Good day.
There is an Ubuntu instance on Aws. It runs an api service using systemd from the user. The session of the user and related services is periodically stopped.
Jun 25 15:31:49 systemd-networkd[581]: eth0: Configured
Jun 25 15:31:49 systemd-timesyncd[449]: Network configuration changed, trying to establish connection.
Jun 25 15:31:49 systemd-timesyncd[449]: Synchronized to time server 91.189.89.199:123 (ntp.ubuntu.com).
Jun 25 15:37:55 systemd[1]: Starting Cleanup of Temporary Directories...
Jun 25 15:37:55 systemd[1]: Started Cleanup of Temporary Directories.
Jun 25 15:54:07 snapd[29375]: storehelpers.go:438: cannot refresh snap "amazon-ssm-agent": snap has no updates available
Jun 25 15:54:12 systemd[1]: Reloading.
Jun 25 15:54:12 systemd[1]: Starting Daily apt download activities...
Jun 25 15:54:12 systemd[1]: Mounting Mount unit for core, revision 9436...
Jun 25 15:54:12 systemd[1]: Mounted Mount unit for core, revision 9436.
Jun 25 15:54:14 systemd[1]: Started Daily apt download activities.
Jun 25 15:54:14 kernel: [3718687.245500] audit: type=1400 audit(1593100454.191:59): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/snap/core/9436/usr/lib/snapd/snap-confine" pid=4420 comm="apparmor_parser"
Jun 25 15:54:14 kernel: [3718687.245865] audit: type=1400 audit(1593100454.191:60): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/snap/core/9436/usr/lib/snapd/snap-confine//mount-namespace-capture-helper" pid=4420 comm="apparmor_parser"
Jun 25 15:54:14 kernel: [3718687.380157] audit: type=1400 audit(1593100454.323:61): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.core.hook.configure" pid=4466 comm="apparmor_parser"
Jun 25 15:54:14 kernel: [3718687.387060] audit: type=1400 audit(1593100454.331:62): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.core" pid=4469 comm="apparmor_parser"
Jun 25 15:54:14 snapd[29375]: daemon.go:542: gracefully waiting for running hooks
Jun 25 15:54:14 snapd[29375]: daemon.go:544: done waiting for running hooks
Jun 25 15:54:14 systemd[1]: snapd.service: Service hold-off time over, scheduling restart.
Jun 25 15:54:14 systemd[1]: snapd.service: Scheduled restart job, restart counter is at 4.
Jun 25 15:54:14 systemd[1]: Stopped Snappy daemon.
Jun 25 15:54:14 systemd[1]: Starting Snappy daemon...
Jun 25 15:54:15 snapd[4483]: AppArmor status: apparmor is enabled and all features are available
Jun 25 15:54:15 snapd[4483]: AppArmor status: apparmor is enabled and all features are available
Jun 25 15:54:15 snapd[4483]: patch.go:64: Patching system state level 6 to sublevel 1...
Jun 25 15:54:15 snapd[4483]: patch.go:64: Patching system state level 6 to sublevel 2...
Jun 25 15:54:15 snapd[4483]: patch.go:64: Patching system state level 6 to sublevel 3...
Jun 25 15:54:15 snapd[4483]: daemon.go:343: started snapd/2.45.1 (series 16; classic) ubuntu/18.04 (amd64) linux/4.15.0-1065-aws.
Jun 25 15:54:15 snapd[4483]: daemon.go:436: adjusting startup timeout by 40s (pessimistic estimate of 30s plus 5s per snap)
Jun 25 15:54:16 kernel: [3718689.181896] audit: type=1400 audit(1593100456.127:63): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/snap/core/9436/usr/lib/snapd/snap-confine" pid=4553 comm="apparmor_parser"
Jun 25 15:54:16 kernel: [3718689.182052] audit: type=1400 audit(1593100456.127:64): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/snap/core/9436/usr/lib/snapd/snap-confine//mount-namespace-capture-helper" pid=4553 comm="apparmor_parser"
Jun 25 15:54:16 kernel: [3718689.212835] audit: type=1400 audit(1593100456.159:65): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap-update-ns.amazon-ssm-agent" pid=4555 comm="apparmor_parser"
Jun 25 15:54:16 kernel: [3718689.222505] audit: type=1400 audit(1593100456.167:66): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap-update-ns.core" pid=4556 comm="apparmor_parser"
Jun 25 15:54:16 kernel: [3718689.300833] audit: type=1400 audit(1593100456.247:67): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.core.hook.configure" pid=4557 comm="apparmor_parser"
Jun 25 15:54:16 kernel: [3718689.305021] audit: type=1400 audit(1593100456.251:68): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.amazon-ssm-agent.amazon-ssm-agent" pid=4559 comm="apparmor_parser"
Jun 25 15:54:16 systemd[1]: Started Snappy daemon.
Jun 25 15:54:17 systemd[1]: Reloading.
