Make sure you have ALL the monitoring turned on in the VM and then wait for it to happen again. When it does, just look at the error log in the VM.