Internet enabled Ubuntu 18.04 Server Reboots

does auth.log show anyone logging in at the time?
Do they always reboot at the same time? At the same time as each other?
Do you use Puppet/Chef etc?
Did you check all user crontab's to see if a reboot was scheduled there?

Hi Andrew,
Thanks for revert.

does auth.log show anyone logging in at the time?
No .
Do they always reboot at the same time? At the same time as each other?
No random time.This is only with internet enabled servers. All other server which don't have internet they r not reboting.
Do you use Puppet/Chef etc?
No
Did you check all user crontab's to see if a reboot was scheduled there?
No crontab for reboot.

So I'm guessing you checked on each box with something like:

for i in `cat /etc/passwd | cut -d":" -f 1`
do
sudo crontab -l -u $i
done

Right? Checks every user's crontab on a server....

Yes we checked all crontab. Nothing except my AV scan.
All servers are based on same template this issue is only with servers whom i have enabled internet access.

Ahh are they VMs? If so check scheduled jobs in VSphere

Yes But i have more than 40 odd Ubuntu VM's and only this 6 to8 vm's are getting rebooted.
And common thread with them is the all are connected to internet.

Are they on the same host? Did you check the scheduled tasks of the VM in vsphere?

They are on different host. No schedule task for VM in my vSphere scheduler.

Anything in the system log files at the time of the shutdown (or shortly before), or are the log files abruptly ending?

What we can see there are some system crom runs.

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
### ENSL SCHEDULED TASK INFORMATION FOLLOWS. DO NOT EDIT THIS SECTION. ###
15 00 * * * root /opt/isec/ens/threatprevention/bin/isecav --runtask --uuid "33313ed8-8688-4de7-b12b-8b1be7e46fcf"
### END OF ENSL SCHEDULED TASK INFORMATION. ###

OK check taskel.

Can you pls explain what is taskel