Determine Why Your Mac Wakes Up From Sleep

Jul 17, 2010 - 49 Comments

Have you ever put your Mac to sleep, only to find it awake seemingly on it’s own when you return to the machine? I’ve run into this mystery a few times, and with a few terminal commands you can help track down what caused your Mac to wake from sleep.

Launch the Terminal and type the following at the command line:

syslog |grep -i "Wake reason"

You will then see a report from the system logs that looks like the following:
Sat Jul 10 08:49:33 MacBookPro kernel[0] : Wake reason = OHC1
Sat Jul 10 17:21:57 MacBookPro kernel[0] : Wake reason = PWRB
Sun Jul 11 08:34:20 MacBookPro kernel[0] : Wake reason = EHC2
Sun Jul 16 18:25:28 MacBookPro kernel[0] : Wake reason = OHC1

Now you’re going to want to look at the code next to the “Wake reason=” text. So what do these wake reason codes mean?

  • OHC: stands for Open Host Controller, is usually USB or Firewire. If you see OHC1 or OHC2 it is almost certainly an external USB keyboard or mouse that has woken up the machine.
  • EHC: standing for Enhanced Host Controller, is another USB interface, but can also be wireless devices and bluetooth since they are also on the USB bus of a Mac.
  • USB: a USB device woke the machine up
  • LID0: this is literally the lid of your MacBook or MacBook Pro, when you open the lid the machine wakes up from sleep.
  • PWRB: PWRB stands for Power Button, which is the physical power button on your Mac
  • RTC: Real Time Clock Alarm, is generally from wake-on-demand services like when you schedule sleep and wake on a Mac via the Energy Saver control panel. It can also be from launchd setting, user applications, backups, and other scheduled events.

There may be some other codes (like PCI, GEGE, etc) but the above are the ones that most people will encounter in the system logs. Once you find out these codes, you can really narrow down what is causing your Mac to wake up from sleep seemingly at random.

Note: You can also monitor the Wake Reason codes by looking at the Console if you are not comfortable with the command line. However, in my experience the Console is slower to search and use than the Terminal. This is usually because the default string match search in Console will look through all of your system and applications logs, including those from third parties.

Thank you to Matt for providing this awesome tip!

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: William Pearson in Mac OS X, Troubleshooting

49 Comments

» Comments RSS Feed

  1. tico says:

    Nice tip.

    Thanks. ;)

  2. ToeKnee says:

    Good info, but my current issue with waking gives a blank wake code, as in:
    7/21/10 12:18:31 AM kernel System Sleep
    7/21/10 12:18:55 AM kernel Wake reason =
    7/21/10 12:18:55 AM kernel System Wake

    arggggg

  3. ToeKnee says:

    quick update, seem to have figured this out – in /Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist, changing keys called “TTYSPreventSleep” from 1 to 0 solved my issue. Not sure why, just saying. YMMV.

  4. Alex C says:

    My MacBook must have a short in the keyboard or something, since I’ve tried everything I found and it always wakes immediately after sleeping, with wake reason = OHC1 and the message “The USB device Apple Internal Keyboard / Trackpad (Port 6 of Hub at 0x4000000) may have caused a wake by issuing a remote wakeup” — even when I’ve got no external USB devices plugged in. If anyone knows a way to disable waking on keyboard input, please let me know at this support forum thread: http://discussions.apple.com/thread.jspa?messageID=11593780

  5. stendec says:

    Sat Aug 21 07:06:40 IgorMacBook kernel[0] : Wake reason = UHC3
    Sat Aug 21 10:50:59 IgorMacBook kernel[0] : Wake reason = UHC3
    Sat Aug 21 12:12:42 IgorMacBook kernel[0] : Wake reason = UHC3
    Sat Aug 21 12:20:07 IgorMacBook kernel[0] : Wake reason = UHC3
    Sun Aug 22 09:11:37 IgorMacBook kernel[0] : Wake reason = UHC3
    Sun Aug 22 13:13:14 IgorMacBook kernel[0] : Wake reason = UHC3

    I always get UHC3. what is that? how to solve it?

    • Anic297 says:

      UHC3 is one USB port of your Mac. If you install Apple Developer Tools, you’ll have two apps for figuring out which it is. I don’t know of any other way to discover that (even System Information doesn’t tell).

