Mysql – How todentify the user who issued MySQL Shutdown command

auditlogMySQLshutdown

We have had several situations when our production MySQL server suddenly became unavailable. The error log just shows "Normal shutdown" followed by the typical shutdown messages. How can I determine the Linux or MySQL user account and host name of the connection issuing the shutdown command?

Best Answer

Check the secure log in the event it was run via a sudo service call

sudo grep mysql /var/log/secure

Check to see if there's any mysql related stuff going on in cronjobs

sudo grep mysql /var/log/cron

Check shell histories for mysqladmin calls

cd /home; for u in *: do; sudo grep mysql /home/$u/.bash_history; done

Check with people you know that either have sudo or mysql root access on this machine

"Hey, which one of you has been shutting down mysql?"