Sugestions for debugging samba close on headless server

So for the PMS integration I have samba running on headless server to run background scripts to sync with PMS without interfering with tills.
I had noticed random closes before but definitely seem to be more frequent than before.
Used to rdp in and find samba frozen washed out with the windows close program prompt. However it now just closes… no crash popup or windows popup. Just closed.
Any suggestions on how to debug the cause.

Anything in the logs?

BTW we have better api tools for interaction with API systems. We can push and update via jscript web helpers now. I know you dont want to redo it now but might be worth a look some day.

How would they be initiated?
It currently uses a trigger to run jscripts.
Triggers making the need for instance of samba not logged in to catch all triggers for background syncs.
I have manual buttons for a push on client tills and rod also runs a sync.
Main things the routine sync is for is booking data and to keep ‘over the bar sales’ more current than just pushing all at wp close.
And did this way to prevent any hangs on bar tills when scripts run and also allows tills to continue if say internet went down where a payment/close sync on tills would cause issues.
Triggers check response and update a timestamp for a synced up to time. So internet outage etc prevents stamp update so all will be synced once back online etc.
It’s not detrimental to the system.
I was more curious as to sambas un notified close.
Will check logs but sure I looked before and nothing in samba log.
Not so familiar with windows logs, what section would be most relevant in there.

Samba logs dont show anything unexpected, few printer name errors but older than last few closes.

They have also reported occasions of slowdown.
Thought I would try and find something in windows logs.

Few things I wanted to ask about…

Looks like there are regular half hourly ‘Starting up database’ events. Although they seem to be for unused databased which guessing may be the reason since they are not kept active through use;

Next I can see a few warings in logs relating to ‘profile notification events’ for load/unload… Not sure if these are relevent or important;

A few DistributedCOM errors, no idea what these relate to;