  6. David says:

    I recently bought a 27″ iMac. Never had any wake-up problems before, but this new iMac, with Snow Leopard, regularly wakes up: last night, according to the log, it woke up four times. The syslog indicates two reasons, EHC2 and RTC, but these don’t say how to correct the problem, of course! Could it have something to do with the wireless (Bluetooth) mouse and keyboard?

  7. Amy says:

    Awesome, thanks :)

  8. majec says:

    Hi there! After switching to a new mac mini i encountered a problem i had before when my mac was awakening itself with no reason or any applications applied…Finally ,after reading lots of unhelpfull remedies i remembered what was causing the problem,In System Prefs go to Bluetooth and uncheck “Allow Bluetooth devices to wake-up this computer”.This should solve 99,99 % problems with waking up bu itself, in my opinion.To wake up you just need to press the power button and wait a little longer for the bluetooth mouse response ,but there are programds which can speed it up… :)

  9. Tolga says:

    Hello,

    I have been working on sleep issues on my MacBook Pro, OS X 10.6.6. After I uninstalled HP Printer and WD External Disk programs, now my MBP sleeps but it goes to sleep very late. For example, I set Energy Saving to 2 minutes to sleep. But my MBP goes to sleep after 15 minutes instead of set 2 minutes. Why is it so ? How can I solve this problem ? Here is the console messages, so that hopefully someone can help me with this issue. In this console log, I leave alone my MacBook Pro at 12:26 PM and first time I see a message about Sleep at 12.34 PM. I should have see a sleep message at 12:36 PM, because it is set for sleep 2 minues in Energy Saving settings.

    24.01.2011 12:26:46 [0x0-0x3c03c].com.apple.systempreferences[378] Couldn’t find any matches.
    24.01.2011 12:27:23 Firewall[57] Stealth Mode connection attempt to UDP 192.168.1.5:60251 from 208.67.222.222:53
    24.01.2011 12:30:16 Firewall[57] Stealth Mode connection attempt to UDP 192.168.1.5:50148 from 208.67.222.222:53
    24.01.2011 12:32:59 awacsd[70] EAP-GTC failed. Retrying in 3600 seconds.
    24.01.2011 12:34:57 configd[13] PowerManagement configd: System Sleep prevented by active remote login session (120 second threshold).
    24.01.2011 12:34:57 configd[13] PowerManagement configd: tty sleep preventer: /dev/ttys000
    24.01.2011 12:34:58 kernel PM notification cancel (pid 13, configd)
    24.01.2011 12:34:58 kernel IOPMrootDomain: idle cancel
    24.01.2011 12:35:37 Firewall[57] Stealth Mode connection attempt to UDP 192.168.1.5:61473 from 208.67.222.222:53
    24.01.2011 12:40:34 kernel hibernate image path: /var/vm/sleepimage
    24.01.2011 12:40:34 kernel sizeof(IOHibernateImageHeader) == 512
    24.01.2011 12:40:34 kernel Opened file /var/vm/sleepimage, size 4294967296, partition base 0xc805000, maxio 400000 ssd 0
    24.01.2011 12:40:34 kernel hibernate image major 14, minor 2, blocksize 512, pollers 5
    24.01.2011 12:40:34 kernel hibernate_alloc_pages flags 00000000, gobbling 0 pages
    24.01.2011 12:40:34 kernel hibernate_setup(0) took 0 ms
    24.01.2011 12:40:35 kernel AirPort: Link Down on en1. Reason 8 (Disassociated because station leaving).
    24.01.2011 12:40:35 kernel [0f96a980][AppleMultitouchDevice::willTerminate] entered
    24.01.2011 12:40:35 kernel [0f96a980][AppleMultitouchDevice::stop] entered
    24.01.2011 12:40:35 kernel System SafeSleep
    24.01.2011 12:40:42 kernel hibernate_page_list_setall start 0x44409000, 0x44428000
    24.01.2011 12:40:42 kernel hibernate_page_list_setall time: 202 ms
    24.01.2011 12:40:42 kernel pages 567743, wire 74756, act 176978, inact 893, spec 177, zf 3026, throt 0, could discard act 55041 inact 74176 purgeable 19300 spec 163396
    24.01.2011 12:40:42 kernel hibernate_page_list_setall found pageCount 255830
    24.01.2011 12:40:42 kernel IOHibernatePollerOpen, ml_get_interrupts_enabled 0
    24.01.2011 12:40:42 kernel IOHibernatePollerOpen(0)
    24.01.2011 12:40:42 kernel writing 254650 pages
    24.01.2011 12:40:42 kernel encryptStart 2e270
    24.01.2011 12:40:42 kernel encryptEnd 4979820
    24.01.2011 12:40:42 kernel image1Size 135123456, encryptStart1 2e270, End1 4979820
    24.01.2011 12:40:42 kernel encryptStart 80dd200
    24.01.2011 12:40:42 kernel encryptEnd 1b343de0
    24.01.2011 12:40:42 kernel PMStats: Hibernate write took 6005 ms
    24.01.2011 12:40:42 kernel all time: 6005 ms, comp time: 1761 ms, deco time: 0 ms,
    24.01.2011 12:40:42 kernel image 456408576, uncompressed 1043312640 (254715), compressed 454224304 (43%), sum1 32212469, sum2 e1de75ed
    24.01.2011 12:40:42 kernel wired_pages_encrypted 39896, wired_pages_clear 33745, dirty_pages_encrypted 181074
    24.01.2011 12:40:42 kernel hibernate_write_image done(0)
    24.01.2011 12:40:42 kernel sleep

