title: AIX: using grep command to log two lines from a file
body: <p>Basically oracle audit entries stored as <code>.aud</code> files in my AIX system</p>
  
  <pre><code>/oracle/SBX/saptrace/audit/
  </code></pre>
  
  <p>The entries of these files looks something like this :</p>
  
  <pre><code>Tue Jul  2 08:41:53 2013 +02:00
  LENGTH : '159'
  ACTION :[6] 'COMMIT'
  DATABASE USER:[1] '/'
  PRIVILEGE :[6] 'SYSDBA'
  CLIENT USER:[6] 'orasbx'
  CLIENT TERMINAL:[5] 'pts/0'
  STATUS:[1] '0'
  DBID:[10] '1854349635'
  
  Tue Jul  2 08:41:53 2013 +02:00
  LENGTH : '159'
  ACTION :[6] 'COMMIT'
  DATABASE USER:[1] '/'
  PRIVILEGE :[6] 'SYSDBA'
  CLIENT USER:[6] 'orasbx'
  CLIENT TERMINAL:[5] 'pts/0'
  STATUS:[1] '0'
  DBID:[10] '1854349635'
  
  Tue Jul  2 08:42:16 2013 +02:00
  LENGTH : '222'
  ACTION :[68] 'update SAPPRD.USR02 set uflag=64 where BNAME='CANAS' and MANDT='000''
  DATABASE USER:[1] '/'
  PRIVILEGE :[6] 'SYSDBA'
  CLIENT USER:[6] 'orasbx'
  CLIENT TERMINAL:[5] 'pts/0'
  STATUS:[1] '0'
  DBID:[10] '1854349635'
  </code></pre>
  
  <p>Now i have schedule a shell script in crontab for it to run every three hours.</p>
  
  <p>Script is something like this:</p>
  
  <pre><code>#/bin/sh
  grep -i USR02 /oracle/SBX/saptrace/audit/*.aud &gt; /EDB/log/check_audit_dest.log
  grep -i USH02 /oracle/SBX/saptrace/audit/*.aud &gt;&gt; /EDB/log/check_audit_dest.log
  grep -i TCURR /oracle/SBX/saptrace/audit/*.aud &gt;&gt; /EDB/log/check_audit_dest.log
  grep -i REGUH /oracle/SBX/saptrace/audit/*.aud &gt;&gt; /EDB/log/check_audit_dest.log
  grep -i LFB1 /oracle/SBX/saptrace/audit/*.aud &gt;&gt; /EDB/log/check_audit_dest.log
  grep -i LFA1 /oracle/SBX/saptrace/audit/*.aud &gt;&gt; /EDB/log/check_audit_dest.logs
  </code></pre>
  
  <p>What this script does is if there is any operations these tables it log that line into  <code>/EDB/log/check_audit_dest.log</code></p>
  
  <p>Like this:</p>
  
  <pre><code># cat /EDB/log/check_audit_dest.log
  /oracle/SBX/saptrace/audit/sbx_ora_13828348_1.aud:ACTION :[68] 'update SAPPRD.USR02 set uflag=64 where BNAME='CANAS' and MANDT='000''
  /oracle/SBX/saptrace/audit/sbx_ora_8847374_1.aud:ACTION :[67] 'update SAPPRD.USR02 set uflag=0 where BNAME='CANAS' and MANDT='000''
  </code></pre>
  
  <p>Now what i want is apart from that line i also want first line of every entry to be log in that log file(for example:<code>Tue Jul  2 08:42:16 2013 +02:00</code>).</p>
  
  <p>Thank you</p>