I have a lot of gz compressed log files which have generic names and I need to check the period of time they reflect. I know about the zcat | head but this works for the beginning of the file only.
How can I just get the last line without decompressing the whole file?
If you want lines from the tail-end of a file rather than the head-end, use tail instead of head:
$ zcat /var/log/syslog.2.gz | tail -1
Aug 24 07:09:02 myhost rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="796" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
RollingFileAppender log4j files that get compressed and I want to find out the timestamp of the last log statement before a new file is started :(
Oct 21, 2019 at 22:31
FWIW: I've developed a command line tool which can make a tail (-t) or even a continuous tail of a gzip file (-T) as it grows. (Many other options available):
https://github.com/circulosmeos/gztool
So for your case:
$ gztool -t myfile.gz | tail -1
Note that for any of these actions gztool will create a little (<1%/gzip) index file interleaved with that action. The advantage of this is that all next "tails" or extractions on that file will consume almost no time/cpu as the file is not decompressed again entirely!
