Sandboxd error messages

Question

Level 2

251 points

Sandboxd error messages

I seem to get a variety of sandboxd related error messages that I have no idea how to solve. I've tried looking here, but none of the topics have quite had the exact same issue.

As background - I recently bought a 15" retina MacBook Pro, and used TimeMachine to move over all my files from my old late 2007 model iMac. But I ran into a problem with the MBP not waking the screen up after the energy saver has turned it off. And upon inspecting my Console, I discovered a raft of different sandboxd related error messages. I also checked the iMac (also running Mountain Lion), and the error messages were there too.

Many of them seem to involve the mdworker:

11/11/2012 17:38:23.375 mdworker[1966]: Unable to talk to lsboxd

11/11/2012 17:38:23.380 mdworker[1965]: Unable to talk to lsboxd

11/11/2012 17:38:23.435 sandboxd[1967]: ([1966]) mdworker(1966) deny mach-lookup com.apple.ls.boxd

11/11/2012 17:38:23.440 sandboxd[1967]: ([1965]) mdworker(1965) deny mach-lookup com.apple.ls.boxd

Others involve qtkits and coresymbolicationd

11/11/2012 17:29:04.050 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:04.124 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:09.725 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:09.733 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:09.741 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.310 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.317 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.326 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.504 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.525 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:29:10.545 sandboxd[1901]: ([1899]) com.apple.qtkits(1899) deny system-fsctl 0x7a0c

11/11/2012 17:30:16.927 com.apple.launchd[1]: (com.apple.quicklook.satellite.5BCCE65C-378E-4205-9FCA-DEF8B620C4A0[1898]) Exit timeout elapsed (20 seconds). Killing

11/11/2012 17:30:36.927 com.apple.launchd[1]: (com.apple.qtkitserver[1899]) Exit timeout elapsed (20 seconds). Killing

11/11/2012 17:30:36.927 com.apple.launchd[1]: (com.apple.qtkittrustedmoviesservice[1900]) Could not terminate job: 3: No such process

11/11/2012 17:30:36.927 com.apple.launchd[1]: (com.apple.qtkittrustedmoviesservice[1900]) Using fallback option to terminate job...

11/11/2012 17:30:44.969 sandboxd[1915]: ([1913]) com.apple.qtkits(1913) deny system-fsctl 0x7a0c

11/11/2012 17:30:44.000 kernel[0]: Sandbox: sandboxd(1915) deny mach-lookup com.apple.coresymbolicationd

Earlier messages also said:

11/11/2012 14:59:37.225 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

11/11/2012 14:59:37.376 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

11/11/2012 14:59:37.527 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

11/11/2012 14:59:37.667 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

11/11/2012 14:59:37.759 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

11/11/2012 14:59:37.908 sandboxd[105]: ([209]) com.apple.qtkits(209) deny file-read-data /Users/*username*/Downloads

What processes cause these errors? I've been trying to figure that out, but haven't had much luck.

MacBook Pro with Retina display, OS X Mountain Lion (10.8.2), 16GB RAM, 512GB SSD, 15" display

Posted on Nov 11, 2012 10:02 AM

Reply

Answer 1

Mika Inkinen Author

Level 2

251 points

Nov 11, 2012 10:10 AM in response to Mika Inkinen

Again, within a minute, I got a whole raft of these error messages:

11/11/2012 18:04:00.888 com.apple.launchd[1]: (com.apple.quicklook.satellite.40944631-A71C-4A03-BF0C-99C153816307[2180]) Exited: Killed: 9

11/11/2012 18:04:12.999 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:12.000 kernel[0]: Sandbox: sandboxd(2192) deny mach-lookup com.apple.coresymbolicationd

11/11/2012 18:04:13.019 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:13.040 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:20.032 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:20.208 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:20.510 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:20.887 com.apple.launchd[1]: (com.apple.qtkitserver[2181]) Exit timeout elapsed (20 seconds). Killing

11/11/2012 18:04:20.888 com.apple.launchd[1]: (com.apple.qtkittrustedmoviesservice[2182]) Could not terminate job: 3: No such process

11/11/2012 18:04:20.888 com.apple.launchd[1]: (com.apple.qtkittrustedmoviesservice[2182]) Using fallback option to terminate job...

