[root@swaggserver-01 log]# grep 'by user' secure | grep 'sshd' | awk '{print $15}' | sed 's/\"//g' | sort | uniq -c | sort -rn
   7372 root
     17 ftp
      3 rpc
      3 daemon
      3 bin
      3 apache
      3
      2 tcpdump
      2 squid
      2 nobody
      2 mail
      2 games
      1 sync
      1 halt
      1 adm