macOS: How to See Your Mac Wake History

Andrew Orr

1 minute read
| Tips

If you’ve ever wanted to see your Mac wake history, check out this Terminal command. It lists all of the times your Mac has been woken up from sleep in chronological order.

[macOS: How to Download Files From the Web Using Terminal]

Mac Wake History

Open Terminal and copy/paste the following command:

Screenshot of Mac wake history in Terminal.

log show --style syslog | fgrep "Wake reason: EC.LidOpen"

It will take a little while, but it will show you your Mac wake history, and it will probably be a big list. But why is this useful?

Why It Matters

This tip was inspired by Patrick Wardle’s new tool called Do Not Disturb. It’s an app that does the same thing as this command, but it goes further. Do Not Disturb “continually monitors your system for events that may indicate a precursor of “evil maid” attack. Specifically it watches for ‘lid open’ events.”

So what is an evil maid attack? Basically it’s when a person access your unattended computer and tries to install malware, such as a bootkit. Do Not Disturb has a companion iOS app that sends you an alert the instant someone open’s your laptop lid. However, it’s a US$10/year subscription.

[macOS: Use Clipboard in Terminal Without a Mouse]

4 thoughts on “macOS: How to See Your Mac Wake History”

  • Thanks, but such commands returns nothing in macOS 12.3.1 (21E258) Monterey on Intel x86 Mac. Curiously, after high CPU activity for some minutes! Is there a different command for it?

    2. Try pmset -g log | grep -e " Sleep " -e " Wake " instead. I’m not sure what it might return, and it’s difficult for me to test it because I have a desktop Mac that doesn’t sleep.

      1. Many thanks! Yes, this article was linker in other newer one. I have tested your Terminal command and it works to show both sleep and wake. This is an example:

        Sleep        Entering Sleep state due to ‘Software Sleep pid=224’:TCPKeepAlive=active Using AC (Charge:0%) 34 secs
         
        Wake         Wake from Normal Sleep [CDNVA] : due to XHC2 XHC1/UserActivity Assertion Using AC (Charge:0%)

        I wonder if other command could also show turning on and off screen saver. Likewise, for booting trials. And also for rebooting and for shutting down.

        Many thanks again for all.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.