MySQL Normal Shutdown

Does anyone know of a good way to capture who shutdown a MySQL server? I have a few servers that keep shutting down with a normal shutdown. Initially, I thought it was a bug, but Oracle is pretty adamant that it is not. Plus, I did look at the MySQL source code and the logic is pretty straight forward. it looks like someone has to issue a normal shutdown for the error log to produce that error. However, I have been unable to find the culprit. None of the logs are capturing anything… I’ve looked at messages, the audit log, mysql, last and nothing.

As of today, I have enabled the general log and have taken tcpdumps. Yet, I still have been unable to capture anything. Any advice would be appreciated.

How many people have access to your box?

At system level you need to restrict people from logging in to your system and enable system logging. For linux enable and configure sudo
disable direct root login.