How to Check What Woke Your MacBook from Sleep

Your MacBook can wake from sleep because of a scheduled maintenance task, a network request, a connected accessory, a lid movement, or a software process. macOS records much of this activity in system logs, and Terminal can display the most recent wake reason.

Quick Answer

To check what woke your MacBook:

1. Open Terminal from Applications > Utilities. 2. Run:

bash
pmset -g log | grep -i "wake"

3. Look for the newest entry containing Wake reason. You may see codes such as EC.LidOpen, PWRB, RTC, XHC, or DarkWake.

Why Your MacBook Wakes from Sleep

Sleep is a low-power state, not a complete shutdown. macOS may wake the MacBook briefly to perform approved background work, respond to hardware input, maintain network availability, or complete a scheduled task.

Common causes include:

• Opening the lid
• Pressing the power button or Touch ID sensor
• Moving or clicking a connected mouse
• Pressing a key on an external keyboard
• Connecting a USB, Thunderbolt, or display accessory
• A scheduled wake event
• Network activity
• Bluetooth devices
• Power-management or firmware events
• A software or hardware problem

Some wake events are intentional and brief. For example, macOS may perform a DarkWake, which is a limited background wake that does not always turn on the display. Other wake events may fully bring the MacBook back to the login screen.

If the MacBook wakes repeatedly, drains its battery while closed, or becomes warm inside a bag, the wake reason can help identify the source.

Check the Most Recent Wake Reason in Terminal

Terminal is the most direct way to inspect macOS power-management logs. The commands below only read system information; they do not change settings or delete files.

1. Open Terminal

1. Open Finder.
2. Select Applications in the sidebar.
3. Open the Utilities folder.
4. Double-click Terminal.

You can also press Command-Space, type Terminal, and press Return.

2. Display recent wake events

Enter this command and press Return:

pmset -g log | grep -i "wake"

The output may include lines similar to:

Wake reason: EC.LidOpen
Wake reason: XHC
Wake reason: RTC
Wake reason: PWRB

The newest entries generally appear near the bottom of the output. If Terminal displays a large amount of text, scroll to the end or press Command-F and search for Wake reason.

3. Read the wake-reason code

The code after Wake reason identifies the event macOS recorded. The exact wording can vary by Mac model and macOS release, but these codes commonly mean:

Code or entry	Likely meaning
EC.LidOpen	The lid-open sensor detected that the MacBook was opened
PWRB	The power button or Touch ID sensor was activated
RTC	A real-time clock event, often associated with a scheduled wake
XHC	A USB or other external controller detected activity
EHC	An older USB controller detected activity
USB	A USB device or USB-related event may have triggered the wake
LID0 or a similar lid entry	A lid sensor event
DarkWake	macOS performed a limited background wake
Maintenance	A maintenance-related background event
Network	Network-related activity may have caused or accompanied the wake

These codes are clues rather than guaranteed explanations. For example, XHC can indicate activity from a dock, hub, keyboard, mouse, external drive, or display connection. It may not identify the exact accessory.

4. Add timestamps and nearby log entries

To see more context around wake events, run:

pmset -g log | grep -i -A 8 -B 3 "wake"

The options mean:

• -A 8 shows eight lines after each matching line.
• -B 3 shows three lines before each matching line.
• grep -i ignores capitalization.

Nearby entries may show whether the MacBook entered DarkWake, returned to full wake, or went back to sleep shortly afterward.

Use pmset -g assertions to Find Apps and Processes Preventing Sleep

A MacBook may appear to wake unexpectedly when it never entered normal sleep in the first place. An application, background process, or connected service can create a power assertion. A power assertion is a temporary request that tells macOS to keep the Mac awake or delay sleep.

To check current assertions, run:

pmset -g assertions

Look for sections such as:

• PreventSystemSleep
• PreventUserIdleSystemSleep
• PreventUserIdleDisplaySleep
• Listed by owning process

An entry may identify an app or process responsible for keeping the Mac awake. Common examples can include media apps, backup tools, file transfers, video calls, or system services.

