2026-04-08 18:06:53.344 +0000 Information 518 fms.example.com Administrator connected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:06:53.347 +0000 Information 520 fms.example.com Administrator disconnected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:03.038 +0000 Information 518 fms.example.com Administrator connected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:03.042 +0000 Information 520 fms.example.com Administrator disconnected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:03.799 +0000 Information 518 fms.example.com Administrator connected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:03.801 +0000 Information 520 fms.example.com Administrator disconnected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:04.558 +0000 Information 518 fms.example.com Administrator connected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:04.562 +0000 Information 738 fms.example.com Database "TheFile" being closed by "admin"...
2026-04-08 18:10:05.585 +0000 Information 168 fms.example.com Database "TheFile" closed.
2026-04-08 18:10:05.590 +0000 Information 520 fms.example.com Administrator disconnected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:06.322 +0000 Information 518 fms.example.com Administrator connected: "admin [XXX.XXX.XXX.XXX]" (fmsadmin).
2026-04-08 18:10:06.325 +0000 Information 488 fms.example.com Stopping Database Server...
2026-04-08 18:10:06.334 +0000 Information 410 fms.example.com Stopping FileMaker Database Engine...
2026-04-08 18:10:14.011 +0000 Information 412 fms.example.com FileMaker Database Engine stopped.
2026-04-08 18:10:14.014 +0000 Information 490 fms.example.com Database Server stopped.
2026-04-08 18:10:20.559 +0000 Information 704 fms.example.com Stopping Admin Server process...
2026-04-08 18:10:29.613 +0000 Information 952 fms.example.com Admin Server process stopped.
2026-04-08 18:10:30.325 +0000 Information 704 fms.example.com Stopping HTTP Server process...
2026-04-08 18:10:31.332 +0000 Information 952 fms.example.com HTTP Server process stopped.
2026-04-08 18:10:32.090 +0000 Information 703 fms.example.com Starting HTTP Server process...
2026-04-08 18:10:37.846 +0000 Information 703 fms.example.com Starting Admin Server process...
2026-04-08 18:10:39.604 +0000 Information 703 fms.example.com Starting Database Server process...
2026-04-08 18:10:40.609 +0000 Information 703 fms.example.com Starting FileMaker Script Engine process...
2026-04-08 18:10:41.733 +0000 Information 162 fms.example.com Starting Database Server 22.0.1 66(06-25-2025)...
2026-04-08 18:10:41.733 +0000 Information 763 fms.example.com Running on Ubuntu 22.04.5 LTS, with 2 logical processor core(s)
What happened was… I got a ticket from the client… “Urgent Filemaker isnt opening”. I logged into FMS Admin Console and was surprised to see that indeed, the file was closed.
I see a ton of “Administrator connected” / “Administrator disconnected” messages, and it should be noted that the IP address (obfuscated in my log file as “XXX.XXX.XXX.XXX”) is the public IP address of the server.
So, am I assuming that these frequent connections / disconnections is OttoFMS? And am I also correct in assuming that OttoFMS is responsible for restarting FMS in this fashion? I looked through the OttoFMS logs and didn’t see anything suspicious that would line up with this event.
Check the syslog in /var/log/ for any events around that time. FMS can stop in this way when the server comes under significant memory pressure. Otto and the DMT will put a strain on resources if the server is under spec. Syslog is rotated regularly, to go back to previous entries / days you’ll need to look in the syslog.1, syslog.2 etc files
Double check you have swap memory enabled on the server free -h will output current memory including swap. The recommended minimum level of swap memory is 8Gb.
The 2-core CPU is below minimum spec for FileMaker Server (minimum spec for FMS is 4-Core CPU).
It would be worth upgrading to FMS 22.0.6 on the chance this might be a rare edge case addressed in a subsequent version
OttoFMS never automatically restarts the Database server. You can restart it from the services tab (or via API), but that would have an accompanying log in the otto-info.log that says a restart has been requested.
