I have 2 very old Linux servers (1 running RHEL ES release 2.1 and the other FC release 3 - both severely under patched [sorry]) that spontaneously rebooted at exactly [to the second] the same time last Thursday. This happened again yesterday [Tuesday] 5 times! I have lots of Windows & Solaris servers on the same power supply that were not affected - I only have these two Linux servers.
Things I've considered :- There are no hardware issues reported on either server. Only one of them is running the client software needed by the UPS management system [which logs show no recent actions]. There is no local or remote cron/at job also the reboots are at random [AFAIK] times. "last -x" shows nothing [IMHO] useful, which is the same for messages, syslog, secure logs.
I'm currently thinking malicious activity exploiting some [un-patched] Linux vulnerability [more than likely] being called remotely and possibly using some level of broadcast to trip vulnerable nodes - but I am paranoid :)
Its only happening during the day so I'm thinking the source maybe a users workstation [all windows] that is only on during work hours.
My questions are :- 1. Is my paranoid theory viable? 2. How could I trap the source of the reboots?