0

I have a lot of gz compressed log files which have generic names and I need to check the period of time they reflect. I know about the zcat | head but this works for the beginning of the file only.

How can I just get the last line without decompressing the whole file?

5

If you want lines from the tail-end of a file rather than the head-end, use tail instead of head:

$ zcat /var/log/syslog.2.gz | tail -1
Aug 24 07:09:02 myhost rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="796" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
  • this works! Thx. But its takes a long time for a 5GB compressed log file (1min). Do you know more efficient ways to do it? – Jurudocs Aug 25 '18 at 10:38
  • 1
    @Jurudocs Unfortunately, I don't think that's possible. gzip is a streaming compression mechanism, which generally requires you to start any decompression from the beginning of the stream. You can't just jump into the middle of a file and start from there. – Dave Sherohman Aug 25 '18 at 10:54
0

FWIW: I've developed a command line tool which can make a tail (-t) or even a continuous tail of a gzip file (-T) as it grows. (Many other options available): https://github.com/circulosmeos/gztool

So for your case: $ gztool -t myfile.gz | tail -1

Note that for any of these actions gztool will create a little (<1%/gzip) index file interleaved with that action. The advantage of this is that all next "tails" or extractions on that file will consume almost no time/cpu as the file is not decompressed again entirely!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.