Clean shutdown - but who made the shutdown?

[Michael Dosser]

Hi,

I have odd situation with one of our servers: it suddenly shut down to 
system halt. This is what makes think of that it was a shutdown:

Oct 30 18:21:23 xxxxx kernel: Stopping inetd.
Oct 30 18:21:23 xxxxx kernel: Shutting down daemon processes:
Oct 30 18:21:23 xxxxx ntpd[687]: kernel time sync enabled 6001
Oct 30 18:21:27 xxxxx kernel: .
Oct 30 18:21:33 xxxxx last message repeated 6 times
Oct 30 18:21:34 xxxxx kernel: daemon process stopped

And in fact, the machine was powered off, when I saw it at the 
datacenter. I powered it on and it came up with no filesystem checks. It 
was cleanly shut down.

We have accounting turned on, but lastcomm does not display any commands 
like shutdown, halt or init. I suspected that someone could have pressed 
the power button but I don't see any acpi events in the logs. There is a 
apcupsd running on that system, but there are no apcupsd.events logged 
and the battery is fully charged.

Can someone give me a hint, where else I could look at to find the 
culprit? What could be the cause to cleanly shutdown a system off 
without anything logged by process accounting?

Thanks,
Mic