11/11/2012 18:04:21.179 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:21.199 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:21.219 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:21.362 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:21.383 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:21.403 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:23.028 com.apple.usbmuxd[54]: _recv_msg errno: 0

11/11/2012 18:04:23.848 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:23.929 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:24.051 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:24.482 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny file-read-data /Library/InputManagers

11/11/2012 18:04:24.503 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny file-read-data /Library/InputManagers

11/11/2012 18:04:25.637 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:25.645 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:25.653 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:26.512 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:26.520 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:26.530 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

11/11/2012 18:04:28.656 sandboxd[2192]: ([2190]) com.apple.qtkits(2190) deny system-fsctl 0x7a0c

Reply

Answer 2

Kappy

Level 10

361,741 points

Nov 11, 2012 10:10 AM in response to Mika Inkinen

I think you have restored what you should not have restored. I recommend this:

Install or Reinstall Lion/Mountain Lion from Scratch

Be sure you backup your files to an external drive or second internal drive because the following procedure will remove everything from the hard drive.

Boot to the Recovery HD:

Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.

Erase the hard drive:

1. Select Disk Utility from the main menu and click on the Continue button.

2. After DU loads select your startup volume (usually Macintosh HD) from the

left side list. Click on the Erase tab in the DU main window.

3. Set the format type to Mac OS Extended (Journaled.) Optionally, click on

the Security button and set the ZeroData option to one-pass. Click on

the Erase button and wait until the process has completed.

4. Quit DU and return to the main menu.

Reinstall Lion: Select Reinstall Lion/Mountain Lion and click on the Install button.

Note: You will need an active Internet connection. I suggest using Ethernet if possible

because it is three times faster than wireless.

Afterward you can restore only your Home folder and third-party applications. Before you restore your files check your console log to see that the repetitive messages have ceased.

Reply

Answer 3

Mika Inkinen Author

Level 2

251 points

Nov 11, 2012 10:21 AM in response to Kappy

Ouch... I didn't realise it's that bad. The same errors also occur on my iMac, so is it some legacy thing associated with upgrading from older OSX versions?

I do have a local copy of Mountain Lion as well, is there any way of using that instead of having to re-download it? e.g. starting it in target disk mode and installing it via my iMac, or rebooting from an external OSX drive and installing it from there?

Reply

Answer 4

Kappy

Level 10

361,741 points

Nov 11, 2012 10:39 AM in response to Mika Inkinen

I do have a local copy of Mountain Lion as well, is there any way of using that instead of having to re-download it? e.g. starting it in target disk mode and installing it via my iMac, or rebooting from an external OSX drive and installing it from there?

Then just open the install application and go from there. That will be faster than downloading it. Be sure you have the installer in your Downloads folder. Don't run it from the Applications folder or it will be deleted after the installation is complete.

Reply

Answer 5

Mika Inkinen Author

Level 2

251 points

Nov 13, 2012 2:35 PM in response to Kappy

Thanks very much for that. I reinstalled Mountain Lion, though it does not appear to allow you to format the hard drive that way. So all my user directory information and applications were untouched.

But so far it certainly seems to have helped. The error messages that I used to get very regularly in Console seem by and large to have disappeared. Not quite completely though - I still get a few sandboxd related errors:

13/11/2012 22:01:10.838 sandboxd[485]: ([483]) com.apple.qtkits(483) deny file-read-data /Library/InputManagers

13/11/2012 22:01:10.000 kernel[0]: Sandbox: sandboxd(485) deny mach-lookup com.apple.coresymbolicationd

13/11/2012 22:01:10.881 sandboxd[485]: ([483]) com.apple.qtkits(483) deny file-read-data /Library/InputManagers

13/11/2012 22:04:40.000 kernel[0]: Sandbox: sandboxd(562) deny mach-lookup com.apple.coresymbolicationd

13/11/2012 22:25:54.810 sandboxd[651]: ([650]) QuickLookSatelli(650) deny mach-lookup com.apple.PowerManagement.control

13/11/2012 22:25:55.000 kernel[0]: Sandbox: sandboxd(651) deny mach-lookup com.apple.coresymbolicationd

Those are the only such messages I've had in a day (as opposed to reams of them every few minutes).

However, it does seem to have started giving me errors related to the Dock:

13/11/2012 22:20:11.908 WindowServer[98]: CGXGetWindowType: Invalid window 1086

13/11/2012 22:20:11.909 Dock[167]: find_shared_window: Invalid depth WindowID 0x43e

