Odd server restart

[autogun]

Hello gurus,

I'd like to know of a way to check why was my server restarted, who or what caused this restart, was it power short-edge or caused interactively by user,

Running who -b outputs the following:

system boot  2010-04-27 04:03

Checking /var/log/messages that time all I see is:

...
Apr 27 03:13:15 localhost xinetd[8893]: EXIT: vnetd status=0 pid=17912 duration=0(sec)
Apr 27 03:13:15 localhost xinetd[8893]: EXIT: vnetd status=0 pid=17909 duration=0(sec)
Apr 27 03:13:28 localhost xinetd[8893]: START: vnetd pid=17951 from=172.22.0.5
Apr 27 03:13:28 localhost xinetd[8893]: START: vnetd pid=17952 from=172.22.0.5
Apr 27 03:13:28 localhost xinetd[8893]: EXIT: vnetd status=0 pid=17952 duration=0(sec)
Apr 27 03:13:28 localhost xinetd[8893]: EXIT: vnetd status=0 pid=17951 duration=0(sec)
Apr 27 04:04:07 localhost syslogd 1.4.1: restart.
Apr 27 04:04:07 localhost kernel: klogd 1.4.1, log source = /proc/kmsg started.
Apr 27 04:04:07 localhost kernel: Bootdata ok (command line is ro root=/dev/VolGroup01/LogVol00 rhgb quiet)
Apr 27 04:04:07 localhost kernel: Linux version 2.6.18-128.1.10.el5xen (mockbuild@builder10.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-44)) #1 SMP Thu May 7 11:07:18 EDT 2009
Apr 27 04:04:07 localhost kernel: BIOS-provided physical RAM map:
Apr 27 04:04:07 localhost kernel:  Xen: 0000000000000000 - 00000001df4aa000 (usable)
Apr 27 04:04:07 localhost kernel: DMI present.
Apr 27 04:04:08 localhost kernel: ACPI: LAPIC (acpi_id[0x01] lapic_id[0x00] enabled)
Apr 27 04:04:08 localhost kernel: ACPI: LAPIC (acpi_id[0x02] lapic_id[0x04] enabled)
Apr 27 04:04:08 localhost kernel: ACPI: LAPIC (acpi_id[0x03] lapic_id[0x01] enabled)
...

Please suggest how can I collect more info regarding this restart...

[falko]

Do you have munin installed? That might give you some info on what has happened.

[autogun]

Nope falko,
No munin

[autogun]

Anyone, please? :O

[falko]

I'd install munin then. That might help you to detect problems with your system resources that might cause a reboot.

[RogueCoder]

If you use user auditing/process auditing that could help you detect if a user is causing the reboot.