How to Use the Linux zcat Command to Read Compressed Text Files

Log files on a busy Linux server can grow to massive sizes very quickly. To conserve disk space, standard practice dictates that older logs (such as those managed by logrotate) are automatically compressed using the gzip utility, resulting in files ending in .gz (like syslog.2.gz). When you need to investigate a historical error, your first instinct might be to extract the file using gunzip, read the log, and then compress it again. This process is tedious and consumes unnecessary disk I/O. Instead, Linux provides the zcat command, which allows you to seamlessly read the contents of a compressed text file directly in your terminal without ever extracting the archive to the disk.

What is zcat?

The zcat utility is essentially a compressed-file wrapper for the standard cat command. When you run zcat on a .gz file, it decompresses the data directly into the system’s active memory (RAM) and immediately streams that text to the standard output (your terminal screen). The original compressed file on the hard drive remains entirely untouched, perfectly compressed, and unmodified.

Basic Usage of zcat

Using zcat is identical to using cat. You simply provide the path to the compressed file.

1. Open your terminal.
2. Execute the command: zcat /var/log/syslog.2.gz

The contents of the log file will instantly print to your screen. However, because log files are usually thousands of lines long, the text will flash past your eyes much faster than you can read it, stopping only at the very bottom.

Piping zcat Output for Readability

Because zcat simply streams the uncompressed text to standard output, you can use standard Linux pipes (|) to pass that text into other utilities for reading or filtering, exactly as you would with uncompressed text.

Reading with less:
To scroll through the compressed file page by page, pipe the output into the less pager. zcat /var/log/syslog.2.gz | less You can now use the arrow keys to scroll up and down, and press q to exit.

Searching with grep:
If you are looking for a specific error message, you do not need to read the whole file. You can pipe the output directly into grep to search for keywords. zcat /var/log/syslog.2.gz | grep "authentication failure" This will instantly print only the lines containing the error message, discarding the rest of the compressed data.

The z-Suite of Commands

While piping zcat into grep or less works perfectly, the developers of gzip actually created dedicated shortcuts for these common pipelines to save you keystrokes. These tools are often referred to as the “z-suite” of commands.

• zless: This is a direct equivalent to zcat file.gz | less. Simply type zless /var/log/syslog.2.gz to open the compressed file in a scrollable view.
• zgrep: This is a direct equivalent to zcat file.gz | grep. You can search directly by typing zgrep "error" /var/log/syslog.2.gz.
• zmore: A simpler pager similar to zless, but with fewer navigation features.

Supported File Types

It is important to note that zcat and its related tools (zless, zgrep) are designed specifically for files compressed with gzip (ending in .gz) or the older compress utility (ending in .Z). They will not work on modern .xz files or .bz2 files. If you need to read a .bz2 file without extracting it, you must use the equivalent bzcat command, and for .xz files, you must use xzcat.