grep "session opened for user" /var/log/auth.log | awk '{print $11}' | sort | uniq -c