    Thanks,
    Tolga

  10. Miles says:

    Thanks for this tip. My new MBP + cinema display is waking from sleep, but my 2007 MBP was doing this as well for over 2 years.

    Log reveals that EHC1 is waking my machine, and at 4 AM last night woke it every few minutes until I finally pulled the power cord out.

    EHC2 seems to be a BT trigger, so EHC1 covers my USB devices. Will be unplugging them one at a time until (if) the problem goes away. Maybe it’s a peripheral that doesn’t play nice, but I am not optimistic.

  11. Mons says:

    My new iMac also wokes up from sleep.

    When i run the terminal script, I can see the times when it woke up. When I look in console the same times are there, and the first line says:
    m.skype.skype[188] WirelessAttach': IOServiceOpen error: e00002c7.

    Is it skype that wakes up my mac?

  12. Andrei says:

    Anyone having tho sleep – wake problem try the following:
    open up your Terminal and enter:
    sudo pmset -a lidwake 0

    This will stop your laptop from waking up when lid is lifted – you will have to push your keyboard, but it worked for me and I’ve tried all solutions I could шватв – doubt 20 all together. I cannot guarantee this worked with 100% certainty because it hasn’t been 2 weeks since implemented, but try it and if it doesn’t work change it back if you prefer.

  13. Caspar says:

    In Lion (10.7) something changed. They changed “Wake reason =” to “Wake reason:” so the command under Lion should be:

    syslog |grep -i “Wake reason:”

  14. Joe says:

    Thanks, Caspar! I ran into that same thing and was just about to post about it.

    What the heck; I’ll post it too.

    In Lion, try typing this:
    syslog |grep -i “Wake reason”

  15. Drew says:

    Mine just says: Thu Sep 15 22:05:37 andrew-pulidos-imac-2 kernel[0] : Wake reason = EC

    is EC = Enhanced Controller? I had the airport off and bluetooth off, and my Imac still wakes immediately after I put it to sleep. any suggestions?

  16. Karmela says:

    Does a command like this exist for seeing what wakes the display?

  17. Hans says:

    I’m having the same issues with my iMac. And I’ve tried the Terminalcommand. But it gives me this response:

    syslog: unknown option “|grep”
    run “syslog -help” for usage

    [Proces voltooid]

    I’m definitely no expert. Has anyone a clue? Should I use another command after “syslog”?

    Thanks,

    Hans

  18. Diogo says:

    For those of you aren’t getting any response, the right string (on Lion, I suppose) is “Wake reason :”.

  19. Greg says:

    None of those strings are getting me any results …. :-(

  20. Daniel says:

    Try this…

    syslog |grep -i “Wake”

  21. Aaron says:

    Mine just says:

    Nov 25 13:12:28 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 26 01:04:50 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 26 03:58:09 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 27 10:58:50 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 27 18:32:55 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 27 20:38:28 AaronsiMac kernel[0] : Wake reason: ? (User)
    Nov 27 22:41:37 AaronsiMac kernel[0] : Wake reason: ? (User)

    So I’m not quit sure where to go from that information. Has anyone else seen anything like this?

  22. Nachi says:

    I am facing the same problem, but it happens only when on power and not on batteries. When on power and the lid is closed, the sleep light goes on and off exactly 6 time and it wakes up by its own and goes back to sleep again. And the loop is end less.

