How do I compress old logs but still grep them without decompressing?

Quick Linux Tip #28:

Try: zgrep 'ERROR' /var/log/app-2026-06.log.gz

Info: zgrep, zcat, and zless inspect .gz files in memory without extracting them to disk.

Examples:

  • $ zcat access.log.gz | awk '{print $1}' | sort -u
  • $ zless huge-log.log.gz  # Page through compressed file
  • $ find /var/log -name '*.log' -mtime +7 -exec gzip {} \;

Note: z-tools exist for most utilities (zgrep, zcat, zless, zdiff). For .xz archives, use xzgrep. Automate log compression using logrotate.

Follow @LinuxTeck for more #LinuxTips

linuxteck@ubuntu:~$ gzip /var/log/app-2026-06.log
linuxteck@ubuntu:~$ ls -lh /var/log/app-2026-06.log*
-rw-r----- 1 root adm 8.2M Jul 1 00:00 /var/log/app-2026-06.log.gz

linuxteck@ubuntu:~$ zgrep 'ERROR' /var/log/app-2026-06.log.gz | head -3
2026-06-15 14:23:11 ERROR: Database connection failed
2026-06-16 09:12:45 ERROR: Out of memory
2026-06-20 22:34:56 ERROR: Disk full
linuxteck@ubuntu:~$
PREVIOUS ARTICLE Quick Linux Tip #27: How do I find a complex command I ran in the past without scrolling through history? NEXT ARTICLE Quick Linux Tip #29: My process list shows <defunct> zombie entries. How do I clean them up?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.