Sleep modes in OS X, as with other operating systems, allow you to quickly lock your Mac, and use less energy when not in use while being ready to resume operation almost instantly. However, unlike a full shutdown, this readiness to resume means that one of a number of events might result in your Mac being woken from sleep. These can be purposeful interactions, but at other times the system might wake for unknown reasons, which can be a bit of a problem.
Luckily, whenever OS X wakes from sleep, the kernel will log the reason for this wake event, which can be used to troubleshoot why your Mac might be waking up on its own. To figure this out, you can open the Console utility (in the Applications > Utilities folder) and choose the “All Messages” section to view all of the system logs. To narrow down the plethora of system log entries, you can search for “wake” or “wake reason” in the Console. Note you can also do this in the Terminal by running the following command:
syslog | grep Wake
These approaches will reveal system entries, such as the following:
1/11/15 7:14:05.000 PM kernel[0]: Wake reason: EC.LidOpen RTC EHC2 (User) 1/11/15 14:34:23.000 PM kernel[0]: Wake reason: PWRB
EHC or XHC — The Enhanced Host Controller (or Extended Host Controller) code generally is followed by a number (e.g., “EHC1” or “EHC2”). This indicates the specific input device (USB, Bluetooth, or otherwise). Generally this code indicates a button has been pressed on the device. To troubleshoot this issue, try unplugging all of your external devices and see if doing so stops the system wakes, then systematically add them back to see if you can find the one that is causing the issue.
OHC — The Open Host Controller suggests peripheral USB or Firewire interfaces, either for storage, audio, printing, or otherwise, might have been the cause for the issue. As with other controller-based wake events like EHCs, this calls for testing each separately to see what might be the cause for the problem.
USB# — This suggests an attached USB device caused the wake event. The number in this code is the enumerated USB device ID, which will not mean much to you, but simply indicates some hub, interface, controller, or other USB device you have attached to your system was the cause for the wake event.
EC.cause — This code includes a specific phrase of what caused it, including things like “EC.LidOpen” or “EC.PowerButton” which tell you what the reason for the wake event was.
GIGE — This stands for “Gigabit Ethernet” and suggests you might have Wake for Network Access checked in the Energy System preferences
LID0 — On some MacBook systems, this indicates the lid was opened.
PWRB — As the code suggests, this means the power button was used to wake your Mac.
RTC — This stands for Real Time Clock, meaning your Mac was scheduled to start up at a specified time in the Energy Saver system preferences. Either try checking your system’s wake schedule in the System Preferences, or reset your Mac’s SMC to keep this from happening.
With “wake reason” searched in the Console utility, you can see the various codes for why the system was woken, and when it was woken.
Overall, these codes should allow you to narrow down what might be waking your Mac, and help you troubleshoot and overcome the problem. While these are listed separately here, keep in mind that more than one might be listed in the system logs, so you may see “EC.LidOpen RTC EHC2” or “GIGE EHC,” indicating multiple devices being activated have caused the system to wake up.