The systemd service/service stops for no apparent reason. Why?

Question

linux

Twice in a year there was a situation that the systemd service stopped for some unknown reason and did not start back automatically
Service - website on flask (python)

I can not analyze the reason who stops the service.

Content

/etc/systemd/system/myservice.service :

[Unit]
Description=My Service
After=network-online.target
After=mysql.service
Requires=network-online.target
Requires=mysql.service

[Service]
User=root
WorkingDirectory=/home/myservice
ExecStart=/usr/bin/python3 /home/myservice/run.py
Restart=always

[Install]
WantedBy=multi-user.target

Conclusion

journalctl -u myservice.service

does not display anything critical, no critical termination of the process.

Content

syslog

at the time (Feb 4 06:18:19) when the service stopped for no apparent reason: [email protected]

uname-a

Linux tasgas 5.4.0-97-generic #110-Ubuntu SMP Thu Jan 13 18:22:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

What triggered the service stop? How to analyze what initiated the service stop?

PS: I'm not a real sysadmin, please don't throw tomatoes

Answer 1

at the time (Feb 4 06:18:19) when the service stopped for no apparent reason:

Either the user or the cronjob did it.
1) look at the .bash_history of all users
2) look at what crons are running at that time (/var/spool/cron/crontabs or something similar, plus /etc/crontab , /etc/cron*)

Answer 2

You have these lines in your log:

Feb  4 06:18:19 ubuntu-server systemd[1]: Reloading.
Feb  4 06:18:19 ubuntu-server systemd[1]: Stopping My Service...
Feb  4 06:18:19 ubuntu-server systemd[1]: myservice.service: Succeeded.
Feb  4 06:18:19 ubuntu-server systemd[1]: Stopped My Service.
Feb  4 06:18:19 ubuntu-server systemd[1]: Stopping MySQL Community Server...
Feb  4 06:18:20 ubuntu-server systemd[1]: mysql.service: Succeeded.
Feb  4 06:18:20 ubuntu-server systemd[1]: Stopped MySQL Community Server.
Feb 4 06:18:20 ubuntu-server systemd[1]: Reloading.

They tell us that someone called systemctl daemon-reload (and this command is called when editing unit files), and then someone deliberately started stopping myservice and mysql services. Accordingly, no automation will help you here, see who logged into the server at that time, and ask this person what he edited and why he stopped your application.
PS From root, running python code, and even working with the network, judging by the dependencies, is a bad idea. It looks like you don’t have a sysadmin in your company who would set everything up for you normally.