zcommands: Read gzip Compressed Text Files On a Fly

Linux and Unix like operating systems comes with z* commands. These commands allow you to read gzip compressed text files using zless, zcat, zmore and friends commands. The gzip command reduces the size of the files using Lempel-Ziv coding (LZ77). Whenever possible, each file is replaced by one with the extension .gz, while keeping the same ownership modes, access and modification times. z* commands has some cool usage too; such as display the current time in different zonename.

The old way…

Let us say you have a file called data.txt.gz. To display file you need to execute the following command:
gzip -d data.txt.gz
cat data.txt
less data.txt

The new way…

Just use the zless or zmore command to display the contents of a file called data.txt.gz:
zless data.txt.gz
zmore data.txt.gz

zcat command

Concatenate compressed files and print on the screen without using the cat command. The syntax is:
zcat file.gz

zdiff / zcmp command

Compare compressed files. The syntax is:
zdiff file1.gz file2.gz
zcmp file1.gz file2.gz

zegrep / zfgrep / zgrep command

Search (grep command or egrep command) compressed files for a regular expression:
zegrep -w '^word1|word2' file.gz
zgrep 'wordToSearch' file.gz

In this example, search Apache/Nginx/Lighttpd web-server access_log_1.gz for IP address using grep command like syntax:

zgrep '' access_log_1.gz

zless / zmore commands

zmore and zless is a filter which allows examination of compressed or plain text files one screenplay at a time on a screen. zmore works on files compressed with compress, pack or gzip, and also on uncompressed files. If a file does not exist, zmore looks for a file of the same name with the addition of a .gz, .z or .Z suffix.
zmore file.gz
zless file.gz

znew command

Znew recompresses files from .Z (compress) format to .gz (gzip) format. If you want to recompress a file already in gzip format, rename the file to force a .Z extension then apply znew.
znew file.Z

zdump command

zdump command prints the current time in each zonename named on the command line. Let us say your current time zone is IST (Indian standard time) and like to see time current time for Los Angeles (USA – PDT), enter:

Fri Aug 31 20:51:39 IST 2007

Now display Los Angeles current time :
zdump /usr/share/zoneinfo/America/Los_Angeles

/usr/share/zoneinfo/America/Los_Angeles  Fri Aug 31 08:20:31 2007 PDT

zipgrep command

Search files in a ZIP archive for lines matching a pattern:
zipgrep *.cpp basesys.zip

Open gzip text files using vim text editor

Just type the following command to open and edit the archived file called file-name-here.txt.gz:
$ vim file-name-here.txt.gz
If the above example, failed edit your local vim config file (see how to configure vim) to set vim for reading and writing compressed files:

  :augroup gzip
  :  autocmd!
  :  autocmd BufReadPre,FileReadPre	*.gz set bin
  :  autocmd BufReadPost,FileReadPost	*.gz '[,']!gunzip
  :  autocmd BufReadPost,FileReadPost	*.gz set nobin
  :  autocmd BufReadPost,FileReadPost	*.gz execute ":doautocmd BufReadPost " . expand("%:r")
  :  autocmd BufWritePost,FileWritePost	*.gz !mv  :r
  :  autocmd BufWritePost,FileWritePost	*.gz !gzip :r

  :  autocmd FileAppendPre		*.gz !gunzip 
  :  autocmd FileAppendPre		*.gz !mv :r 
  :  autocmd FileAppendPost		*.gz !mv  :r
  :  autocmd FileAppendPost		*.gz !gzip :r
  :augroup END

Practical examples of z* commands

Search log files:

zgrep 'something' /path/to/log/file.gz
zgrep 'email-id' /var/log/maillog-*.gz
zgrep 'kernel' /var/log/yum.log*.gz

Find failed login attempts:

zgrep --color 'Failed password for' /var/log/secure*

Sample outputs:

/var/log/secure-20131215.gz:Dec  8 04:10:06 txvip1 sshd[59988]: Failed password for root from port 51448 ssh2
/var/log/secure-20131215.gz:Dec  8 04:10:06 txvip1 sshd[59988]: Failed password for root from port 51448 ssh2
/var/log/secure-20131215.gz:Dec  8 04:10:08 txvip1 sshd[59990]: Failed password for root from port 51449 ssh2
/var/log/secure-20131215.gz:Dec  8 04:10:08 txvip1 sshd[59990]: Failed password for root from port 51449 ssh2

Search for pattern in all *.gz files using xargs command and zgrep command as follows:
find /path/to/dir/ -iname '*.gz' -print0 | xargs -0 -I {} zgrep "pattern" {}

See also

🐧 Please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on Linux, Open Source & DevOps via:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
10 comments… add one
  • arman Sep 28, 2015 @ 9:51

    can we rename a file while compressing, in case file name already exists?
    eg. If file.log.gz already exists and i m compressing file.log, it will give error. So i want to rename the file.log after compressing to file.log1.gz. Is it possible?

  • BFB Jan 7, 2014 @ 17:13

    Very useful. Thanks

  • cherouvim Apr 2, 2013 @ 10:07

    Thanks. Saved the day! 🙂

  • Danny Dec 5, 2011 @ 4:12

    you can also use gunzip -c, this will send file to standard output.. example:

    $ sudo gunzip -c /var/log/dmesg.*.gz | grep -i duplex
    [ 12.194310] tg3 0000:02:00.0: eth0: Link is up at 100 Mbps, full duplex
    [ 12.405853] tg3 0000:02:00.0: eth0: Link is up at 100 Mbps, full duplex
    [ 12.223136] tg3 0000:02:00.0: eth0: Link is up at 100 Mbps, full duplex
    [ 45.822750] tg3 0000:02:00.0: eth0: Link is up at 100 Mbps, full duplex

  • tarun Jan 28, 2009 @ 10:36

    it’s very useful to handle zip file, it’s special in grep format

  • Jeff Schroeder Sep 5, 2007 @ 5:37

    Or just make sure you are using gnu less because it autodetects and autodecompresses gzip / bz2 files for you.

  • 🐧 nixCraft Sep 1, 2007 @ 9:50

    gregf, oh yes I forgot about vim handling .gz file. Good reminder…

    Binnay, another good reminder

    raj, no problem 😀

    Appreciate all of your posts!

  • raj Sep 1, 2007 @ 9:19

    hey thanks for zcommand, really useful 😀

  • Binny V A Sep 1, 2007 @ 5:35

    For reading a BZipped file…
    bzcat file.xml.bz2

  • gregf Aug 31, 2007 @ 20:28

    Another good thing to remember is vim can handle gzipped files so if your that anal over space you can still edit the file.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre> for code samples. Problem posting comment? Email me @ webmaster@cyberciti.biz