3

I would think the answer is unequivocally, "No." But...

My MacBook Pro logged "Diagnostic and Usage Messages" in the Console, at 4:19am, while it was physically closed and (therefore) sleeping. I was physically asleep from a bit before 1am until 8am. I'm the only one who was here last night. When I woke up, I actually became alarmed that something in my house was physically out of place (although could try to chalk this up to paranoia and poor memory), so began to worry about a physical intrusion. I went to check my laptop, opened it and as soon as it woke, I got Little Snitch dialogs about connecting to radarsubmissions.apple.com, which I looked up and see this is usually for crash reporting diagnosics. No programs appear to have crashed. This led me to the Console application, where I see the entries from the middle of the night.

Is this determinate of a physical intrusion, or is there another possible explanation where my laptop stayed closed all night? I do see in the Console going back 6 days, all other logging is from times when I would have been using the laptop.

0

3 Answers 3

3

When you close the lid of a MacBook, it triggers a sensor which says to the running operating system "the lid is closed". It is up to the OS to decide what to do in this case. In particular, nothing forces the OS to go to sleep; the machine may perfectly operate while closed (this is not recommended because heat dissipation does not work as well when the lid is closed, but there is no impossibility). If the OS decides to go to sleep, then it also registers to the relevant circuitry the nature of the hardware events which may wake it up; these may include "opening the lid" but also "reaching a given specific time".

There are in fact several levels of sleeping; see for instance this page. Depending on the level, the extent of the sleeping changes (i.e. which elements are stopped and which keep on running). In any case, if the machine has been corrupted by some malware, then that malware may well make it so that when you put the machine to sleep by closing the lid, the "sleep mode" is only emulated, and the machine still runs; or the malware schedules an automatic wake-up even if the lid is still closed, in order to further its nefarious schemes.

It is even possible that the people at Apple really play such games for totally honest and harmless reasons, e.g. to run normal regular housekeeping tasks when it is least consequential for the human user, i.e. when the user is not in front of the machine and using it.

Alternatively, you are a sleepwalker.

4
  • 1
    Thanks Thomas. I knew some of this, but last I'd checked (will check again), I do have it set to sleep on close. I thought about the wake for OS housekeeping possibility, but given a) I only went looking because of signs of physical intrusion in my house, b) last 6 days never seems to have any activity while I wasn't present, and c) slightly suspicious things within the late night logs (e.g. changing BSSID to unknown MAC address), I'm wanting to verify this is legit (or not).
    – Jason Boyd
    Jul 25, 2014 at 15:28
  • 1
    I don't believe I'm a sleepwalker. Happened once or twice when I was a little kid. I'm not on Ambien or anything :)
    – Jason Boyd
    Jul 25, 2014 at 15:30
  • It could also just be a bug. I've had two cases on different machines of design flaws or buggy preventing a laptop from properly sleeping. As with all other types of bugs, it might be that this one triggers very rarely and you hadn't noticed it before. If you're truly worried then set up another box to sniff the traffic sent by your machine and you'll get a clue what it stays up at night for. Jul 26, 2014 at 23:51
  • This and all comments are helpful. It's occurring to me, I should be able to look through system logs for the night in question to get a better sense of things. Any pointers as to what I might look for to support nefarious or non-nefarious activity?
    – Jason Boyd
    Jul 27, 2014 at 12:20
2

If that's a newer MacBook, it's probably just "Power Nap". Crash reports aren't mentioned but that could be covered under "Continues background downloads of Mac App Store items, including software updates".

0

I have observed "similar" behaviour, where my macbook is active even when its lid is closed and have not been touched for several hours.

In my case, the macbook was probing for wifi networks. I tried google to find an explanation why it was trying to connect to networks when it was supposed to sleep, but nothing turned up - guess there is a reason why you have to turn off all electronics during airplane takeoff and landing.

Detected the behavior with the code posted on this Q&A thread, which I ran on linux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .