I have a raspberry pi 4 that runs a samba server (+ 2TB HDD) and it suddenly rebooted. I use a pretty big heatsink to keep the pi cool and I use the official raspberry pi power supply.
last reboot provides you a log of reboot events which were requested by software: either a command from a privileged user (e.g.
sudo reboot) or a script. Note: the reboot event corresponds to the end time, not the start time:
pi@raspberrypi: $ last reboot reboot system boot 5.4.79-v7l+ Thu Jan 1 01:00 still running reboot system boot 5.4.79-v7l+ Thu Jan 1 01:00 - 14:55 (18651+13:55) pi@raspberrypi: $ date -d "19700101 UTC +18651 days 13:55" Sun 24 Jan 2021 02:55:00 PM CET
Everything else is a hardware event which you can only definitely track down by monitoring voltage, temperature and reset pins externally.
That it rebooted implies one of two things:
The system was intentionally rebooted for some reason. If this is the case, the event would be logged; have a look back through
/var/log/syslogto when this happened. If instead you find the log stops and restarts abruptly, possibly with a short burst of garbage bytes in between, then there was no reboot and only the second option is possible.
The power was cycled. This could have been a momentary external interruption, or it could be because the SoC shut down due to insufficient power.
These are the only two things which can trigger a reboot -- it's either intentional or caused by the power cycling. If the OS just crashes for some reason, the system would simply shutdown and not spontaneously reboot.