning. Some devices have ADB over Network or Wireless Debugging setting available in Developer options:

If you don't have this setting on your device, you need to connect the device to a USB host like PC once after every reboot.

Unhide Developer options screen:

Go to Settings -> About and tap Build number five to seven times.
Developer options should appear directly under Settings or in Settings -> System at the bottom.

Enable wireless debugging:

Enable Android debugging in Developer options.
Connect the device to the PC with a USB cable.
On PC open a terminal window (or command prompt on Windows) and run:
adb tcpip 5555
You must have adb executable available on your PC to run the above command. If not, here's the download link.

Optional steps for verification:

Disconnect the USB cable from the device.
Connect your device and PC to a common Wi-Fi network.
Get the IP address of the device (usually in Wi-Fi settings or in Settings -> About), say it's 192.168.1.1.
On PC run:
adb connect 192.168.1.1
Run again:
adb shell id -u
It should print 2000 (or 0).

Connect WhatsRunning to ADB:

Run WhatsRunning app and check ADB Shell in drawer. Enter port 5555 and tap connect.
Allow USB Debugging if asked.

Leave the Android debugging enabled.

For more details see this.

Android 11 and above

On Android 11 and above, it's possible to turn on Wireless Debugging without connecting to a PC.

Connect your device to a Wi-Fi network.
Open WhatsRunning and Developer Options in Split-Screen mode. See instructions above how to unhide Developer Options.
Enable Wireless debugging and Disable ADB authorization timeout in Developer Options. The latter ensures that you don't have to repeat the next two steps (pairing) again and again.
Open Wireless debugging and tap on "Pair device with pairing code". Note the pairing code and port number.
In WhatsRunning check ADB Shell in drawer, enter both parameters in the shown fields, and tap pair.
After successful pairing now it's time to connect. Enter the new port number from Wireless debugging in the shown field and tap connect.

Now you can leave the Wireless debugging enabled. Or better disable it and leave the USB debugging enabled.

If you entirely turn off the debugging in Developer options, or after every reboot, you need to repeat the last step.

For more details see this.

Here's a 1 minute video guide:

WhatsRunning Versions

WhatsRunning is available in two variants: Free and Pro. Both flavors are available as Play Store and GitHub / Telegram releases. All four variants have different package names, so can be installed simultaneously.

Paid Features

RAM usage detail:
- Total RAM, free, sparable
- RAM used by active apps, cached apps, non-app processes, kernel and ZRAM
- Total Swap, usage by apps and non-app processes
Process detail:
- PPID, PID, UID, GID, groups, child count, thread count
- SELinux context, Linux capabilities, CGroups
- CPU usage, RAM usage, SWAP usage
- CPU priority, I/O priority, OOM kill score
- Executable path, age, I/O usage
- App name, importance, last active time
- Tasks (activities) names, running status, last active time
- App services names, types, running status, no. of clients, start time, last active time
- Init and framework services, if applicable
Complete lists of:
- System services; init and framework
- App services
- Active apps
- App state log
- Apps alarms and scheduled jobs
- Auto-starting apps
- Wake locks and wakeup calls
- Battery sipper apps

See screenshots for more details.

FAQs

Why WhatsRunning requires root or ADB access?

Android won't allow a normal user app to read the process information of other apps, even not completely of its own.

That's why we run a separate process with high privileges to circumvent the restrictions.

By default, the background process (daemon) is run with ADB UID (2000) or (if rooted) System UID (1000). On rooted devices UID can be changed in Advanced Settings.

My device isn't rooted. How can I use WhatsRunning?

Use with ADB. Please do read the note at the start. There are some limitations; more on some devices, less on others.

Why WhatsRunning requires INTERNET permission?

The standalone Pro version requires internet connection for license verification. The other versions - Free and Play Store Pro - can work completely offline. Though Play Store app needs internet connection for license verification.

Optional use of android.permission.INTERNET permission:

Check for app updates. You can disable this in app settings.
Fetch help contents of this webpage that you view in drawer -> Help.

Local (on-device) use of android.permission.INTERNET permission:

Android does not allow apps to create network sockets without having the INTERNET permission even if they are meant to be used only locally and not for an internet connection. WhatsRunning has two uses of local (on-device) connections (the ability to create localhost sockets at 127.0.0.1) for Inter Process Communication (IPC):

WhatsRunning starts a background process with root / ADB privileges and talks to that process over network socket. After the initial handshake, both processes start talking over Binder. We have no better way to do this because Android doesn't allow apps to talk over UNIX domain sockets either.
If your device is not rooted and you use WhatsRunning with ADB, then connecting to adbd requires internet permissions. See Is PMX spying on me using ADB over network?.

So if the app is unable to create or use local network sockets, it will fail. And if you want to stop WhatsRunning from using internet, it must not stop the app from talking to on-device processes over loopback interface for IPC. This is usually the case with iptables-based firewalls like AFWall+ and VPN based firewalls like NetGuard. But some ROMs have a built-in feature to disallow network access:

This not only prevents the app from using internet but also disables its ability to create loopback sockets for IPC. So WhatsRunning won't be able to get root / ADB privileges if this permission is denied.

How much privacy friendly WhatsRunning is?

We are not interested in you or your device at all. We do not spy on you. We do not collect your data in any way, not even the crash logs. We believe in our users being educated, well-informed, and in-charge of their privacy. WhatsRunning strengthens you to protect your privacy.

You may also want to see our Privacy Policy.

What are "Orphan Activities / Services"?

When an app is running in background and is not in active usage, the Android operating system may kill its native process at any stage e.g. to spare RAM or to preserve other resources. But its Activities (the visible part) and Services may still be kept in record so that to resume at a later stage. Such components are labeled as "orphan" in WhatsRunning.

What's the difference between "CPU Usage" and "CPU Impact" in sorting?

CPU Impact is simply the time a process spends while using the CPU. CPU Usage is the ratio of CPU time to the age of process.

For details see utime, stime and starttime fields under /proc/[PID]/stat in proc(5).