13/11/2012 22:20:11.909 Dock[167]: CGSGetWindowTags: Invalid window 0x43e

13/11/2012 22:20:11.909 Dock[167]: find_shared_window: WID 1085

13/11/2012 22:20:11.909 Dock[167]: CGSGetWindowTags: Invalid window 0x43d

13/11/2012 22:20:11.910 Dock[167]: find_shared_window: WID 1084

13/11/2012 22:20:11.910 Dock[167]: CGSGetWindowTags: Invalid window 0x43c

13/11/2012 22:20:11.910 Dock[167]: find_shared_window: WID 1083

13/11/2012 22:20:11.910 Dock[167]: CGSGetWindowTags: Invalid window 0x43b

13/11/2012 22:20:11.910 Dock[167]: find_shared_window: WID 1082

13/11/2012 22:20:11.910 Dock[167]: CGSGetWindowTags: Invalid window 0x43a

And the Calendar:

13/11/2012 22:33:48.858 CalendarAgent[209]: [com.apple.calendar.store.log.alarms] [Could not parse the ics containing the default alarms. Using none as the default alarms. ICS: BEGIN:VALARM X-WR-ALARMUID:D012E1FA-D15D-4662-A0DE-7F4FDB8AB57C UID:D012E1FA-D15D-4662-A0DE-7F4FDB8AB57C TRIGGER:-PT15H ATTACH;VALUE=URI:Basso ACTION:AUDIO END:VALARM]

13/11/2012 22:33:48.861 CalendarAgent[209]: [com.apple.calendar.store.log.alarms] [Could not parse the ics containing the default alarms. Using none as the default alarms. ICS: BEGIN:VALARM X-WR-ALARMUID:EE3C8C58-E727-43CE-9FDB-51A7495F934D UID:EE3C8C58-E727-43CE-9FDB-51A7495F934D TRIGGER:-PT15M ATTACH;VALUE=URI:Basso ACTION:AUDIO END:VALARM]

Not sure what to make of those...

Reply

Answer 6

Kappy

Level 10

361,741 points

Nov 13, 2012 2:51 PM in response to Mika Inkinen

Got me. Reading console log entries is one thing. Making heads or tails of them is quite another.

Reply

Answer 7

Nov 15, 2012 2:27 AM in response to Kappy

I had similar issues, however they only became a problem a couple of weeks down the track after a restore.

Problem: Time Machine taking a long time to build/index/query files on the system after an upgrade/restore.

So far i have fixed this in two different ways.:

1) open terminal and running

sudo chown -R <your-user>:staff /home/<your-user>/

This fixed a lot of file permissions for Time Machine, and some of the applications i was using, everything in this directory is owned by you, so it is safe to make it yours again!

2) If you open Console and keep a close eye on it, you can see the mdworker and the sandbox daemons having trouble, but to find out what files it is looking for you can run this command inside Terminal

sudo opensnoop -n mdworker

This will query the openfiles that mdworker is looking/using, in the first column we can also see the UID and the Process ID, if you are finding hangs, there is normal a problem with this file, to fix this you will need to Google the file manually to find out what it does and does not, if its in your /home/<user> directory your pretty safe. If your like me, i have brew installed, and the permissions for brew can somtimes become overridden by Mac, and manually i have to reset them back to my user. To keep this short, tread with caution, and keep a backup! 🙂

Hope this helps, its been a long night but i managed to get rid of 90% of them and my mac is a lot happier!

Thanks!

- Kyle

Reply

Answer 8

Mika Inkinen Author

Level 2

251 points

Nov 19, 2012 5:32 PM in response to kylescottmcgill

I tried using sudo chown, but the /home directory is empty. Did you mean /Users/<your-user>/ ?

I still keep getting these messages at regular intervals:

19/11/2012 09:25:57.000 kernel[0]: Sandbox: sandboxd(7337) deny mach-lookup com.apple.coresymbolicationd

19/11/2012 09:25:57.608 sandboxd[7337]: ([7333]) mdworker(7333) deny mach-lookup com.apple.ls.boxd

19/11/2012 09:25:57.615 sandboxd[7337]: ([7335]) mdworker(7335) deny mach-lookup com.apple.ls.boxd

19/11/2012 09:25:57.621 sandboxd[7337]: ([7334]) mdworker(7334) deny mach-lookup com.apple.ls.boxd

19/11/2012 09:31:06.000 kernel[0]: Sandbox: sandboxd(7374) deny mach-lookup com.apple.coresymbolicationd

19/11/2012 09:31:08.979 sandboxd[7374]: ([7369]) mdworker(7369) deny mach-lookup com.apple.ls.boxd

19/11/2012 09:31:08.985 sandboxd[7374]: ([7370]) mdworker(7370) deny mach-lookup com.apple.ls.boxd

19/11/2012 09:31:08.991 sandboxd[7374]: ([7372]) mdworker(7372) deny mach-lookup com.apple.ls.boxd

It's starting to drive me nuts!

