Diagnosing cause of reboots

[Luke Maurits <luke%maurits.id.au@localhost>]

Hi all,

I have a low-traffic web and mail server running 5.1.2 which has
recently aquired a nasty habit of rebooting every 10 days or so.  I
think this has happened 3 times now.  If I run last(1) after one of
these incidents I can see a line like:

reboot    ~                         Sat Jul 21 01:45

so I assume this is not happening due to something like a power outage,
hardware failure, kernel panic or anything like that (since in this
case the system wouldn't update the wtmp file).  I've also asked my VPS
provider shortly after one of the reboots if anything happened at their
end and they couldn't give me a reason for why the server may have
rebooted. last(1) clearly shows that nobody is logged in at the time of
the reboot (and I'm the only person with shell access and I *know* I'm
not doing it), so I assume the reboot command is, for some reason, being
called by a daemon or a cron job or something like that, one with root
priveleges.  I've poked through the logs and nothing seems to show up
around the time of the reboots, except various services shutting down
and starting back up.

If a program calls reboot, does NetBSD log which program did it
somewhere?  Can init or the kernel reboot the system, and if so is that
logged somewhere?  What are some common situations in which they might
do so?  Is there anything else I should know that might help me in
diagnosing what's going on here?

Many thanks,
Luke