Track the signal or command to reboot the linux system

My centos7.2 system with KVM suites installed on dell r730 reboot randomly in a few days. I also checked the logs and commands list executed by the system users, but nothing to find.

So I wanna track the signal or command to reboot the system, how can I do this ? Any other ideas help to troubleshoot this could be appreciated!

I've already known that the account with root privilegs or acpi script can cause the rebooting, but I didn't find anything helpful.

Thank you for the help.

 uname -a

Linux ip-10-0-2-20 3.10.0-327.36.1.el7.x86_64 #1 SMP Sun Sep 18 13:04:29 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

last reboot

reboot system boot 3.10.0-327.36.1. Thu Sep 20 14:09 - 03:26 (13:16)
reboot system boot 3.10.0-327.36.1. Tue Sep 18 17:30 - 03:26 (2+09:55)