Hi Mark,
There is nothing in the os/puppet logs which can indicate an
intervention. The server (or rather the VM) was up all the time.
We have a haproxy in front of the cluster, but in the access log again
there is nothing suspicious.
Probably this will stay unsolved, since it was one time event I do not
want to over do it...
Thanks, Igor