How to View the Contents of a Compressed Archive Using the zcat Command in Linux

When working on Linux servers, log files and database dumps are almost always compressed using the gzip format to save disk space. These files end with the .gz extension.

If you need to quickly check the contents of a compressed system log to find an error message, standard practice dictates that you must first decompress the file using gunzip, read the massive text file using cat or less, and then compress it again to save space. This is a slow, tedious, and disk-intensive process.

To bypass this, Linux provides the zcat command. zcat allows you to instantly view the uncompressed contents of a .gz archive directly in your terminal, without ever extracting the file to your hard drive.

The Basic zcat Command

The zcat command functions exactly like the standard cat command, but it is specifically designed to read compressed archives.

To view the entire contents of a compressed log file named syslog.2.gz, type the following command in your terminal:

zcat syslog.2.gz

Press Enter. The server will decompress the file in the system’s RAM (memory) and instantly print the text to your terminal screen. The original .gz file remains completely untouched and compressed on your hard drive.

Piping zcat for Better Readability

Because log files and database dumps are typically massive, running a raw zcat command will cause thousands of lines of text to instantly flood your terminal screen, making it impossible to read.

To solve this, you must “pipe” (|) the output of zcat into other standard Linux text-reading tools.

1. Using zcat with ‘less’

To read a compressed file page by page, pipe the output into the less command:

zcat syslog.2.gz | less

This opens an interactive viewing environment. You can use your Up and Down arrow keys to scroll through the text, and press Q to quit and return to the prompt.

2. Using zcat with ‘head’ or ‘tail’

If you only want to see the very beginning or the very end of a compressed log file, use head or tail.

To see only the first 20 lines of the archive:

zcat syslog.2.gz | head -n 20

To see only the last 50 lines (perfect for finding the most recent error in an old log):

zcat syslog.2.gz | tail -n 50

Searching Inside Compressed Archives

The most powerful use of zcat is combining it with grep to search for specific error codes or IP addresses inside compressed files.

For example, if you want to find every instance of the word “Failed” inside an archived authentication log, you would use:

zcat auth.log.1.gz | grep "Failed"

This command will silently scan the entire compressed archive and print only the lines containing the word “Failed” to your terminal.

By integrating zcat into your workflow, you can rapidly audit, search, and analyse archived server data without the overhead of constantly unzipping and re-zipping massive files.