When your Mac wakes form sleep, the OS X Kernel will output a message to the system console, containing a code that identifies the reason for the system having been woken up. This can be anything from a lid being opened, to a key being pressed.
Since you can access these logs using the System Console utility, if your system is regularly waking unexpectedly up after you put it to sleep, then you can use the Console to peruse the system logs and hopefully find the reason for the system being woken up.
To use the console for this, first open the Console program and then select the “All Messages” section. Now use the search bar at the top of the Console window to only include entries including the term “wake” or if you care to be more specific then use “wake reason.”
Note that this can be done similarly using the following command in the Terminal, which might be more convenient for people logging into a system remotely using SSH:
syslog | grep -i "Wake reason"
When you do this either in the Console or in the Terminal, you will see an output similar to the following:
3/19/14 5:25:07.000 PM kernel: Wake reason: EC.LidOpen (User) 3/19/14 9:04:28.000 PM kernel: Wake reason: EHC2
The codes after “Wake Reason:” indicates the cause for the waking event, which can be one of the following:
This stands for Enhanced Host Controller and usually has a number appended, such as “EHC1” or “EHC2,” to indicate a specific controller (ie, the first or perhaps second USB controller on the system). These can be USB keyboards, bluetooth devices, or similar user input device, and this type of wake event usually only happens if a physical button is pressed on the device. If you have not purposefully issued a button press, then this may indicate a broken button or two, or faulty firmware on the device.
This option is a fairly self-explanatory listing of the cause, which may mirror other options also output to the terminal. A few of examples you might see here are “EC.LidOpen,” “EC.PowerButton,” and “EC.SleepTimer” to indicate you have raised the lid of a laptop, pressed its power button, or the system’s sleep timer may have activated the system.
On some MacBook systems, this may indicates the opening of the lid.
The Open Host Controller indicates a USB or FireWire device such as an audio interface, storage device, or printer may have been the reason for the system waking. Therefore, try checking any attached peripheral devices by unplugging them and testing whether that at least bypasses the problem.
This means the power button was pressed.
This stands for Real Time Clock, and suggests the system’s hardware scheduling controllers such as the SMC was responsible. If this is the case, then either try checking your system’s wake schedule in the Energy Saver system preferences, or try resetting the SMC to keep this from happening.
This indicates an attached USB device played a role in waking the system. The number indicates the device’s enumerated value (e.g., USB1, or USB3), which is just the sequence it was identified by the system.
Some of the information for this hint came from this OS X Daily article.
This is a handy tip. Thanks.