How to investigate which process causes wakeups during laptop sleep-mode in MacOS (or Linux)?

Question

My MacBook spontaneously wakes up from sleep mode with high fan activity.

I want to do a investigate this in RTC or power settings? Or by strace-ing of processes, etc (using some process/kernel magic!).

Hint: It is probably managed by "rtcwake".

I am not even sure if this is a scheduled task, or from a WiFi wakeup, or something else.

I don't want guesses about what usually causes this in Mojave, etc. Instead: I need to do a systematic investigation on this on my MacOS (Mojave). Linux-related answers are also appreciated.

This is about system standby, sleep-mode, suspended mode. (Note that this is not about standup and wakeup of individual processes. The whole laptop turns on spontaneously.)

Answer 1

Reading the log file is the best way to debug the problem.

So, try this command in your Terminal to fetch the system logs, this will tell you "wake up" history.

log show --style syslog | fgrep "Wake reason: EC.LidOpen"

To see the wake reason:

For macOS Sierra, Mojave, Catalina, and newer

log show |grep -i "Wake reason"

Or for MacOS El Capitan, Yosemite, Mavericks, and older

syslog |grep -i "Wake reason"

This will look like:

MacBookPro kernel[0] : Wake reason = OHC1
MacBookPro kernel[0] : Wake reason = PWRB
MacBookPro kernel[0] : Wake reason = EHC2
MacBookPro kernel[0] : Wake reason = OHC1

So what do these wake reason codes mean?

• OHC: stands for Open Host Controller, is usually USB or Firewire. If you see OHC1 or OHC2 it is almost certainly an external USB keyboard or mouse that has woken up the machine.
• EHC: standing for Enhanced Host Controller, is another USB interface, but can also be wireless devices and bluetooth since they are also on the USB bus of a Mac.
• USB: a USB device woke the machine up
• LID0: this is literally the lid of your MacBook or MacBook Pro when you open the lid the machine wakes up from sleep.
• PWRB: PWRB stands for Power Button, which is the physical power button on your Mac
• RTC: Real Time Clock Alarm, is generally from wake-on-demand services like when you schedule sleep and wake on a Mac via the Energy Saver control panel. It can also be from launchd setting, user applications, backups, and other scheduled events.

There may be some other codes (like PCI, GEGE, etc) but the above are the ones that most people will encounter in the system logs. Once you find out these codes, you can really narrow down what is causing your Mac to wake up from sleep seemingly at random.

Hope this will help :)

Answer 2

This answer is based on Linux, so it might not apply strictly to Mac. To determine whether rtcwake is responsible for your MacOS wakeups, you could replace the executable (in my Ubutnu it is /usr/sbin/rtcwake) with a wrapper script that leaves a sign of rtcwake having run, e.g.

$ cd /usr/sbin/rtcwake
$ sudo mv rtcwake rtcwake_orig 

and then write script /usr/sbin/rtcwake containing

#!/bin/bash
touch $HOME/rtcwake_ran
/usr/sbin/rtcwake_orig

Variants of the script would depend on your shell. In particular, in the last line you would possibly run rtcwake in some alternative way, so as to not own the process (nohup / disown). See https://unix.stackexchange.com/questions/152310/how-to-correctly-start-an-application-from-a-shell

---

To inspect possible causes of wakeup, you can check various relevant logs, at /var/log. E.g., syslog*, acpi*. See also https://unix.stackexchange.com/questions/83036/where-is-the-log-for-acpi-events

---

Do you have wakeonlan?