This afternoon I noticed that a manually started service is no longer running on my EC2 instance (standard Ubuntu 9.04 image). When I logged in via SSH I got warning that rsa fingerprint of the host has changed. Uptime was 7 hours and from /var/log/messages I could see that the VM had rebooted this morning. Looked at the dates of files in /etc/ssh, they were all last modified this morning too.
I'm not very familiar with EC2 instances so wanted to ask -- is this behavior normal, what could cause it? Some automatic security updates maybe?