This command does not show the original wake trigger in every case. It is most useful when the MacBook does not sleep reliably, wakes immediately after sleeping, or stays awake with the lid open.

If an unfamiliar application appears:

1. Save your work.
2. Quit the application normally.
3. Check whether the MacBook sleeps as expected.
4. Update or reinstall the app if the problem returns.
5. Contact the app developer if it continues creating the assertion.

Do not force-quit an app before saving your work. Force-quitting can discard unsaved changes.

Check Scheduled Wake Events

A scheduled wake can make the MacBook turn on at a specific time. To inspect scheduled power events, run:

pmset -g sched

The output may show events such as:

• Wake
• Sleep
• Power On
• Shutdown
• Wake or Power On

A scheduled event may come from a previous power setting, an administrator-managed Mac, or software that requested a timed action.

If you recognize the event, no action may be necessary. If the MacBook wakes at the same time every day and the schedule is unexpected, review its energy settings.

Review Energy settings

1. Open the Apple menu.
2. Select System Settings.
3. Click Battery.
4. Review the available sleep, wake, and energy-related settings.

The exact options can vary by Mac model and macOS release. On some Macs, scheduled power options may be under Energy Saver or an Options button within the energy settings.

Do not change a scheduled power setting if the MacBook is managed by your employer or school without checking with the administrator first.

Test Connected Accessories

External devices are a frequent cause of unexplained wake events, especially when Terminal reports XHC, EHC, or USB.

Potential triggers include:

• USB hubs and docks
• External keyboards and mice
• External drives
• Monitors and adapters
• Ethernet adapters
• Printers
• Audio interfaces
• Charging accessories

To test them safely:

1. Save your work and disconnect all nonessential accessories.
2. Close the MacBook lid or choose Apple menu > Sleep.
3. Wait several minutes.
4. Check whether the MacBook wakes again.
5. Reconnect accessories one at a time.
6. Allow enough time between tests to identify the device that coincides with the wake.

If the MacBook only wakes while connected to a dock or monitor, update the dock’s firmware if the manufacturer provides an update. Also check the cable, adapter, and connected peripherals.

Disconnect external drives only after ejecting them in Finder. To eject a drive, click its Eject icon in the Finder sidebar or drag its desktop icon to the Trash, which changes to an Eject symbol. Disconnecting a drive during a file operation can cause data loss or corruption.

Check Bluetooth Devices

A Bluetooth mouse, keyboard, or other accessory may send input while the MacBook is asleep. A device with a stuck button, low battery, or unstable connection can create repeated wake events.

To test Bluetooth accessories:

1. Turn off or disconnect Bluetooth input devices.
2. Put the MacBook to sleep.
3. Observe whether it wakes without those devices connected.
4. Reconnect each device separately.

To review Bluetooth settings:

1. Open Apple menu > System Settings.
2. Click Bluetooth.
3. Identify connected accessories.
4. Disconnect accessories you do not need.

If a mouse or keyboard is the suspected cause, replace its batteries or charge it, then check for physical buttons that may be held down.

Check Network-Related Wake Activity

Network access can wake a MacBook for background communication or shared services. A Mac may also wake when another device accesses a shared resource, depending on its settings and hardware.

Review network-related options here:

1. Open Apple menu > System Settings.
2. Click Battery.
3. Click Options if it appears.
4. Review settings related to network access during sleep.

The available choices depend on the MacBook and macOS version. If you do not need network access while asleep, disable the relevant option and test again.

On a work or school Mac, network wake behavior may be controlled by an administrator. Avoid changing managed settings without permission.

Check Whether the MacBook Is Actually Waking

Not every event that lights the screen is a full wake from sleep. The MacBook may have performed a DarkWake, briefly activated the display because of an input device, or restarted after a crash.

