My MacBook Air (a few months old) randomly wakes from sleep roughly 3 hours after the lid is closed. The wake reason is given as EC.LidOpen, but in fact, the lid remains closed. The mac appears to go immediately back to sleep. I am not experiencing any negative consequences from this, but wanted to be sure I shouldn't be worried about malware.
For example (this occurs every night)
log show --style syslog | fgrep "Wake reason"
2017-03-18 01:33:44.916848+0100 localhost kernel: (AppleACPIPlatform) Wake reason: EC.SleepTimer (SleepTimer)
2017-03-18 04:33:58.836023+0100 localhost kernel: (AppleACPIPlatform) Wake reason: EC.LidOpen (User)
EDIT: using pmset -g log, I got more information on the mysterious wake-ups, which seem to be caused by mDNSResponder.
2017-04-14 10:23:12 +0200 Kernel Client Acks Delays to Sleep notifications: [AppleBacklightDisplay driver is slow(msg: SetState to 0)(984 ms)] [powerd is slow(16830 ms)] [AppleThunderboltNHIType2 driver is slow(msg: WillChangeState to 2)(361 ms)] [RP03 driver is slow(msg: SetState to 0)(1277 ms)]
2017-04-14 10:23:12 +0200 Assertions PID 173(mDNSResponder) Created MaintenanceWake "mDNSResponder:maintenance" 00:00:00 id:0x0xd0000806d [System: DeclUser kDisp]
2017-04-14 10:23:12 +0200 Assertions PID 173(mDNSResponder) Released MaintenanceWake "mDNSResponder:maintenance" 00:00:00 id:0x0xd0000806d [System: DeclUser kDisp]
2017-04-14 10:23:12 +0200 DarkWake DarkWake from Deep Idle [CDN] due to EC.SleepTimer/SleepTimer: Using BATT (Charge:81%) 0 secs
2017-04-14 10:23:12 +0200 HibernateStats hibmode=3 standbydelay=10800 741
2017-04-14 10:23:12 +0200 Kernel Client Acks Delays to Wake notifications: [SSP3 driver is slow(msg: SetState to 3)(405 ms)] [SSP3 driver is slow(msg: DidChangeState to 3)(373 ms)]
2017-04-14 10:23:12 +0200 Sleep Entering Sleep state due to 'Maintenance Sleep': Using Batt (Charge:81%) 1189 secs 2017-04-14 10:23:40 +0200 PM Client Acks Delays to Sleep notifications: [AirPort configd plug-in is slow(1835 ms)] [com.apple.apsd timed out(28012 ms)]
energy saver preferences on battery: -turn display off after 15 minutes -put hard disks to sleep when possible -slightly dim the display when on battery power -(power nap unchecked) Power adapter: -turn display off after 15 minutes -prevent computer from sleeping automatically when the display is off -put hard disks to sleep when possible -(wake for wi-fi network access unchecked) -(power nap unchecked)
One more edit: Noticed the 10800 here is exactly 3 hours! Is that a coincidence? Does anybody know how to read/change these settings? This is in response to pmset -g
System-wide power settings: Currently in use: standbydelay 10800 standby 1 halfdim 1 hibernatefile /var/vm/sleepimage powernap 0 gpuswitch 2 disksleep 10 sleep 15 (sleep prevented by coreaudiod) autopoweroffdelay 28800 hibernatemode 3 autopoweroff 1 ttyskeepawake 1 displaysleep 15 acwake 0 lidwake 1