In the old days, one could run the Console application and search through the system log to identify when certain events occurred. One of the more popular events we’ve received questions about is “What is waking up my Mac?” since many users like to put their Mac to sleep when they’re not using it to save energy. A bit of Google-Fu revealed that others have this question as well, with this post over at MacRumors: new Console- finding Wake Reason?
The answer to the user’s query as to what is waking up their Mac was to enter the following in the Terminal:
log show --style syslog | fgrep "Wake reason"
This is using the new log command, asking it to show events using the old syslog style, and only display ones that match (that’s what fgrep does) the phrase “Wake reason.” Here’s some of the results:
2018-09-26 16:07:59.228409-0400 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.LidOpen (User) 2018-09-26 16:28:36.057070-0400 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.ACDetach (Maintenance)
This is all well and good and answered the original question, but we wanted to dig a bit deeper. Instead of waking, we modified the search to just look for the word “sleep.” While there was a lot of material, we noticed that several useful items for both wake and sleep contained the term “[powerd:sleepWake].” We’ll guess powerd is the daemon (also known as a background process) and sleepWake is a sleep or wake event. So, let’s modify the search term like so:
log show --style syslog | fgrep "[powerd:sleepWake]"
This produces what we think is much more interesting output, and of course shows both sleep and wake events:
2018-04-03 08:31:48.934423-0400 localhost powerd: [powerd:sleepWake] Entering Sleep state due to 'Clamshell Sleep' 2018-04-03 08:53:39.153032-0400 localhost powerd: [powerd:sleepWake] Wake from Normal Sleep [CDNVA] due to EC.ACAttach/HID Activity:
Finally, if you’d like to save the results of your search to a file, you can redirect the output to a file, which should appear in your home directory, like so:
log show --style syslog | fgrep "[powerd:sleepWake]" > MacBook-pro-sleepwake.txt