How to find user

You also get more info in below

When the system logs an authentication message in the /var/log/secure file, the message can contain the following types of information: The connecting user's ID The IP address or host name of the user's interface The time of each login attempt Successful login attempts for command line interface sessions only Failed login attempts for command line interface, BIG-IP Configuration utility, and iControl sessions The time of the logout for command line interface sessions only