How to find out what my MacBook Air was doing for 3 hours in my backpack (hot and at 8% battery) when I thought it was sleeping?

I am using macOS Catalina (10.15) and I spent about an hour exporting some photos from Photos to my friend's SD card, which seems to involve a lot of computing (it's not the same as copying files). That's OK. It was plugged in to power the whole time, so I was at 100% battery. When I finished, I closed all the applications except Chrome browser with a single empty tab and closed the lid. This normally puts my laptop into to sleep mode. I unplugged it and slid it into the protective case in my backpack as I've been doing every day for several years now. Three hours later, I pulled it out on the bus to do some work and the fan was running, it was hot, and the battery was at 8%. I took the screenshot below and then shut the computer down so I could safely put it back in its protector. **Question:** How can I find out what my MacBook Air was doing for 2 hours in my backpack (hot and at 8% battery) when I thought it was sleeping? Are there log files I can check for a few hour period to see what was using so much power? There is a *very remote* possibility that I had used sudo pmset -a disablesleep 1 recently to listen to some music with the lid closed on another bus ride, but I doubt it. Nevertheless I need to rule this out. Is there a way I can check the status of disablesleep during that time period, or find logs of the instances when it changed status? [](https://i.sstatic.net/JgTKq.jpg) *** **Update 1:** I'm not seeing any way to get an hourly summary unless it's this stuff from Activity Monitor (below) which goes for only 12 hours in my very old Catalina OS. (I will be updating, as soon as I can convince the App store to recognize my Apple ID, perhaps that will solve several lingering problems). [](https://i.sstatic.net/or0qa.png) **Update 2:** In response to the suggested queries in @Ruskes's [answer](https://apple.stackexchange.com/a/469237/143729) here are the results. Note that I put my laptop in my backpack somewhere around 10:45 to 11:45, and then opened it back up around 14:15, noticed the problem and shut it down. I later plugged it in to charge and restarted around 16:00 The command log show --style syslog --last 36h | grep "Wake reason" yielded 2024-02-13 06:24:18.304815+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:24:39.508966+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:24:39.508967+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:46:17.830890+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:46:17.830895+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:46:18.991668+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:46:20.152147+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:47:07.548976+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:47:07.548979+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:48:04.648201+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:48:04.648208+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:48:04.656591+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.642408+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:48:05.718097+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.720483+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:49:22.965033+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 10:43:53.090984+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 10:43:53.091000+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 14:18:40.937986+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 14:18:40.938058+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 14:18:53.279118+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 15:59:42.233613+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:05:38.933380+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:05:38.933382+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:15:29.675109+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:15:29.675120+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:15:31.685736+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:16:19.364015+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:16:19.364017+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:30:30.669710+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: [...] The command log show --style syslog | fgrep "Wake reason" yielded [...] 2024-02-13 06:24:18.304815+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:24:39.508966+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:24:39.508967+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:46:17.830890+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:46:17.830895+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:46:18.991668+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:46:20.152147+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:47:07.548976+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:47:07.548979+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:48:04.648201+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:48:04.648208+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:48:04.656591+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.642408+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:48:05.718097+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.720483+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:49:22.965033+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 10:43:53.090984+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 10:43:53.091000+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 14:18:40.937986+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 14:18:40.938058+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 14:18:53.279118+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 15:59:42.233613+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:05:38.933380+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:05:38.933382+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:15:29.675109+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:15:29.675120+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:15:31.685736+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:16:19.364015+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:16:19.364017+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:30:30.669710+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:30:30.669719+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:30:31.804000+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:30:31.859119+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:31:20.329319+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:31:20.329321+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) [...] The command log show --style syslog | fgrep "DarkWake" is too long, dense, and verbose to include.