When your Mac wakes form sleep, the OS X Kernel will output a message to the system console, containing a code that identifies the reason for the system having been woken up. This can be anything from a lid being opened, to a key being pressed.

Since you can access these logs using the System Console utility, if your system is regularly waking unexpectedly up after you put it to sleep, then you can use the Console to peruse the system logs and hopefully find the reason for the system being woken up.

To use the console for this, first open the Console program and then select the “All Messages” section. Now use the search bar at the top of the Console window to only include entries including the term “wake” or if you care to be more specific then use “wake reason.”

Note that this can be done similarly using the following command in the Terminal, which might be more convenient for people logging into a system remotely using SSH:

syslog | grep -i "Wake reason"

When you do this either in the Console or in the Terminal, you will see an output similar to the following:

3/19/14 5:25:07.000 PM kernel[0]: Wake reason: EC.LidOpen (User)
3/19/14 9:04:28.000 PM kernel[0]: Wake reason: EHC2

The codes after “Wake Reason:” indicates the cause for the waking event, which can be one of the following:

• EHC

  This stands for Enhanced Host Controller and usually has a number appended, such as “EHC1” or “EHC2,” to indicate a specific controller (ie, the first or perhaps second USB controller on the system). These can be USB keyboards, bluetooth devices, or similar user input device, and this type of wake event usually only happens if a physical button is pressed on the device. If you have not purposefully issued a button press, then this may indicate a broken button or two, or faulty firmware on the device.

• EC.cause

  This option is a fairly self-explanatory listing of the cause, which may mirror other options also output to the terminal. A few of examples you might see here are “EC.LidOpen,” “EC.PowerButton,” and “EC.SleepTimer” to indicate you have raised the lid of a laptop, pressed its power button, or the system’s sleep timer may have activated the system.

• LID0

  On some MacBook systems, this may indicates the opening of the lid.

• OHC

  The Open Host Controller indicates a USB or FireWire device such as an audio interface, storage device, or printer may have been the reason for the system waking. Therefore, try checking any attached peripheral devices by unplugging them and testing whether that at least bypasses the problem.

• PWRB

  This means the power button was pressed.

• RTC

  This stands for Real Time Clock, and suggests the system’s hardware scheduling controllers such as the SMC was responsible. If this is the case, then either try checking your system’s wake schedule in the Energy Saver system preferences, or try resetting the SMC to keep this from happening.

• USB#

  This indicates an attached USB device played a role in waking the system. The number indicates the device’s enumerated value (e.g., USB1, or USB3), which is just the sequence it was identified by the system.

These codes show which system features were at least partly responsible for waking the system. Keep in mind that often you may see multiple items listed that correspond to the same sleep event. For instance, upon opening the system’s lid, not only might the EC.LidOpen event trigger, but the Real Time Clock and the Enhanced Host Controller might also show activity. With these codes and the console you can better determine what might be the cause of your system waking from sleep, instead of randomly trying various maintenance routines and system resets to figure the problem out.

Some of the information for this hint came from this OS X Daily article.