Without more information on what version you are using I'll have to assume you are using VMWare Infrastructure 3.x. and that it happens at around the same time every day. With this version you can schedule events to take place. In the VMWare infrastructure client go to Scheduled tasks and check to see if anything is scheduled for this host. Have you checked the VM logs to see if anything untoward is being applied to the VM? if nothing on the VM logs check the ESX system log files first to see if they show anything, usually gobledygook to be honest but can muscle through, also try the actualweb server logs themselves, is it a clean shutdown or a powerdown, if ESX is controlling this shutdown it will be a probably be a sharp powerdown however if it is clean when closing down look at the vm and what it is doing, has or could it be compromised?

Without more information on what version you are using I'll have to assume you are using VMWare Infrastructure 3.x. and that it happens at around the same time every day. With this version you can schedule events to take place. In the VMWare infrastructure client go to Scheduled tasks and check to see if anything is scheduled for this host. Have you checked the VM logs to see if anything untoward is being applied to the VM? if nothing on the VM logs check the ESX system log files first to see if they show anything, usually gobledygook to be honest but can muscle through, also try the actualweb server logs themselves, is it a clean shutdown or a powerdown, if ESX is controlling this shutdown it will be a probably be a sharp powerdown however if it is clean when closing down look at the vm and what it is doing, has or could it be compromised?