> This looks like a normal shutdown command was issued from somewhere, > IMO. I would check the other log files under /var/log and its sub- > directories for entries around this time. Especially secure.log*. Also, > I don't know your configuration, but is there a cron or at entry that > has a scheduled reboot? > > also check last log to see who was logged in