How to Identify the user who issued MySQL Shutdown command We have had several situations when our production MySQL server suddenly became unavailable.  The error log just shows "Normal shutdown" followed by the typical shutdown messages.  How can I determine the Linux or MySQL user account and host name of the connection issuing the shutdown command?
Check the secure log in the event it was run via a sudo service call

sudo grep mysql /var/log/secure


Check to see if there's any mysql related stuff going on in cronjobs

sudo grep mysql /var/log/cron


Check shell histories for mysqladmin calls

cd /home; for u in *: do; sudo grep mysql /home/$u/.bash_history; done

Check with people you know that either have sudo or mysql root access on this machine

"Hey, which one of you has been shutting down mysql?"