Hi folks,

New to the forum

Is it possible to tell how a server rebooted? I mean, I don't see any users specifically typing in the reboot command but the server somehow got rebooted. I have captured the below logs. Ideally I would like to know if the system rebooted on its own or a user inputed something or hit ctrl-alt-delete. Any help would be appreciated! Thanks!

[7] [07057] [ts/0] [root ] [pts/0 ] [67.310.13.21 ] [67.310.13.21 ] [Wed Feb 22 12:05:45 2012 AST]
[7] [08861] [ts/0] [root ] [pts/0 ] [67.310.13.21 ] [67.310.13.21 ] [Wed Feb 22 12:07:43 2012 AST]
[5] [23413] [ca ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:31 2012 AST]
[1] [13110] [~~ ] [runlevel] [~ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:32 2012 AST]
[8] [07294] [1 ] [ ] [tty1 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [07295] [2 ] [ ] [tty2 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [07296] [3 ] [ ] [tty3 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [07298] [4 ] [ ] [tty4 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [07299] [5 ] [ ] [tty5 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [07301] [6 ] [ ] [tty6 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [23413] [ca ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [1 ] [ ] [tty1 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [2 ] [ ] [tty2 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [3 ] [ ] [tty3 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [4 ] [ ] [tty4 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [5 ] [ ] [tty5 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[8] [00000] [6 ] [ ] [tty6 ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[5] [23766] [l6 ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:37 2012 AST]
[1] [00000] [~~ ] [shutdown] [~~ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:27:54 2012 AST]
[2] [00000] [~~ ] [reboot ] [~ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:41:40 2012 AST]
[8] [02311] [si ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:41:40 2012 AST]
[1] [20019] [~~ ] [runlevel] [~ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:41:40 2012 AST]
[5] [05181] [l3 ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:41:40 2012 AST]
[8] [05181] [l3 ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:42:24 2012 AST]
[5] [07263] [1 ] [ ] [ ] [2.6.16.60-0.21-smp ] [0.0.0.0 ] [Wed Feb 22 12:42:24 2012 AST]

root pts/1 47.30.15.131 Wed Feb 22 12:45 - 14:46 (02:01)
root pts/0 192.168.100.127 Wed Feb 22 12:43 - 13:41 (00:57)
root tty1 Wed Feb 22 12:42 still logged in
reboot system boot 2.6.16.60-0.21-s Wed Feb 22 12:41 (1+08:23)
root pts/0 47.30.15.131 Wed Feb 22 12:07 - down (00:19)
root pts/0 47.30.15.131 Wed Feb 22 12:05 - 12:07 (00:01)
ads pts/1 47.150.64.181 Wed Feb 22 11:46 - 11:48 (00:02)


Feb 22 12:27:49 server01 kernel: Kernel log daemon terminating.
Feb 22 12:27:49 server01 kernel: Kernel logging (proc) stopped.
Feb 22 12:27:45 server01 named[6947]: exiting
Feb 22 12:27:45 server01 named[6947]: no longer listening on 162.12.22.38#53
Feb 22 12:27:45 server01 named[6947]: no longer listening on 192.168.165.93#53
Feb 22 12:27:45 server01 named[6947]: no longer listening on 67.30.11.132#53
Feb 22 12:27:45 server01 named[6947]: no longer listening on 127.0.0.1#53
Feb 22 12:27:45 server01 named[6947]: stopping command channel on 127.0.0.1#953
Feb 22 12:27:45 server01 named[6947]: shutting down: flushing changes
Feb 22 12:27:37 server01 sshd[6904]: Received signal 15; terminating.
Feb 22 12:27:32 server01 init: Switching to runlevel: 6
Feb 22 12:27:31 server01 shutdown[23413]: shutting down for system reboot