The connected disconnected logs you’re seeing in the Event.log are fmsadmin instances starting and stopping. OttoFMS uses the fmsadmin cli for file listing, backups, and credential checking among other things, so its normal to see a bunch of them.
I found the event in syslog. Here’s what I hope is enough to shed some additional light:
Apr 8 18:09:12 ip-XXX-XXX-XXX-XXX systemd[1]: Starting Clean php session files...
Apr 8 18:09:12 ip-XXX-XXX-XXX-XXX systemd[1]: phpsessionclean.service: Deactivated successfully.
Apr 8 18:09:12 ip-XXX-XXX-XXX-XXX systemd[1]: Finished Clean php session files.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Created slice User Slice of UID 0.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Starting User Runtime Directory /run/user/0...
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Finished User Runtime Directory /run/user/0.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Starting User Manager for UID 0...
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Queued start job for default target Main User Target.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Created slice User Application Slice.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Reached target Paths.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Reached target Timers.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Starting D-Bus User Message Bus Socket...
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on GnuPG network certificate management daemon.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on GnuPG cryptographic agent and passphrase cache.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on debconf communication socket.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on REST API socket for snapd user session agent.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Listening on D-Bus User Message Bus Socket.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Reached target Sockets.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Reached target Basic System.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Started User Manager for UID 0.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Reached target Main User Target.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[141387]: Startup finished in 67ms.
Apr 8 18:10:02 ip-XXX-XXX-XXX-XXX systemd[1]: Started Session 16761 of User root.
Apr 8 18:10:20 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Stopping Admin Server process...
Apr 8 18:10:29 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Admin Server process stopped.
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Stopping HTTP Server process...
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX systemd[1]: Started Filemaker.com monitor system and stop Nginx Server.
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX systemd[1]: com.filemaker.nginx.start.service: Main process exited, code=killed, status=9/KILL
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX systemd[1]: com.filemaker.nginx.stop.service: Deactivated successfully.
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX systemd[1]: com.filemaker.nginx.start.service: Failed with result 'signal'.
Apr 8 18:10:30 ip-XXX-XXX-XXX-XXX systemd[1]: com.filemaker.nginx.start.service: Consumed 10min 8.377s CPU time.
Apr 8 18:10:31 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: HTTP Server process stopped.
Apr 8 18:10:32 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Starting HTTP Server process...
Apr 8 18:10:36 ip-XXX-XXX-XXX-XXX systemd[1]: Starting Filemaker.com monitor system and start Nginx Server...
Apr 8 18:10:36 ip-XXX-XXX-XXX-XXX systemd[1]: Started Filemaker.com monitor system and start Nginx Server.
Apr 8 18:10:37 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Starting Admin Server process...
Apr 8 18:10:39 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Starting Database Server process...
Apr 8 18:10:40 ip-XXX-XXX-XXX-XXX com.filemaker.syslogger[777]: Starting FileMaker Script Engine process...
Apr 8 18:11:24 ip-XXX-XXX-XXX-XXX systemd[1]: session-16761.scope: Deactivated successfully.
Apr 8 18:11:24 ip-XXX-XXX-XXX-XXX systemd[1]: session-16761.scope: Consumed 4.077s CPU time.
Apr 8 18:11:34 ip-XXX-XXX-XXX-XXX systemd[1]: Stopping User Manager for UID 0...
Looks like we’re running a 4 GB swap file:
free -h
total used free shared buff/cache available
Mem: 7.8Gi 1.7Gi 274Mi 0.0Ki 5.8Gi 5.7Gi
Swap: 4.0Gi 278Mi 3.7Gi
This is a client’s AWS EC2 instance (t2.large). It seems clear that it’s just a little underpowered (although it’s been running well for many many months).
@jamesatdf thanks for the tips… every time I do this I get a little better at it.
@kduval thanks for confirming that OttoFMS isn’t the bad guy here.
