I'm have a mongodb installed in a droplet in digital ocean. I was talking with de digital ocean suport right now, but, apparently he cant help me with this.
Checking mongodb logs, i see this:
2017-01-13T12:00:30.396+0000 I COMMAND [conn29429] dropDatabase MYDBNAME starting 2017-01-13T12:00:30.398+0000 I COMMAND [conn29429] dropDatabase MYDBNAME finished
And is repeating everyday, apparently.
I have no idea what is the cause, i dont have any cronjobs or any deleting operation in my applications. Thanks for any help.
Your mongodb instance has been hacked, presumably because you've left it wide-open to the outside world.
There's a couple of articles here on the issue:
http://www.securityweek.com/multiple-attackers-hijacking-mongodb-databases-ransom
http://www.darknet.org.uk/2017/01/mongodb-ransack-33000-databases-hacked/z
You need to secure your mongodb instance
How is your database secured? It looks like you having security issues: http://www.securityweek.com/multiple-attackers-hijacking-mongodb-databases-ransom