Jun 25 15:54:18 snapd[4483]: storehelpers.go:438: cannot refresh snap "core": snap has no updates available
Jun 25 16:01:48 systemd-networkd[581]: eth0: Configured
Jun 25 16:01:48 systemd-timesyncd[449]: Network configuration changed, trying to establish connection.
Jun 25 16:01:48 systemd-timesyncd[449]: Synchronized to time server 91.189.89.199:123 (ntp.ubuntu.com).
Jun 25 16:12:11 systemd[1]: Stopping User Manager for UID 1000...
Jun 25 16:12:11 systemd[18795]: Stopped target Default.
Jun 25 16:12:11 systemd[18795]: Stopping API_SERVICE...
Jun 25 16:12:11 systemd[18795]: Stopped API_SERVICE.
Jun 25 16:12:11 systemd[18795]: Stopped target Basic System.
Jun 25 16:12:11 systemd[18795]: Stopped target Sockets.
Jun 25 16:12:11 systemd[18795]: Closed GnuPG cryptographic agent and passphrase cache.
Jun 25 16:12:11 systemd[18795]: Closed REST API socket for snapd user session agent.
Jun 25 16:12:11 systemd[18795]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Jun 25 16:12:11 systemd[18795]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Jun 25 16:12:11 systemd[18795]: Closed GnuPG network certificate management daemon.
Jun 25 16:12:11 systemd[18795]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Jun 25 16:12:11 systemd[18795]: Stopped target Timers.
Jun 25 16:12:11 systemd[18795]: Stopped target Paths.
Jun 25 16:12:11 systemd[18795]: Reached target Shutdown.
Jun 25 16:12:11 systemd[18795]: Starting Exit the Session...
Jun 25 16:12:11 systemd[18795]: Received SIGRTMIN+24 from PID 5414 (kill).
Jun 25 16:12:11 systemd[1]: Stopped User Manager for UID 1000.
Jun 25 16:12:11 systemd[1]: Removed slice User Slice of API_USER.
Jun 25 16:17:01 CRON[5416]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Jun 25 16:31:49 systemd-timesyncd[449]: Network configuration changed, trying to establish connection.
Jun 25 16:31:49 systemd-networkd[581]: eth0: Configured
Jun 25 16:31:49 systemd-timesyncd[449]: Synchronized to time server 91.189.89.199:123 (ntp.ubuntu.com).
After that, the user session does not start. But if you try to make a request for the api of this service, then the user session and the service are launched.
Jun 26 11:31:28 systemd-networkd[581]: eth0: Configured
Jun 26 11:31:28 systemd-timesyncd[449]: Network configuration changed, trying to establish connection.
Jun 26 11:31:28 systemd-timesyncd[449]: Synchronized to time server 91.189.89.199:123 (ntp.ubuntu.com).
Jun 26 11:32:37 systemd[1]: Created slice User Slice of API_USER.
Jun 26 11:32:37 systemd[1]: Starting User Manager for UID 1000...
Jun 26 11:32:37 systemd[1]: Started Session 1208 of user API_USER.
Jun 26 11:32:37 systemd[6860]: /home/API_USER/.config/systemd/user/API_SERVICE.service:8: Failed to parse service type, ignoring: Simple
Jun 26 11:32:37 systemd[6860]: Listening on GnuPG network certificate management daemon.
Jun 26 11:32:37 systemd[6860]: Listening on REST API socket for snapd user session agent.
Jun 26 11:32:37 systemd[6860]: Reached target Timers.
Jun 26 11:32:37 systemd[6860]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Jun 26 11:32:37 systemd[6860]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Jun 26 11:32:37 systemd[6860]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Jun 26 11:32:37 systemd[6860]: Listening on GnuPG cryptographic agent and passphrase cache.
Jun 26 11:32:37 systemd[6860]: Reached target Sockets.
Jun 26 11:32:37 systemd[6860]: Reached target Paths.
Jun 26 11:32:37 systemd[6860]: Reached target Basic System.
Jun 26 11:32:37 systemd[1]: Started User Manager for UID 1000.
Jun 26 11:32:37 systemd[6860]: Started API_SERVICE.
Jun 26 11:32:37 systemd[6860]: Reached target Default.
Jun 26 11:32:37 systemd[6860]: Startup finished in 53ms.
Jun 26 11:32:38 API_SERVICE[6873]: API_SERVICE_LOG
loginctl enable-linger USER_NAME
Well. As it turned out, the service worked while the user session was working, which was supported by an active ssh connection. When I disconnected this connection, the user session was closed and, accordingly, all services from this user. When there was a request for a non-working service, the request ended with an error, to which I received a notification, after which I connected through the ssh to the server, due to which the user session was raised and the services associated with it were raised. Therefore, everything looked as described in the question.
When I began to compare how I configured services on other servers where there is no such problem, I found that in this case I missed the execution of the command indicated above. After completing it, the user session does not end after disconnecting the ssh connection.