How to find system wake causes in OS X

Whenever your system wakes from sleep, the OS X Kernel will output a small code to the system console that indicates the reason for the wake event. Since you can access the system console using Apple's Console utility, if your system is regularly waking up when you have put it to sleep, then you can help track down the reason using these codes.

To locate these codes, first open the Console program. Next, select "All Messages" in the sidebar, which will bring up the output from active and ongoing system events. Now enter the term "wake" (or more specifically, "wake reason") in the search bar at the top-right of the Console window toolbar. If you are using the OS X Terminal to monitor a remote system via SSH, then you can perform a similar console search by running the following command:

syslog | grep Wake

When you do this, you will see an output similar to the following:

3/18/13 5:14:06.000 PM kernel[0]: Wake reason: EC.LidOpen RTC EHC2 (User)
3/18/13 10:54:38.000 PM kernel[0]: Wake reason: EHC2

The codes after "Wake reason:" indicates the cause for the waking event, which can be one of the following:

• EHC -- This stands for Enhanced Host Controller and is often followed by a number such as "EHC1" or "EHC2," to indicate a specific controller (such as the first or second USB controller on the system), which can be a USB hub, Bluetooth device, or similar user input device. This usually only happens if a physical button is pressed on the device, which may indicate a broken button or two if you have not manually awakened your device.
  
  If this is constantly the cause of your system waking, try unplugging all devices from your USB ports (including keyboards and mice) and also try disabling Bluetooth on your system to see if that clears the problem. Then try re-enabling each, one at a time, and testing devices connected through it.
• EC.cause -- This option gives you a fairly self-explanatory output of the cause, which may mirror other options. A couple of examples you might see here are "EC.LidOpen" or "EC.PowerButton" to indicate you have raised the lid of a laptop or have pressed its power button.
• GIGE -- This indicates the Ethernet network connection was the cause for waking, likely due to the "Wake for network access" option being checked in the Energy Saver system preferences.
• LID0 -- This may be the indicator used for the opening of the lid on some MacBook systems.
• OHC -- This stands for Open Host Controller and indicates that a USB or FireWire device such as an audio interface, storage device, or printer was the cause for the wake event. As with EHC-based events, try checking any attached peripheral devices.
• PWRB -- This indicates the power button was pressed to bring the Mac out of sleep. If this is occurring when you have not manually pressed the button, it indicates the button may be faulty, or you might try an SMC Reset to attempt to fix the way the button is being handled.
• RTC -- This stands for Real Time Clock, and suggests the system's hardware scheduling controllers (i.e., the System Management Controller, or SMC) was responsible. Either try checking your system's wake schedule in the Energy Saver system preferences or reset the SMC to keep this from happening.
• USB# -- This indicates an attached USB device played a role in waking the system, and can be any enumeration such as USB1 or USB3.

These codes show which details were at least in part the cause for the wake event. In some cases, you may see multiple items listed, such as the example above where upon opening the system's lid, not only did the EC.LidOpen event trigger, but so did the Real Time Clock and the Enhanced Host Controller. With these codes and the console you can better determine what might be the cause of your system waking from sleep, instead of randomly trying various maintenance routines and system resets.

(Some of the information for this tip came from this OSXDaily article)

Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.