I hope someone can help me. This happened 4 days ago, twice a day, and today it happened again. I don't know the reason. I hope for a solution to that. As you can see, there are many ips that try to enter, and log disconnect. What does this also mean?
Your system is accessible from the whole internet, so it is to be expected that other people (or bots) are trying to login via SSH on the default port. It does not look like anyone succeeded, but I think most people here would recommend you put up some kind of barrier. Or maybe some did succeed to login as root and removed this information from the logs, we would not be able to tell.
It's not clear why the system rebooted but it was not gracefully and could have been something like a power interruption or hardware failure. If someoen initiated a reboot, you would see logs about shutting down services before restarting the system.