How to debug Windows Sandbox abnormal termination

Question

What (host) logged information is available to determine the source of my problem?

Thanks in advance for any insight you might provide.

Answer 1

I can see you're experiencing an error with Windows Sandbox unexpectedly terminating. This can be frustrating, especially when there's no clear reason provided in the error message.

To debug Windows Sandbox abnormal termination, here are several logging sources you can check:

1. Event Viewer - This should be your first stop
   • Open Event Viewer (run eventvwr.msc)
     • Check under "Windows Logs" > "Application" and "System" for entries with source "Windows Sandbox" or "Container"
       • Also look under "Applications and Services Logs" > "Microsoft" > "Windows" > "Containers"
       1. Process Monitor (Sysinternals)
          • Use this tool to monitor system calls made during sandbox launch
            • Filter for "WindowsSandbox.exe" or "wsl.exe" processes
            1. Resource Monitor
               • Run resmon.exe to check resource utilization when Sandbox crashes
                 • Look for memory pressure, disk or CPU bottlenecks
                 1. Virtualization logs
                    • Check "Applications and Services Logs" > "Microsoft" > "Windows" > "Hyper-V"
                      • Windows Sandbox uses virtualization technology similar to Hyper-V
2. ETW Tracing

• Use Event Tracing for Windows with the Microsoft-Windows-Containers provider
  • Command: xperf or wpr can be used to collect traces