1

I was recently trying out the command: log show —style syslog | fgrep ”Wake”

I noticed that there were two EC.Lidopen events at a time when I had left the MacBook in my locked apartment. The two logs had simultaneous time stamps at 15.30:05, which strikes me as bug-like since a normal wake-up would just render one EC.Lidopen event... not two of them in the same second?

Powernap is disabled for battery mode, and the computer wasn't plugged in. The computer was put in sleep-mode after I last used it, and had WiFi but not Bluetooth enabled. I have double-checked that other events are correct time-wise so that it’s not a time-setting issue. Is there a possibility that it might be due to a bug?

Here is the output:

2019-03-20 08:13:49.131203+0100 localhost kernel[0]: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01)

2019-03-20 08:13:49.854413+0100 localhost kernel[0]: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01)

2019-03-20 08:13:54.971671+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: ?

2019-03-20 08:13:54.971673+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: ?

2019-03-20 13:30:04.130464+0100 localhost kernel[0]: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01)

2019-03-20 13:30:04.845262+0100 localhost kernel[0]: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01)

2019-03-20 13:30:07.350598+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: RTC (Alarm)

2019-03-20 13:30:07.350601+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: RTC (Alarm)

2019-03-20 15:30:00.162154+0100 localhost kernel[0]: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01)

2019-03-20 15:30:05.378599+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.LidOpen (User)

2019-03-20 15:30:05.378601+0100 localhost kernel[0]: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.LidOpen (User)

  • Seems like power nap might explain all those messages. What specifically do you consider a bug? I wouldn’t put any weight in the log messages if there’s no actual observable or problem with the system waking while “asleep” if power nap or other usb or network devices can wake the Mac. – bmike Mar 20 at 21:29
  • I checked my settings and powernap is disabled for battery-mode. I'm mostly concerned with whether EC.Lidopen is from someone actually opening the lid. If such an event is logged even though no one opens it, I would consider it a bug. ;-) – Heta Mar 20 at 21:37
  • Fair enough. I’m not saying you’re wrong to consider it a bug, just engineering might not or ever fix it, so I’ll answer how I would narrow down what’s really happening. – bmike Mar 20 at 21:55
1

Thanks for your help,

Using pmset -g log, I have found that EC.Lidopen occurred in conjunction with scheduled wake ups. And true, waking the computer by opening the lid does not render an 'EC.Lidopen' wake-up reason but rather a 'Host (0x01)'.

An EC.Lidopen event in my case is generated when the Mac goes to sleep either after closing the lid manually or after it wakes from Deep Idle due to maintenance and goes to sleep again. I think a lot of people who use the wake up reason to find if someones using their computer can be confused by this function...

0

Since Apple isn’t likely to have documented those log messages, I would install a product that will snap a picture when your lid opens so you can know it’s being opened. This is sometimes called an “evil maid” attack but it could be called a “snoopy dude” just as well.

You can also test sending a wake up packet over WiFi when you know the lid is closed to make sure those messages are not a result of wake on lan traffic over WiFfi. Same with jiggling any USB connected devices. Test unplugging them when you are there nad know the lid is shut. I’m assuming you have already tried lifting the lid and don’t see those messages since that would be easy to test.

If you end up filing a bug, please report back how you decided that and if it ever gets acknowledged.

0

As an FYI. Recent builds of Mac OS can and will install updates while the computer is asleep. This is called "Hybrid sleep". This would indicate "lid open" in the logs. Check your update history.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .