系统日志过滤脚本请教

weixiaoke

日志内容如下：
Mar  6 18:49:14 file smbd[31009]:   Oplock break failed for file A\u5218\u5174/\u5173\u4e8e\u7948\u798f\u516c\u53f8\u5e94\u653f\u5e9c\u8981\u6c42\u4fee\u5efa\u5e02\u653f\u5de5\u7a0b\u7684\u60c5\u51b5\u8bf4\u660e20170306-tlx.doc -- replying anyway
Mar  6 18:56:58 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
Mar  6 18:57:35 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
Mar  6 18:57:41 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
Mar  6 18:57:45 file iscsid: connect to 10.0.0.20:3260 failed (Connection refused)
Mar  6 18:57:49 file iscsid: connect to 10.0.0.20:3260 failed (Connection refused)
Mar  6 19:07:30 file smbd[31717]:   Oplock break failed for file \u6211\u7684\u6587\u6863/\u756a\u79ba\u79df\u52a1\u90e8/\u516c\u53f8\u5c4b\u8d44\u6599\uff08\u5408\u7ea6\uff09/2017-2-25\u516c\u5bd3\u65b0\u5408\u540c\uff08\u8d26\u53f7\uff09/\u4e0d\u80fd\u53c2\u800320170226\uff083C31\uff09\u516c\u5bd3\u79df\u8d41\u65b0\u5408\u540c\uff08\u8d26\u53f7\uff09\u5149.doc -- replying anyway
Mar  6 21:26:44 file rsyncd[32734]: name lookup failed for 192.168.110.251: Temporary failure in name resolution
Mar  7 06:38:43 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
Mar  7 06:39:19 file iscsid: connect to 10.0.0.20:3260 failed (Connection refused)
Mar  7 06:39:23 file iscsid: connect to 10.0.0.20:3260 failed (Connection refused)


我的要求如下：
1、将当前时间前一天的日志按关键字(failed和rsync)过滤出来，不显示重复的记录（时间不同报错相同也只显示一条）
2、被过滤出来的每条记录跟据关键字在该记录下面增加一条说明
如：Mar  6 18:56:58 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
这条有关键字：file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
则在下面添加一行说明：存储错误，不能连接，请立即解决！

谢谢各位大神帮助！

weixiaoke

请高手出招帮帮我

jason680

回复 1# weixiaoke

$ awk '/failed|rsync/{s=$0;$1=$2=$3="";if(!a[$0]++)print s"\n存储错误，不能连接 ，请立即解决！"}' FILE
Mar  6 18:49:14 file smbd[31009]:   Oplock break failed for file A\u5218\u5174/\u5173\u4e8e\u7948\u798f\u516c\u53f8\u5e94\u653f\u5e9c\u8981\u6c42\u4fee\u5efa\u5e02\u653f\u5de5\u7a0b\u7684\u60c5\u51b5\u8bf4\u660e20170306-tlx.doc -- replying anyway
存储错误，不能连接，请立即解决！
Mar  6 18:56:58 file iscsid: connect to 10.0.0.20:3260 failed (No route to host)
存储错误，不能连接，请立即解决！
Mar  6 18:57:45 file iscsid: connect to 10.0.0.20:3260 failed (Connection refused)
存储错误，不能连接，请立即解决！
Mar  6 19:07:30 file smbd[31717]:   Oplock break failed for file \u6211\u7684\u6587\u6863/\u756a\u79ba\u79df\u52a1\u90e8/\u516c\u53f8\u5c4b\u8d44\u6599\uff08\u5408\u7ea6\uff09/2017-2-25\u516c\u5bd3\u65b0\u5408\u540c\uff08\u8d26\u53f7\uff09/\u4e0d\u80fd\u53c2\u800320170226\uff083C31\uff09\u516c\u5bd3\u79df\u8d41\u65b0\u5408\u540c\uff08\u8d26\u53f7\uff09\u5149.doc -- replying anyway
存储错误，不能连接，请立即解决！
Mar  6 21:26:44 file rsyncd[32734]: name lookup failed for 192.168.110.251: Temporary failure in name resolution
存储错误，不能连接，请立即解决！

weixiaoke

谢谢！
“当前时间前一天”的日志这个条件如何配匹啊？