Check for these clues:

• DarkWake entries suggest limited background activity.
• A sudden login screen may indicate a full wake, restart, or logout.
• An Apple logo can indicate a restart rather than a normal wake.
• A request for your password after a short period may simply reflect a security setting.
• A warm MacBook with a low battery may have stayed awake instead of waking repeatedly.

To check whether the Mac restarted, select Apple menu > About This Mac > More Info, then review system information and recent behavior. You can also use the logs described earlier to compare the sleep and wake timestamps.

If the MacBook wakes and then becomes unusually slow, check Activity Monitor. Open Applications > Utilities > Activity Monitor, select the CPU tab, and look for an app using unusually high processor resources. Do not quit an unfamiliar system process just because it appears in the list. If a process is repeatedly associated with overheating or poor performance, investigate it before taking action.

A Safe Diagnostic Routine

When the cause is unclear, use this sequence:

1. Record the approximate time the MacBook woke.
2. Run:

bash
pmset -g log | grep -i "wake"

3. Note the newest wake reason and timestamp.
4. Run:

bash
pmset -g sched

5. Check for a scheduled event near the same time.
6. Run:

bash
pmset -g assertions

7. Disconnect nonessential accessories.
8. Turn off Bluetooth input devices temporarily.
9. Test sleep again.
10. Reconnect devices one at a time.

This approach separates likely causes into four groups: hardware input, scheduled activity, network behavior, and software that prevents or interrupts sleep.

Troubleshooting Unexpected Wake-Ups

The command returns no wake reason

The log may not contain the event you expected, or the command may be filtering out relevant wording. Try:

pmset -g log | tail -n 100

This displays the last 100 lines of the power-management log. Search for wake, sleep, darkwake, or assertion.

You can also use:

log show --last 24h --predicate 'eventMessage contains[c] "wake"'

This searches the unified macOS log for wake-related messages from the past 24 hours.

The wake reason is XHC, EHC, or USB

Disconnect docks, hubs, drives, keyboards, mice, monitors, and adapters. Reconnect them individually. The code usually identifies an external controller, not the exact accessory.

The wake reason is RTC

Run:

pmset -g sched

Look for a scheduled wake or power event. If one exists and is not needed, review the settings in System Settings > Battery.

The Mac wakes immediately after you close the lid

Remove accessories, disconnect power adapters and docks, and test again. Check for objects that may keep the lid from closing fully. A case, cable, or physical obstruction can interfere with the lid sensor.

The MacBook gets hot while closed

Stop using it in a bag until the problem is resolved. A Mac that stays awake can build up heat and drain its battery. Disconnect accessories, check assertions, and review recent wake events. If the issue continues, follow a broader troubleshooting process for unexpected sleeping and waking, such as the steps in How to Fix a Mac That Sleeps or Wakes Unexpectedly.

The issue began after installing an app or utility

Quit or temporarily uninstall the suspected app, especially if it manages backups, displays, networks, audio devices, or system cleaning. Save your work first, and use the developer’s uninstall instructions when available.

The Mac becomes slow after waking

Check Activity Monitor for unusually high CPU or memory use. If a process consistently consumes excessive resources, record its name and investigate it rather than deleting system files. A persistent system process problem may require separate performance troubleshooting, including checking whether the kernel_task process is overloading your MacBook.

Frequently Asked Questions

Can I see exactly which device woke my MacBook?

Not always. macOS often records a controller or event category rather than the accessory’s name.

Is it safe to run pmset commands?

The commands in this guide are read-only. They display power-management logs, schedules, and current assertions. They do not alter sleep settings.

Can I delete the wake logs?

You generally do not need to. Logs rotate automatically, and deleting system logs is not a useful first troubleshooting step.

What if the MacBook wakes even with everything disconnected?

Run the wake-log and scheduled-event commands again. If the issue continues with no accessories connected, check software settings, installed utilities, and system updates.

Final Thoughts

The quickest way to investigate an unexpected wake-up is to check the latest entry from:

pmset -g log | grep -i "wake"

Use pmset -g sched for scheduled events and pmset -g assertions for software that may be preventing sleep.