19

I have a lot of gz compressed log files which have generic names and I need to check the period of time they reflect. I know about the zcat | head but this works for the beginning of the file only.

How can I just get the last line without decompressing the whole file?

Jurudocs
  • 339
  • 1
  • 3
  • 11

2 Answers2

29

If you want lines from the tail-end of a file rather than the head-end, use tail instead of head:

$ zcat /var/log/syslog.2.gz | tail -1
Aug 24 07:09:02 myhost rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="796" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Dave Sherohman
  • 1,779
  • 1
  • 12
  • 16
  • 5
    this works! Thx. But its takes a long time for a 5GB compressed log file (1min). Do you know more efficient ways to do it? – Jurudocs Aug 25 '18 at 10:38
  • 4
    @Jurudocs Unfortunately, I don't think that's possible. gzip is a streaming compression mechanism, which generally requires you to start any decompression from the beginning of the stream. You can't just jump into the middle of a file and start from there. – Dave Sherohman Aug 25 '18 at 10:54
  • This is a problem for me too. I have `RollingFileAppender` log4j files that get compressed and I want to find out the timestamp of the last log statement before a new file is started :( – Sridhar Sarnobat Oct 21 '19 at 22:31
  • 2
    @SridharSarnobat : then maybe the easiest and fastest is to use the file's last modification date ? – Olivier Dulac Mar 02 '21 at 08:58
7

FWIW: I've developed a command line tool which can make a tail (-t) or even a continuous tail of a gzip file (-T) as it grows. (Many other options available): https://github.com/circulosmeos/gztool

So for your case: $ gztool -t myfile.gz | tail -1

Note that for any of these actions gztool will create a little (<1%/gzip) index file interleaved with that action. The advantage of this is that all next "tails" or extractions on that file will consume almost no time/cpu as the file is not decompressed again entirely!

circulosmeos
  • 191
  • 1
  • 2
  • 5