[cobalt-security] Trying to determine why RAQ4R rebooted

["Todd Kirk" <tkirk@xxxxxxxxxxxxxx>]

Hi all,

Last night at 8.26pm my RAQ4R rebooted. My co locater says there was no
power outage or any reason from their end that a reboot would have been
caused. I did nothing to the server, I wasn't even logged in. All
services are running fine this morning and the only place I really
'know' to have a look is the last log -

reboot   system boot  2.2.16C32_III    Mon Jan 20 20:26          (14:03)

I have also run top, df -h, logged in, who, netstat, ps aux and looked
for weird files/directories. Chkrootkit-0.38 was all clean with a fresh
install also.

Could someone please help me track down why this reboot occurred? Is
there a specific log file or process I can take to track it down.

The system has only been OS restored 1 month ago and all patches are up
to date. I only run openwebmail, webalizer, interbase, mysql, 50 virtual
sites, 5 ASP db sites and three sites with Thawte SSL certs.

Any help or ideas greatly appreciated.


regards,
 
Todd Kirk