My digital ocean droplet have some unecpected shutdowns in the last days.

The droplet ist off and i have to power it on again. If the system requested a power down then a log entry should exist. But there is nothing. Server Logs show normal traffic, nothing special and then boom system off. From my perspective it looks like a Power failure on real hardware without the posibility to capture everything. On a Kernel Panic the system shoud perform a Reboot not a power down. You I try this behavier with sysctl debug.kdb.panic=1

I wrote to the support team but they answer that my guest requested the shutdown and everything is fine with the hypervisor and other systems running on it. So they deny my request to move my droplet to another hypervisor.

At the moment i dont have an idea for future investigation.

System and Services:

  • FreeBSD with ZFS
  • PF
  • NginX
  • uWSGI
  • sshd
  • autossh tunel to another machine
  • munin node + master

There is absolutly nothing in my logfiles and "last" dose not show a requested shutdown. Below you will find thelast logline bevor and after from /var/log/messages

I hope you have some Ideas


-> % last | grep shutdown
shutdown time Tue Dec 5 09:16
monocult pts/1 xxx Tue Dec 5 09:14 - shutdown (00:02)
monocult pts/0 xxx Tue Dec 5 08:36 - shutdown (00:40)
shutdown time Sat Dec 2 13:48
monocult pts/0 xxx Sat Dec 2 13:46 - shutdown (00:01)

Dec 1 21:39:56 application-server sshd[1987]: error: maximum authentication attempts exceeded for invalid user root from xxx port 45166 ssh2 [preauth]
Dec 2 13:46:13 application-server syslogd: kernel boot file is /boot/kernel/kernel

Dec 5 00:42:33 application-server sshd[68482]: error: maximum authentication attempts exceeded for invalid user root from xxx port 52546 ssh2 [preauth]
Dec 5 08:34:26 application-server syslogd: kernel boot file is /boot/kernel/kernel

I don't have enough reputation to comment but I wanted to add to your post by saying that I'm having the exact same experience. Happened on Dec 18th at 10:13AM UTC.

Even after countless emails to support, they are reporting that everything is fine on their end and yet I have a droplet that looks like the power was pulled from the wall. Nothing in the logs that show a shutdown was requested either by the DO dashboard or from withing the OS. If it helps to narrow down the issue and maybe find a commonality, I was running the following on my droplet:

  • Postfix
  • Dovecot
  • Ezjail
  • pf
  • Nginx (x3)
  • PHP (x2)
  • mySQL
  • openVPN (x2)
  • Quagga ospf and zebra
  • Nagios NRPE (x5)
  • SSHd (x5)

The droplet also runs FreeBSD 11.1 x64 with ZFS and 100GB of block storage.

Support is saying they can't do anything unless this is reproducible. I'd gladly swap details with you if you think combining our support cases will help DigitalOcean?

Again, I know this isn't an answer and I'm not trying to hijack your thread, just supporting the validity of your experience.

  • After the talk with the support member everything works. So i think that digital ocean has done some thing, but dosent tell me. Not the best political move but i dont have an other answer. The only thing i change is that i restricted ssh access to my remote ip. But i cant belive that the tigger is an ssh bug or that someon has gained access to the machine. (I checked this with a diff to an earlyer snapshot) sorry for the late reply, hope to heer from you! – monocult Jan 9 '18 at 13:06

check disks via smartmontools, 95% problem there

  • 2
    This is a VM / container. You need access to a bare hard drive to get that. – Spooler Dec 16 '17 at 21:02

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.