Sep 10

Frequently while searching for strings or patterns in a log file in a Linux/Unix server, you will come across a situation where the log files have been compressed by logrotate.

root@spartan [~]# ls -al /var/log/exim_mainlog*
-rw-r—–    1 mailnull mail     190715738 Sep 10 08:18 /var/log/exim_mainlog
-rw-r—–    1 mailnull mail     77593857 Sep  7 04:06 /var/log/exim_mainlog.1.gz
-rw-r—–    1 mailnull mail     88615088 Aug 31 04:05 /var/log/exim_mainlog.2.gz
-rw-r—–    1 mailnull mail     72980206 Aug 24 04:07 /var/log/exim_mainlog.3.gz

Now if you want to search within the compressed files one would have to un-compress using gunzip or tar and use grep.

Better way is to use `zgrep`.

root@spartan [~]# zgrep ’string’ /var/log/exim_mainlog.1.gz

This would search for the pattern or string within the compressed archive without the need of un-compressing it. Sweet :D

Additional note, zgrep is available in the gzip package,

root@spartan [~]# whereis zgrep
zgrep: /usr/bin/zgrep /usr/share/man/man1/zgrep.1.gz

root@spartan [~]# rpm -qf /usr/bin/zgrep
gzip-1.3.3-13.rhel3