In this sort of environment you want to look at your pam logs (/var/log/auth.log on debian-like distros, and iirc, /var/log/secure on RH-like). This gives you not only a list of what was run, but who ran it and when.
Shame for me ...
http://imgur.com/CBTrdJw [server linux box] http://imgur.com/tEjBtNY [development os x box]
I'm pretty sure there is also a whole bunch of other (less famous) commands that would and should be added.
I've seen inexperienced sysadmins remotely rebooting a server only to discover that it won't boot up anymore because the original problem was that the server had run out of disk space.
Same idea for services restart; don't do it unless absolutely needed. While it may be doing the trick in some cases it can also generate its own set of new false symptoms.
Take the example of :
- mysql is "slow"
- let's restart ! ...
- mysql init script has been puking dots (.) for the last 30 minutes on shutdown
- let's kill -9 it ! ...
- mysql db is corrupted ! Hurray!