I would think the answer is unequivocally, \"No.\" But... My MacBook Pro logged
ID: 660695 • Letter: I
Question
I would think the answer is unequivocally, "No." But...
My MacBook Pro logged "Diagnostic and Usage Messages" in the Console, at 4:19am, while it was physically closed and (therefore) sleeping. I was physically asleep from a bit before 1am until 8am. I'm the only one who was here last night. When I woke up, I actually became alarmed that something in my house was physically out of place (although could try to chalk this up to paranoia and poor memory), so began to worry about a physical intrusion. I went to check my laptop, opened it and as soon as it woke, I got Little Snitch dialogs about connecting to radarsubmissions.apple.com, which I looked up and see this is usually for crash reporting diagnosics. No programs appear to have crashed. This led me to the Console application, where I see the entries from the middle of the night.
Is this determinate of a physical intrusion, or is there another possible explanation where my laptop stayed closed all night? I do see in the Console going back 6 days, all other logging is from times when I would have been using the laptop.
Explanation / Answer
When you close the lid of a MacBook, it triggers a sensor which says to the running operating system "the lid is closed". It is up to the OS to decide what to do in this case. In particular, nothing forces the OS to go to sleep; the machine may perfectly operate while closed (this is not recommended because heat dissipation does not work as well when the lid is closed, but there is no impossibility). If the OS decides to go to sleep, then it also registers to the relevant circuitry the nature of the hardware events which may wake it up; these may include "opening the lid" but also "reaching a given specific time".
There are in fact several levels of sleeping; see for instance this page. Depending on the level, the extent of the sleeping changes (i.e. which elements are stopped and which keep on running). In any case, if the machine has been corrupted by some malware, then that malware may well make it so that when you put the machine to sleep by closing the lid, the "sleep mode" is only emulated, and the machine still runs; or the malware schedules an automatic wake-up even if the lid is still closed, in order to further its nefarious schemes.
It is even possible that the people at Apple really play such games for totally honest and harmless reasons, e.g. to run normal regular housekeeping tasks when it is least consequential for the human user, i.e. when the user is not in front of the machine and using it.