Frequently while searching for strings or patterns in a log file in a Linux/Unix server, you will come across a situation where the log files have been compressed by logrotate.
root@spartan [~]# ls -al /var/log/exim_mainlog*
-rw-r—– 1 mailnull mail 190715738 Sep 10 08:18 /var/log/exim_mainlog
-rw-r—– 1 mailnull mail 77593857 Sep 7 04:06 /var/log/exim_mainlog.1.gz
-rw-r—– 1 mailnull mail 88615088 Aug 31 04:05 /var/log/exim_mainlog.2.gz
-rw-r—– 1 mailnull mail 72980206 Aug 24 04:07 /var/log/exim_mainlog.3.gz
Now if you want to search within the compressed files one would have to un-compress using gunzip or tar and use grep.
Better way is to use `zgrep`.
root@spartan [~]# zgrep ’string’ /var/log/exim_mainlog.1.gz
This would search for the pattern or string within the compressed archive without the need of un-compressing it. Sweet
Additional note, zgrep is available in the gzip package,
root@spartan [~]# whereis zgrep
zgrep: /usr/bin/zgrep /usr/share/man/man1/zgrep.1.gz
root@spartan [~]# rpm -qf /usr/bin/zgrep
gzip-1.3.3-13.rhel3












