Finding how the machine was rebooted

[Hari Bhaskaran]

Hi,

I am trying to trouble shoot a problem where one of the machines
got rebooted. I can see "last" shows a shutdown was done. How
do I know if it was a Cntrl-Alt-Del done from the console or
if it was a shutdown command executed via a ssh/remote login?
I would also like to know if it was some panic/bug etc also.

Also I have a dmesg.today that is couple of days older than
/var/run/dmesg.boot. How is that possible? Doesn't dmesg.today
mean the the dmesg of the last (current) boot?

BTW, /var/ is running on a vinum-ed partition (if that would 
help) 

Any help is appreciated.
Thanks for your time.
--
Hari Bhaskaran