Find what countries your users are logging into your server from. Tested on SLES only and needs geoip-lookup to be installed on your server.

gistfile1.sh

#!/bin/bash
grep "Accepted .* for " /var/log/messages | awk '{print $9, $11}' | egrep -v "nagios|bb|172\.|10\.|192\.168\."  | sort | uniq | while read u
do
  AUSER=`echo $u | awk '{print $1}'`
  AIP=`echo $u | awk '{print $2}'`
  COUNTRY=`geoip-lookup $AIP`
  #echo $AUSER $COUNTRY $AIP
  echo $AUSER $COUNTRY
done | sort  | uniq -c | sort -n