    But only when connected to power, That means any external factor like Bluetooth or Keyboard or wireless or usb are not the problem( Though I do not use any of them)

  23. […] OS X daily provides a detailed article on what the different wake reason short codes mean. RTC stands for the […]

  24. Sean says:

    I am running Lion 10.7.2 on a Mac Pro. This problem of randomly waking only started after installing Lion. I’ve tried the following commands:

    syslog |grep -i “Wake reason =”
    no response

    syslog |grep -i “Wake reason:”
    response: grep: reason:”: No such file or directory

    syslog |grep -i “Wake”
    no response

    While I’d like to find this article useful, none of the commands mentioned are working at all. Any other ideas?

  25. Raoul says:

    syslog | grep -i “wake reason” is the correct command!

  26. Thanks. What is the following? “Fri Jan 6 17:16:19 npxpstndrd218 kernel[0] : Wake reason = EC LID0″

    The name of my computer is different and there are only a few of these mixed in. My problem is that when I close my computer the apple goes dark then turns back on and the drive starts spinning until I open it in which case it goes into sleep mode for about a minute.

  27. allan says:

    NONE of the commands work on lion!!! I’m desperate!!!

    All of them give me no response or the no file in directory thing.

    • Anic297 says:

      Do like me: avoid the Terminal and search in the Console. Why wasting time with so abstract things that are Unix commands?

  28. allan says:

    Ok, nvm, it worked with

    syslog | grep -i “wake reason”

    HOWEVER, I’ve found that EHC could also mean when your macbook is with the lid open and in sleep mode. When you press any button and it wakes up, thats going to show up in the logs as EHC2.

  29. […] the wake reason is. In Lion the terminal commando is: syslog | grep -i "wake reason" Determine Why Your Mac Wakes Up From Sleep Tell us how you install? Retail? Which extra kexts are you using? Maybe you need a clean install? […]

  30. John says:

    I’m running Terminal and it’s telling me “: Wake reason = USB7″ or sometime with “USB4.” However, I have no USB elements plugged into my laptop. Any ideas, people?

  31. Guest says:

    Mac OS X 10.4, doesn’t work.

    syslog does provide a log, but it doesn’t have any entries for “wake reason” even during the time when it did wake up.

  32. Sam says:

    For other’s reference, USB devices include iSight, IR port (remote IR receiver), keyboard and trackpad, and bluetooth.
    My Core Duo macbook has USB7 wake reasons which can be cross referenced with the USB section of the Apple Utility “System Profiler”. Look through the USB bus sections until you see Bus Number 0x7d for example. In my case this is the bluetooth module which is failing and giving weird on/off issues and of course making the computer wake up. Might have to remove or found out how to disable this…

  33. cmcc says:

    Thanks for this post, just wanted to post in case it helps others out.
    I had the same problem with an early 2009 Mac Pro.
    The problem turned out to be an extra keyboard that I had connected directly to the back USB ports of the MAC.

  34. terry says:

    Thank you so much for this post, finally solved that problem w my MBA, now all i have to do is remember to unplug my usb hub Before I close the lid!

  35. Sheldon says:

    I was having this same problem and the wake reason that I was getting was XHC1, which appears to be related to the USB ports on my MacBook Pro. In my case, the culprit was a hard drive docking station that was turned on, but did not have a hard drive plugged into it at the time and was not making any noise so I had no idea it was still on. I also had no idea that it would try to communicate so actively with my computer. I hope this saves somebody out there and a lot of frustration.

  36. Billy Gard says:

    My computer is a macbook with Leopard 10.5.8. Nothing is connected to the machine except a power supply. No bluetooth devices are present.

    In the middle of the night I heard the disk making its humming sound when the lid was closed. The computer woke. When I opened it the screen stayed blank, like the computer crashed in some weird way. So I did a cold reboot. It did a Hum-Hum-Chime sequence twice before successfully rebooting.

    In a previous situation the computer woke while closed, and the fan was running furiously as if it were hot. It had to be rebooted then as well.

    The “Wake for ethernet network administrator access” is set, but nothing is plugged in the ethernet. Something would have to wake it up through the airport.

  37. […] of the time since that alone can give you the information you’re looking for. Furthermore, by reading the wake reasons you’ll be able to see how the Mac was woken up and by what method. For example, Mac laptops […]

  38. Mike says:

    Hi everyone I am on snow leopard and am getting this
    Wake reason=us I dont know what this means by the way it is a 2006 MacBook Core Duo

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates