Not with the sleep/wake events -- laptop's lock screen doesn't kick in until 15 minutes of sleep, and I was impatient! -- but with a 10 second pause at the top, a 3 x "System Beep" replacing the "Sleep" action, then running the macro and ⌘⌃Q to lock the screen.
So the shell script works -- I'll have a dig into the rest.
Update -- the beeps work on a wake-triggered version too. Perhaps it's the "Sleep" action that's the problem?
Using your method you could do your first search, grab a timestamp, then repeat the search with that instead of "Wake reason".
Trying to limit the cruft:
log show --style syslog --last 24h | grep "to FullWake"
...gets me the manual (eg tapped the space bar) wake events for the last 24 hours. You could then use the timestamp to look at what else was happening around then, eg
log show --style syslog --last 24h | grep "2022-06-19 09:38:53" | less
If your "auto-wakes" aren't getting recorded as "to FullWake" in the logs we'll have to look for another way to filter.
I tested with a beep and that works fine as long as the pause isn't too short at the start. 5s is too short; 10s is fine. However, the sleep command isn't working for me. I replaced it with a simulated Escape key, and that resulted in a black screen but the fans didn't stop spinning, so it's not really 'asleep'. Bit stumped.
I'm unsure why we'd want to see the manual wakes, when it's the ones that aren't manually triggered that we're looking for...? I'm sure your logic is sound, but I don't follow. Anyway, here's what Terminal spits out in response to log show --style syslog --last 24h | grep "to FullWake":
Terminal Output
2022-06-18 20:27:04.323532+0100 localhost powerd[115]: [powerd:sleepWake] DarkWake to FullWake from Deep Idle [CDNVA] : due to UserActivity Assertion
2022-06-18 20:27:13.848589+0100 localhost powerd[115]: [powerd:sleepWake] DarkWake to FullWake from Deep Idle [CDNVA] : due to HID Activity
2022-06-18 20:29:03.025693+0100 localhost powerd[115]: [powerd:sleepWake] DarkWake to FullWake from Deep Idle [CDNVA] : due to HID Activity
2022-06-18 20:29:50.657468+0100 localhost powerd[115]: [powerd:sleepWake] DarkWake to FullWake from Deep Idle [CDNVA] : due to HID Activity
I'm getting the feeling you can't sleep from the lock screen using KM. Note that, on my machines at least, there's no "Sleep" button on the lock screen's GUI either.
I'm giving pmset a go now...
I can't simulate your "accidental" wake-ups, so I'm testing with manual in the hope that both versions result in a "FullWake" entry in the logs. If you've had an unrequested wake-up since 8pm yesterday then I guess they don't.
But there may be a better way (which I'm surprised they didn't tell you to do):
pmset -g log | egrep '\b(Sleep|Wake|Start)\s{2,}'
...should get you a list of sleep/wake/start entries. Find whatever corresponds to your mystery event in there -- then the rest of that line may give you a clue, otherwise use the timestamp to check other logs via eg Console's "Mac Analytics Data". Also worth, if you haven't already, unlocking as soon as you can after a mystery awakening and running:
Pushover is an amazing tool for troubleshooting. It gives me an exact time the error occurred, helping narrow down the issues via those commands you gave me. I'm building a list...
Also, I've noticed that after I use pmset sleepnow, it doesn't wake again. Perhaps this is a viable solution if I can't solve the main issue.
.
.