Listing 1. Parsing the Logs for Successful Logins

cat secure* | grep Accepted | awk -F' ' '\
{print $1" "$2" "$9}' | uniq -u
Aug 30 juser
Aug 22 kuser
Aug 23 user
Aug 15 foo

1b.
Aug 24 13:23:19 foohost sshd[16348]: Accepted
password for phil from 127.0.0.1 port 47338 ssh2
Aug 24 13:23:25 foohost sshd[16398]: User root
not allowed because not listed in AllowUsers