23

I have a lot of gz compressed log files which have generic names and I need to check the period of time they reflect. I know about the zcat | head but this works for the beginning of the file only.

How can I just get the last line without decompressing the whole file?

Jurudocs
  • 379

2 Answers2

35

If you want lines from the tail-end of a file rather than the head-end, use tail instead of head:

$ zcat /var/log/syslog.2.gz | tail -1
Aug 24 07:09:02 myhost rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="796" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Dave Sherohman
  • 1,849
  • 1
  • 13
  • 16
11

FWIW: I've developed a command line tool which can make a tail (-t) or even a continuous tail of a gzip file (-T) as it grows. (Many other options available): https://github.com/circulosmeos/gztool

So for your case: $ gztool -t myfile.gz | tail -1

Note that for any of these actions gztool will create a little (<1%/gzip) index file interleaved with that action. The advantage of this is that all next "tails" or extractions on that file will consume almost no time/cpu as the file is not decompressed again entirely!

circulosmeos
  • 231