#!/usr/bin/perl -w
use strict;
use Data::Dumper::Simple;

my %users;

while (<DATA>) {
    next unless /Login succeeded/;
    chomp;
    if (/User: ([\w]+),/) {
        $users{$1}++;
    }

}

print Dumper(%users);

__DATA__
00:00000:00014:2005/11/30 10:01:23.77 server  Configuration file '/opt/sybase/SERVER1.cfg' has been written and the previous version has been renamed to '/opt/sybase/SERVER1.030'.
00:00000:00014:2005/11/30 10:01:23.80 server  The configuration option 'log audit logon success' has been changed by 'sa' from '0' to '1'.
00:00000:00015:2005/11/30 10:01:37.36 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00016:2005/11/30 10:10:50.91 Logon  Login succeeded. User: xyz, Client IP address: '169.123.26.124'.
00:00000:00017:2005/11/30 16:31:31.02 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00020:2005/11/30 16:51:11.90 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00021:2005/12/01 09:49:23.44 Logon  Login succeeded. User: abc, Client IP address: '169.123.26.124'.
00:00000:00022:2005/12/01 09:49:23.90 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00023:2005/12/01 09:51:29.65 kernel  Cannot read, host process disconnected: SERVER1  spid:23
00:00000:00025:2005/12/01 09:52:27.74 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00026:2005/12/01 09:55:24.06 Logon  Login succeeded. User: qwr, Client IP address: '169.123.26.124'.
00:00000:00027:2005/12/01 09:55:47.15 Logon  Login succeeded. User: sa, Client IP address: '169.123.26.124'.
00:00000:00026:2005/12/01 10:02:25.95 server  Configuration file '/opt/sybase/SERVER1.cfg' has been written and the previous version has been renamed to '/opt/sybase/SERVER1.031'.