MacBook Air briefly wakes from sleep after 3 hours

My MacBook Air (a few months old) randomly wakes from sleep roughly 3 hours after the lid is closed. The wake reason is given as EC.LidOpen, but in fact, the lid remains closed. The mac appears to go immediately back to sleep. I am not experiencing any negative consequences from this, but wanted to be sure I shouldn't be worried about malware.

For example (this occurs every night)

log show --style syslog | fgrep "Wake reason"

2017-03-18 01:33:44.916848+0100 localhost kernel[0]: (AppleACPIPlatform) Wake reason: EC.SleepTimer (SleepTimer)

2017-03-18 04:33:58.836023+0100 localhost kernel[0]: (AppleACPIPlatform) Wake reason: EC.LidOpen (User)

EDIT: using pmset -g log, I got more information on the mysterious wake-ups, which seem to be caused by mDNSResponder.

2017-04-14 10:23:12 +0200 Kernel Client Acks Delays to Sleep notifications: [AppleBacklightDisplay driver is slow(msg: SetState to 0)(984 ms)] [powerd is slow(16830 ms)] [AppleThunderboltNHIType2 driver is slow(msg: WillChangeState to 2)(361 ms)] [RP03 driver is slow(msg: SetState to 0)(1277 ms)]
2017-04-14 10:23:12 +0200 Assertions PID 173(mDNSResponder) Created MaintenanceWake "mDNSResponder:maintenance" 00:00:00 id:0x0xd0000806d [System: DeclUser kDisp]
2017-04-14 10:23:12 +0200 Assertions PID 173(mDNSResponder) Released MaintenanceWake "mDNSResponder:maintenance" 00:00:00 id:0x0xd0000806d [System: DeclUser kDisp]
2017-04-14 10:23:12 +0200 DarkWake DarkWake from Deep Idle [CDN] due to EC.SleepTimer/SleepTimer: Using BATT (Charge:81%) 0 secs
2017-04-14 10:23:12 +0200 HibernateStats hibmode=3 standbydelay=10800 741
2017-04-14 10:23:12 +0200 Kernel Client Acks Delays to Wake notifications: [SSP3 driver is slow(msg: SetState to 3)(405 ms)] [SSP3 driver is slow(msg: DidChangeState to 3)(373 ms)]
2017-04-14 10:23:12 +0200 Sleep Entering Sleep state due to 'Maintenance Sleep': Using Batt (Charge:81%) 1189 secs 2017-04-14 10:23:40 +0200 PM Client Acks Delays to Sleep notifications: [AirPort configd plug-in is slow(1835 ms)] [com.apple.apsd timed out(28012 ms)]

Edit:

 energy saver preferences on battery:
-turn display off after 15 minutes
-put hard disks to sleep when possible
-slightly dim the display when on battery power
-(power nap unchecked)

Power adapter:
-turn display off after 15 minutes
-prevent computer from sleeping automatically when the display is off
-put hard disks to sleep when possible
-(wake for wi-fi network access unchecked)
-(power nap unchecked)

One more edit: Noticed the 10800 here is exactly 3 hours! Is that a coincidence? Does anybody know how to read/change these settings? This is in response to pmset -g

System-wide power settings:
Currently in use:
 standbydelay         10800
 standby              1
 halfdim              1
 hibernatefile        /var/vm/sleepimage
 powernap             0
 gpuswitch            2
 disksleep            10
 sleep                15 (sleep prevented by coreaudiod)
 autopoweroffdelay    28800
 hibernatemode        3
 autopoweroff         1
 ttyskeepawake        1
 displaysleep         15
 acwake               0
 lidwake              1

Solution 1:

It may be worth resetting your System Management Controller (SMC) to see if this resolves this behaviour.

To do this on your MacBook Air follow these steps:

1. Shut down your Mac
2. Keep the MagSafe adapter (power cable) plugged in.
3. Press at the same time shiftoptioncontrol (on the left side of the bult-in keyboard) and the power button
4. Let go
5. Turn your Mac back on with the power button.

Let me know how you go.

Boot into Safe Mode

Since resetting the SMC didn't resolve this for you, I'd test to see if this still happens when booted into Safe Mode. To do this, follow these steps:

1. Fully shut down your Mac
2. Restart your Mac
3. Immediately press the Shift key and keep it down
4. Let go of the Shift key when you see the login window (NOTE: If you have FileVault enabled you may need to log in twice).
5. Take a note of what happens (i.e. Close the lid and check again to see if it still wakes up 3hrs later)
6. Exit Safe Mode by restarting your Mac as normal

Run Apple Diagnostics

Now that we've established Safe Mode makes no difference and resetting the SMC didn't help, it's time to test your Apple hardware. Your model of MacBook Air uses Apple Diagnostics to do this. Follow these steps:

1. Fully shut down your Mac
2. Restart your Mac
3. Immediately press the D key and keep it down until you see the Diagnostics screen appear
4. Wait for Diagnostics to finish (this typically only takes a few minutes)
5. Once complete, one of two things will appear on the screen:
   • a No issues found message
   • a brief description of any errors found plus further instructions
6. If the diagnostics test does find errors, take a note of what they are

Note: If pressing and holding the D key at Step 3 doesn't work, start again at Step 1 and, at Step 3 press and hold both the OptionD keys instead. This will try and run diagnostics from the internet instead, so you will need to allow more time for it to complete.

Regardless, take a note of what happens and let me know how you went.