I am seeing this on an MGCP controlled Fractional T-1. the shutdown command will re-appear upon reboot. Router is a 2811 with an NM, IOS is advipservices 12.4(3d) and the card in question is a vwic-2mft-t1. interesting. Of course, there are the fractional T-1 caveats, but I don't think that's my cause.
These are the paths to get to each CCX logs through CLI. They may be helpful if you are having issues accessing RTMT or downloading logs through it.
If you want to download them you have to prefix "file get " and you can add one of the options (re...