use strict;
use warnings;

my %users;
my %conn;

while (<DATA>) { # I use DATA handle instead of $fh for convenience
  if( /BIND/ ) {
    my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
    $conn{$conn} = $uid;
  }
  if( /SRCH=Q/ ) {
    my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
    my $uid = $conn{$conn}; 
    ++$users{$uid};
  }
}

for my $uid (keys %users) {
  my $count = $users{$uid};
  print "\t=> Bad user $uid ! count = $count\n" if  $count>3;
}