How to print the last line of a gz compressed file in the command line?

Question

I have a lot of gz compressed log files which have generic names and I need to check the period of time they reflect. I know about the zcat | head but this works for the beginning of the file only.

How can I just get the last line without decompressing the whole file?

Solution 1

If you want lines from the tail-end of a file rather than the head-end, use tail instead of head:

$ zcat /var/log/syslog.2.gz | tail -1
Aug 24 07:09:02 myhost rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="796" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Solution 2

FWIW: I've developed a command line tool which can make a tail (-t) or even a continuous tail of a gzip file (-T) as it grows. (Many other options available): https://github.com/circulosmeos/gztool

So for your case: $ gztool -t myfile.gz | tail -1

Note that for any of these actions gztool will create a little (<1%/gzip) index file interleaved with that action. The advantage of this is that all next "tails" or extractions on that file will consume almost no time/cpu as the file is not decompressed again entirely!

Comments

[Jurudocs]

this works! Thx. But its takes a long time for a 5GB compressed log file (1min). Do you know more efficient ways to do it?

[Swapnil Kumar]

@Jurudocs Unfortunately, I don't think that's possible. gzip is a streaming compression mechanism, which generally requires you to start any decompression from the beginning of the stream. You can't just jump into the middle of a file and start from there.

[Sridhar Sarnobat]

This is a problem for me too. I have RollingFileAppender log4j files that get compressed and I want to find out the timestamp of the last log statement before a new file is started :(

[Olivier Dulac]

@SridharSarnobat : then maybe the easiest and fastest is to use the file's last modification date ?