EC2 instance shutdown without alert & CloudTrail event.

Hello.

If the 'stopinstance' action is not found in CloudTrail, it is likely that the instance was not stopped by AWS API but rather through OS shutdown or similar operations.
Please check to see if there is any kind of high load occurring before stopping, or if there is a shutdown within the OS.

Hello!

https://repost.aws/knowledge-center/ec2-instance-automatic-reboot-cause https://repost.aws/knowledge-center/ec2-windows-identify-stop-reboot

These 2 knowledge center articles cover this exact topic for both Linux & Windows EC2 instances. If you cannot find a cloudtrail event, then it is likely that it is an OS initiated shutdown from within the EC2. This can happen due to crashing, kernel panic etc.

If you have not already, check on your AWS Health Dashboard to see if there were any notifications around degraded hardware for this instance. In cases where hardware goes bad, we may take your instance offline to move it to another host. This will always have a health event associated, so if there is not one present, it's not due to bad hardware.

Check your Health Dashboard The AWS Health Dashboard reports multiple instance reboot events, such as simplified automatic recovery, scheduled maintenance, and retirement. To act on the health notifications, either reschedule the scheduled event, or manually stop and start the instance. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-configuration-recovery.html https://docs.aws.amazon.com/health/latest/ug/getting-started-health-dashboard.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/reschedule-event.html