AWS EC2服务器与Apache随机自动关机问题排查求助

大家好，我遇到了一个棘手的问题，AWS EC2服务器会随机自动关机，已经发生两次了，实在找不到原因，想请各位帮忙排查一下。

服务器环境说明 #

• 操作系统：Ubuntu 18.04.6 LTS
• 部署两个站点：
  • domain.com：WordPress站点，直接运行在Apache2上
  • docs.domain.com：React/Next.js应用，通过pm2 + yarn管理进程，Apache反向代理到本地3000端口

Apache虚拟主机配置 #

domain.com 的Vhost配置 #

<VirtualHost *:443>
ServerName domain.com
DocumentRoot /var/www/html
ServerAlias domain.com
ErrorLog /var/www/error.log
CustomLog /var/www/requests.log combined
SSLEngine on
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/domain.com-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com-0001/privkey.pem
</VirtualHost>

<VirtualHost *:80>
ServerName domain.com
DocumentRoot /var/www/html
ServerAlias bangdb.com
ErrorLog /var/www/error.log
CustomLog /var/www/requests.log combined
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

docs.domain.com 的Vhost配置 #

<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName docs.domain.com
ProxyRequests Off
ProxyPreserveHost On
ProxyVia Full
ServerSignature Off
<Proxy *>
Require all granted
</Proxy>
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/domain.com-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com-0001/privkey.pem
</VirtualHost>
</IfModule>

故障现象 #

服务器在2023年1月22日07:39左右（日志时间）突然关机，两个站点完全无法访问，SSH也连不上，只能通过AWS控制台手动重启才能恢复。这是第二次出现该问题，第一次发生在2022年12月17日。

故障时的日志信息 #

syslog 关键片段 #

Jan 22 07:09:36 ip-172-30-0-37 systemd[1]: Starting Clean php session files...
Jan 22 07:09:36 ip-172-30-0-37 systemd[1]: Started Clean php session files.
Jan 22 07:17:00 ip-172-30-0-37 snapd[15896]: autorefresh.go:540: Cannot prepare auto-refresh change due to a permanent network error: persistent network error: Post https://api.snapcraft.io/v2/snaps/refresh: dial tcp: lookup api.snapcraft.io: Temporary failure in name resolution
Jan 22 07:17:00 ip-172-30-0-37 snapd[15896]: stateengine.go:149: state ensure error: persistent network error: Post https://api.snapcraft.io/v2/snaps/refresh: dial tcp: lookup api.snapcraft.io: Temporary failure in name resolution
Jan 22 07:17:01 ip-172-30-0-37 CRON[30597]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Jan 22 07:20:01 ip-172-30-0-37 CRON[30603]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp)
Jan 22 07:20:01 ip-172-30-0-37 sm-msp-queue[30622]: My unqualified host name (ip-172-30-0-37) unknown; sleeping for retry
Jan 22 07:21:01 ip-172-30-0-37 sm-msp-queue[30622]: unable to qualify my own domain name (ip-172-30-0-37) -- using short name
Jan 22 07:39:01 ip-172-30-0-37 CRON[30649]: (root) CMD (  [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi)
Jan 22 07:39:36 ip-172-30-0-37 systemd[1]: Starting Clean php session files...
Jan 22 07:39:36 ip-172-30-0-37 systemd[1]: Started Clean php session files.
Jan 22 07:39:47 ip-172-30-0-37 systemd[1]: Received SIGINT.
Jan 22 07:39:47 ip-172-30-0-37 systemd[1]: Stopped target Cloud-init target.
Jan 22 07:39:47 ip-172-30-0-37 systemd[1]: Stopping Authorization Manager...
Jan 22 07:39:47 ip-172-30-0-37 systemd[1]: Stopping User Manager for UID 1000...
Jan 22 07:39:47 ip-172-30-0-37 systemd[1]: Stopped target Timers.
Jan 22 07:39:47 ip-172-30-0-37 systemd[18626]: Stopped target Default.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Mounted POSIX Message Queue File System.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Started Set the console keyboard layout.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Mounted Huge Pages File System.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Started Create list of required static device nodes for the current kernel.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Mounted Kernel Debug File System.
Jan 22 07:40:41 ip-172-30-0-37 systemd[1]: Started Remount Root and Kernel File Systems.

Apache 日志关键片段 #

[Sat Jan 21 06:25:02.412725 2023] [ssl:warn] [pid 31096] AH01909: ip-172-30-0-37.ec2.internal:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jan 21 06:25:02.413374 2023] [mpm_prefork:notice] [pid 31096] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.1 configured -- resuming normal operations
[Sat Jan 21 06:25:02.413383 2023] [core:notice] [pid 31096] AH00094: Command line: '/usr/sbin/apache2'
[Sat Jan 21 17:07:54.107574 2023] [mpm_prefork:error] [pid 31096] AH00161: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
[Sun Jan 22 06:25:01.992892 2023] [mpm_prefork:notice] [pid 31096] AH00171: Graceful restart requested, doing restart
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using fe80::8b1:5dff:fe04:4731. Set the 'ServerName' directive globally to suppress this message
[Sun Jan 22 06:25:02.073408 2023] [ssl:warn] [pid 31096] AH01909: fe80::8b1:5dff:fe04:4731:443:0 server certificate does NOT include an ID which matches the server name
[Sun Jan 22 06:25:02.074116 2023] [mpm_prefork:notice] [pid 31096] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.1 configured -- resuming normal operations
[Sun Jan 22 06:25:02.074125 2023] [core:notice] [pid 31096] AH00094: Command line: '/usr/sbin/apache2'
[Sun Jan 22 07:39:47.609420 2023] [mpm_prefork:notice] [pid 31096] AH00169: caught SIGTERM, shutting down

我反复查看了日志，注意到syslog里有systemd[1]: Received SIGINT.的记录，Apache日志里也显示收到SIGTERM信号关机，但完全找不到是什么触发了这个信号。另外之前Apache还出现过MaxRequestWorkers耗尽的警告，不知道和这个问题有没有关联？

想请教各位大佬，这种随机关机的情况可能是什么原因导致的？有没有什么排查方向或者解决方案？

备注：内容来源于stack exchange，提问作者ujjwal