You mentioned looking in /var/adm/messages, but did you
check the "archived" versions of that file? In
particular, look one version back, at:
/var/adm/messages.0
Someone else mentioned "syslog", but I don't think that
the default location is in /var/adm/syslog. It is
configured by "/etc/syslog.conf", and I *think* the
default location is:
/var/log/syslog
One other suggestion was that your machine was hijacked.
I don't know your configuration or exposure, but
depending on your circumstances, maybe it would make
sense to scan for non-standard checksum in your system
files.
In the environment where *I* work, sophisticated hackers
are *far* less common than run-of-the-mill human errors
(as in, "Oh, when I rebooted, I forgot that I was
rlogin'd to your machine!"). To quickly check for those
"innocent" situations, a couple of likely places to look
are:
/var/adm/sulog
to see if someone su'd to root just before the reboot, or
to look at the output of
last
to look for a remote login as root (the remote machine
might give you a clue as to who was the culprit).
Obviously, these logs can be tweaked by someone intent on
installing some kind of malware, but they're a quick way
of checking for inadvertent botches.