Assume that my aa system log. The log often have this error message,

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
Error: & gt; 11 16:16:37 Sat Apr, 406 & lt; RfcException:
Message: Connect to SAP failed
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

My goal is to appear this kind of information, the latter part of the log file visit error messages (latest) redirected to a new file (the E-mail to the administrator is prompt, easy)
Error: & gt; * * * * * * Date * * * * * *, 406 & lt; RfcException:

# date
The Sat Apr 11 16:18:16 CST 2020

My approach is to write a regular monitoring script, assume that every 5 minutes to monitor,

Root# grep Error aa. The log | tail - 4
Error: & gt; 11 16:11:35 Sat Apr, 714 & lt; RfcException:
Error: & gt; 11 16:13:22 Sat Apr, 223 & lt; RfcException:
Error: & gt; 11 16:15:45 Sat Apr, 345 & lt; RfcException:
Error: & gt; 11 16:17:35 Sat Apr, 714 & lt; RfcException:

The difficulty lies in:

1) how to position to the current line Error for the first time in 5 minutes? That date at the back of the Error and of the date of the interval in 5 minutes now it happened (Error)
2) how to put the bank at the back of the line all redirected to a file?