Ygtjki

For months my server has been going down every few weeks. I check logs in cPanel, I see that memory usage and CPU usage all normal till server goes down. There is no spike in resource usage prior to server going down. I have been trying to run server both with screen and without. On screen version is that every few weeks I just find dead screen.
I start server with forever, like this:

forever start -o backend_out4.log -e backend_err4.log -a index.js

After I see server has crashed, I open that log, see that last visit was to some url that doesn't exist. I restart the server, go to that url, nothing happens. Similar is to logs in cPanel. I open the logs, check when server first time responded with 503 code, check url that was logged before. Restart the server, visit that url, nothing happens.

when I run dmesg, few last lines are these:

[17595162.766140] LVE: [1555] cgrp_param_open: cgrp_param_lookup memory.swappiness failed with -2
[17595162.766143] LVE: [1555] cgrp_param_open_write_string: can't open memory.swappiness, rc=-2
[17595162.766145] LVE: [1555] os_resource_extra_init: failed to disable swapping, physmem can swap out
[17595162.775419] LVE: [1555] cgrp_param_open: cgrp_param_lookup memory.swappiness failed with -2
[17595162.775422] LVE: [1555] cgrp_param_open_write_string: can't open memory.swappiness, rc=-2
[17595162.775424] LVE: [1555] os_resource_extra_init: failed to disable swapping, physmem can swap out
[17595162.785352] LVE: [1555] cgrp_param_open: cgrp_param_lookup memory.swappiness failed with -2
[17595162.785356] LVE: [1555] cgrp_param_open_write_string: can't open memory.swappiness, rc=-2
[17595162.785358] LVE: [1555] os_resource_extra_init: failed to disable swapping, physmem can swap out
[17602219.243052] try_charge: task lsphp is about to be killed due to oom
[17602222.420140] try_charge: task lsphp is about to be killed due to oom
[17604779.812248] LVE: [1555] cgrp_param_open: cgrp_param_lookup memory.swappiness failed with -2
[17604779.816494] LVE: [1555] cgrp_param_open_write_string: can't open memory.swappiness, rc=-2
[17604779.820613] LVE: [1555] os_resource_extra_init: failed to disable swapping, physmem can swap out
[17621398.958802] TCP: request_sock_TCP: Possible SYN flooding on port 25. Sending cookies. Check SNMP counters.

If I google last line, I get results talking about DDoS attack. When I look from cPanel logs URL that have been requested, I see things like: /sql/myadmin/index.php?lang=en, /sql/webadmin/index.php?lang=en- These looks more like someone using some software to crawl some endpoints, hoping to find vulnerability. And if it was DDoS attack, shouldn't it spike in resource usage?

I am hosting at a2hosting.com, using nodejs-hosting package. Maybe the problem is in something that isn't installed by default in my server, but should be.

At this point, I am no longer even hoping direct answer, I am just looking for hint or tip, that might lead to solutions.