Reply

Answer 9

Nov 19, 2012 5:39 PM in response to Mika Inkinen

Hi Mika,

Sorry i did mean /Users/<your-users> and also i would like to apologise for the lack of grammar in that last post...

Did opensnoop give you any more clues as to what files were causing problems?

At the moment i still get some, but no-where as many as i used to, however it looks like you still get quite a lot.

Thanks!

- Kyle

Reply

Answer 10

Kappy

Level 10

361,741 points

Nov 19, 2012 6:30 PM in response to Mika Inkinen

Yes, you could do that, but to connect the two in Target Disk Mode requires both computers be connected by a FireWire cable. You can also do it from an external drive.

Reply

Answer 11

Mika Inkinen Author

Level 2

251 points

Nov 25, 2012 6:00 AM in response to kylescottmcgill

The opensnoop hasn't really allowed me to narrow it down much - because it doesn't give an exact enough time stamp for the processes, even if i look at the outputs at exactly the same time as i get the console error message, i can't really tell what processes spotlight was indexing.

I tried using the -v option (sudo opensnoop -v -n mdworker) to give a string time stamp, but it only gives it to the nearest second and it shows over a hundred items being indexed in that one second.

So I'm stumped. I don't know whether I should just live with the error messages and hope it's nothing serious, or reinstall the operating system completely from scratch and hope that solves it.

I also tried rebuilding the Spotlight index, but that did not solve the problem either.

Reply

Answer 12

nevasha

Level 1

4 points

Dec 7, 2012 6:23 PM in response to Mika Inkinen

Thanks Kyle for sharing, as this resoved all but the following error message that I am aware of hot off the screen

Dec 7 18:14:23 kernel[0]: IOHIDSystem cursor update overdue. Resending.

Dec 7 18:14:42 mdworker[2956]: Unable to talk to lsboxd

Dec 7 18:14:42 mdworker[2955]: Unable to talk to lsboxd

Dec 7 18:14:43 kernel[0]: Sandbox: sandboxd(2959) deny mach-lookup com.apple.coresymbolicationd

Dec 7 18:14:44 sandboxd[2959] ([2956]): mdworker(2956) deny mach-lookup com.apple.ls.boxd

Dec 7 18:14:44 sandboxd[2959] ([2955]): mdworker(2955) deny mach-lookup com.apple.ls.boxd

Dec 7 18:16:17 kernel[0]: IOHIDSystem cursor update overdue. Resending.

Dec 7 18:16:47 --- last message repeated 1 time ---

Dec 7 18:17:01 mdworker[2965]: Unable to talk to lsboxd

Dec 7 18:17:01 mdworker[2964]: Unable to talk to lsboxd

Dec 7 18:17:02 kernel[0]: Sandbox: sandboxd(2969) deny mach-lookup com.apple.coresymbolicationd

Dec 7 18:17:03 sandboxd[2969] ([2965]): mdworker(2965) deny mach-lookup com.apple.ls.boxd

Dec 7 18:17:03 sandboxd[2969] ([2964]): mdworker(2964) deny mach-lookup com.apple.ls.boxd

Like Mika I don't wish to rebuild the system, hate to loose my app related prefrences, bookmarks the lot.

This is now feeling lot like my old Windows XP box !!

Reply

Answer 13

nevasha

Level 1

4 points

Dec 7, 2012 7:05 PM in response to kylescottmcgill

Kyle,

Can you qualify the following:

This will query the openfiles that mdworker is looking/using, in the first column we can also see the UID and the Process ID, if you are finding hangs -

as in how do I identify what is hanging?

Reply

Answer 14

Dec 7, 2012 7:16 PM in response to nevasha

Hi nevasha,

In my particular case a Hang resulted in permission errors being thrown and a process looping over the same files (trying harder to index the file).

To more or less sum up my experience, i have yet to have any real problems after a general cleanup, i still have the odd console error message come through, but all and all my Mac is running fine. On numerous websites people have commented its not worth a rebuild, and it doesnt cause any real problems. Long Index Times by Spotlight occur every now and then, but its not something too bad.

I hope this helps!

Thanks!

- Kyle

Reply

Answer 15

Jan 4, 2013 3:49 PM in response to Kappy

I am also ving these errors but did not restore, in fact I recently did a clean installation of Mountain Lion on my iMac.

sandboxd: ([624]) com.apple.qtkits(624) deny file-read-data /Users/randyharris/Storage/Scratch/MediaPrep/iFlicks

many errors in console like the above, this happens when I move media files on my system, and or try to launch an AppleScript via Folder Actions to move these media files.

Reply