EGD is a daemon that watches for system activity, then writes that activity to / dev/random to feed its entropy pool. (See man 4 random.)
EGD observes activity from three sources:
- keyboard and mouse events (using Carbon Events)
- distributed notifications (generated by many system tasks, including switching applications and changing directories)
- polling of the kernel's statistics reports (namely vm_statistics, host_load_info, and host_cpu_load_info)




