tracing mysterious rebooting on centos 5

[Brandon Joseph Adams <emidln@gmail.com>]

Hi

So I'm back doing linux stuff after a few years and I ran into a rather 
signficant hangup. The system I'm working on is a CentOS 5.4 machine 
keeps rebooting at semi-random intervals whenever the iptables rules 
change. I'm not currently sure if this is a fault in my iptables rules, a 
hardware problem, or the result of a rogue legacy script finding something 
amiss and rebooting. The solution I came up with is as follows (with auditd 
enabled):

auditctl -a entry,always -S reboot

My only concern is that there might be another way to reboot the system 
that isn't using reboot(2). init 6 seems to use reboot(2) and the userspace 
reboot command seems to use it as well. Is there another way (outside of 
magic sysrq) that the system might be rebooting via software?

Also, is there a better (maybe more obvious) way to be checking for this. 
The logs in /var/log aren't very helpful and last & friends just tell me that 
a reboot happened, not what caused it.

Thanks,
-- 
Brandon Joseph Adams
Email: emidln@gmail.com
Tel: +1 217-953-0257
GPG Key: 1024D/2F2EFCCF
Fingerprint = 2AEE AA3F B5C9 409D 2EE6  E38B CA06 8CDF 2F2E FCCF

This is a digitally signed message part.