Command to find users attacking a file in linux

 cat auth.log | grep "input_usr_auth_request" | awk '{print $9}' | sort -u > users.txt