zgrep -i "^oct 20" /var/log/syslog*|grep -iB 5 -A 5 'postfix\/pickup
/var/log/syslog.1.gz:Oct 20 01:55:01 elmo CROND[7682]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 02:00:01 elmo CROND[7701]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 02:00:02 elmo CROND[7704]: (root) CMD (/home/davider/scripts/backups/saintbk.sh full )
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo kernel:  CIFS VFS: Error 0xfffffffb on cifs_get_inode_info in lookup of \backups\automated
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo last message repeated 11 times
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/pickup[7339]: 585F8E607F: uid=0 from=<root>
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/cleanup[7716]: 585F8E607F: message-id=<20121020060003.585F8E607F@elmo.localdomain>
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/qmgr[3925]: 585F8E607F: from=<root@elmo.localdomain>, size=1723, nrcpt=1 (queue active)
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/local[7718]: 585F8E607F: to=<postfix@elmo.localdomain>, orig_to=<root>, relay=local, delay=0.32, delays=0.05/0.2/0/0.08, dsn=2.0.0, status=sent (delivered to mailbox)
/var/log/syslog.1.gz:Oct 20 02:00:03 elmo postfix/qmgr[3925]: 585F8E607F: removed
/var/log/syslog.1.gz:Oct 20 02:01:01 elmo CROND[7723]: (root) CMD (nice -n 19 run-parts --report /etc/cron.hourly)
--
/var/log/syslog.1.gz:Oct 20 03:55:01 elmo CROND[8208]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 04:00:01 elmo CROND[8227]: (mail) CMD (/usr/bin/python -S /usr/lib64/mailman/cron/gate_news)
/var/log/syslog.1.gz:Oct 20 04:00:01 elmo CROND[8230]: (root) CMD (/home/davider/scripts/backups/spacechk.sh)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo kernel:  CIFS VFS: Error 0xfffffffb on cifs_get_inode_info in lookup of \backups\automated
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo last message repeated 4 times
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/pickup[8202]: 0D62FE607F: uid=0 from=<root>
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/cleanup[8235]: 0D62FE607F: message-id=<20121020080002.0D62FE607F@elmo.localdomain>
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/qmgr[3925]: 0D62FE607F: from=<root@elmo.localdomain>, size=1018, nrcpt=1 (queue active)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/local[8237]: 0D62FE607F: to=<postfix@elmo.localdomain>, orig_to=<root>, relay=local, delay=0.09, delays=0.08/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
/var/log/syslog.1.gz:Oct 20 04:00:02 elmo postfix/qmgr[3925]: 0D62FE607F: removed
/var/log/syslog.1.gz:Oct 20 04:01:01 elmo CROND[8243]: (root) CMD (nice -n 19 run-parts --report /etc/cron.hourly)

Quote:

Originally Posted by metallica1973 Once the occurrence is found, I want to see 5 lines before and after.

grep -C 5 "search" file

gawk '{if(c-->0)print}{a[NR]=$0}/pattern/{for(i=NR-5;i<=NR;i++){print a[i]};c=5}' filename