Thanks for the hints. Since looking into the issue we have log-level=debug as well as some custom monitoring on all machines and try to catch one that fails "in-the-act". There is no pattern to the machines failing, desktops of different hardware, a server. We now have a machine on 13.2 with the same symptoms. One thing that is common to all machines is a custom service running that has an underscore in it's name. CoreOS had a bug, but that's code that is as far as I understand is not present in openSuSE (https://github.com/coreos/fleet/issues/579)