detecting what does a reboot

[ik]

Hello

I have a server (old centos 5) that does sometimes few times a reboot, in
random hours.
I removed non root permissions to execute halt, reboot and shutdown, but I
wish also to try and track down what causing that reboot.

Is there a way to audit-trail or just log any kind of rebooting request
(including system calls), and finding out what or whom execute it ?

Thanks,

Ido
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.cs.huji.ac.il/pipermail/linux-il/attachments/20140608/a320ff11/attachment-0001.html>