Checked logs you suggested. In messages nothing interesting.
Quote:
Aug 4 06:25:07 yyyy rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="1954" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Aug 4 16:22:11 yyyy kernel: imklog 4.2.0, log source = /proc/kmsg started.
Last time server went down around 15:55.
However syslog is a bit more interesting:
Quote:
Aug 4 15:17:01 yyyy CRON[21025]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
ug 4 16:22:11 yyyy kernel: imklog 4.2.0, log source = /proc/kmsg started.
Interesting part is '^@' . If i open file with some regular editor (like Notepad2) i get 'null' there. If i open in gVIM i get bunch of '^@' characters. So something bad was there, but I gues no way to find out what exactly.