The number of user-list posts for each tool gives us an idea of its user base. (The actual number of posts is omitted as statistics for a single month could be misleading.)
Listing 4 contains a simple script using sed and awk to compress the output of ausearch down to only the non-duplicated (time omitted) executable and port number fields.