gzip: Compress Files on Linux, Decompress gzip Files, and Use gunzip and zcat

gzip is the Linux command that compresses a single file into a .gz file; to decompress, add -d to the same command or use gunzip. On an AlmaLinux 9 server, a 31,878-byte access log shrank to 4,424 bytes, and decompressing it brought back the original size and modification time.

The output below comes from a test folder on an AlmaLinux 9.8 server, run as root, with times in UTC. The access logs, notes and configuration files are sample files made for the test, and the IP addresses in the logs are documentation example values.

1️⃣ How to use the gzip command

The test folder holds two access logs, two note files, a config folder with configuration files and an empty restore folder.

ls -l

total 88
-rw-r--r-- 1 root root 31878 Oct 28 23:50 access.log
-rw-r--r-- 1 root root 47748 Oct 27 23:59 access.log-20261027
drwxr-xr-x 2 root root    39 Oct 29 00:19 config
-rw-r--r-- 1 root root    45 Oct 28 14:30 memo.txt
-rw-r--r-- 1 root root   426 Oct 27 09:10 readme.txt
drwxr-xr-x 2 root root     6 Oct 29 00:19 restore

When you put a file name after gzip, that file turns into a compressed file with .gz added to the end of its name. The command below compresses access.log and prints nothing when it finishes.

gzip access.log

After compression, ls -l shows no access.log, only access.log.gz. The 31,878-byte log became 4,424 bytes, and the modification time is still that of the original file.

ls -l access.log access.log.gz

ls: cannot access 'access.log': No such file or directory
-rw-r--r-- 1 root root 4424 Oct 28 23:50 access.log.gz

With -v, gzip prints the reduction ratio and the new file name for each file. The [81.5%] on the readme.txt line is how much smaller the file got, and [replaced with] means the original file was replaced by the .gz file.

gzip -v readme.txt

readme.txt:	 81.5% -- replaced with readme.txt.gz

To keep the original file, add -k. Compressing memo.txt with -k leaves memo.txt and memo.txt.gz side by side.

gzip -k memo.txt

ls -l memo.txt memo.txt.gz

-rw-r--r-- 1 root root 45 Oct 28 14:30 memo.txt
-rw-r--r-- 1 root root 71 Oct 28 14:30 memo.txt.gz

The 45-byte memo.txt actually grew to 71 bytes after compression. According to the official manual, gzip compresses even when the result is larger than the original, and it stores the original file name and time inside the compressed file.

If you list several files at once, each file gets its own .gz file. Compressing the two configuration files in the config folder produces two files, app.conf.gz and site.conf.gz.

gzip -v config/app.conf config/site.conf

config/app.conf:	 78.7% -- replaced with config/app.conf.gz
config/site.conf:	 87.7% -- replaced with config/site.conf.gz

ls -l config/

total 8
-rw-r--r-- 1 root root 206 Oct 20 11:00 app.conf.gz
-rw-r--r-- 1 root root  93 Oct 20 11:05 site.conf.gz

2️⃣ Decompressing gzip files

Decompressing access.log.gz with -d prints nothing, access.log comes back, and access.log.gz is gone.

gzip -d access.log.gz

ls -l access.log access.log.gz

ls: cannot access 'access.log.gz': No such file or directory
-rw-r--r-- 1 root root 31878 Oct 28 23:50 access.log

The restored access.log is 31,878 bytes, and its modification time is the same Oct 28 23:50 as before compression.

gunzip does the same job as gzip -d. With -k it decompresses while keeping the compressed file, and [created] on the -v line means it made a new file without deleting the .gz file.

gunzip -kv readme.txt.gz

readme.txt.gz:	 81.5% -- created readme.txt

ls -l readme.txt readme.txt.gz

-rw-r--r-- 1 root root 426 Oct 27 09:10 readme.txt
-rw-r--r-- 1 root root 108 Oct 27 09:10 readme.txt.gz

gzip has no option for choosing the output folder, so to decompress into another folder, use -c to send the decompressed data to standard output and put the new file path after [>]. The command below decompresses memo.txt.gz into memo.txt in the restore folder.

gzip -dc memo.txt.gz > restore/memo.txt

ls -l restore/

total 4
-rw-r--r-- 1 root root 45 Oct 29 00:19 memo.txt

Decompressing with -c leaves memo.txt.gz in place. The new restore/memo.txt has a modification time of Oct 29 00:19, when the file was created.

3️⃣ gzip command options

-l prints, on one line and without decompressing, the compressed size, the original size, the reduction ratio and the name the file gets when decompressed. After compressing access.log again with -k, -l shows the following.

gzip -k access.log

gzip -l access.log.gz

         compressed        uncompressed  ratio uncompressed_name
               4424               31878  86.2% access.log

Adding -v puts the compression method (defla, short for deflate), the CRC of the original data and the date and time of the original file in front.

gzip -lv access.log.gz

method  crc     date  time           compressed        uncompressed  ratio uncompressed_name
defla b49b41c4 Oct 28 23:50                4424               31878  86.2% access.log

-t only checks whether the compressed file is intact and then exits. Used with -v, it prints [OK] after each file without problems.

gzip -tv access.log.gz

access.log.gz:	 OK

The numbers -1 to -9 set the compression level, and according to the official manual the default is -6. The same access.log was compressed three times with -c and the sizes were compared with wc -c.

gzip -c -1 access.log | wc -c

5564

gzip -c -6 access.log | wc -c

4424

gzip -c -9 access.log | wc -c

4164

-9 was 260 bytes smaller than the default, and -1 was 1,140 bytes larger than the default.

If you give only a folder name, gzip prints [is a directory -- ignored] and skips the folder.

gunzip config

gzip: config is a directory -- ignored

To process every file inside a folder, add -r. Running gunzip -r on the config folder, where the two configuration files had been compressed, decompresses both files one after another.

gunzip -rv config

config/app.conf.gz:	 78.7% -- replaced with config/app.conf
config/site.conf.gz:	 87.7% -- replaced with config/site.conf

ls -l config/

total 8
-rw-r--r-- 1 root root 840 Oct 20 11:00 app.conf
-rw-r--r-- 1 root root 528 Oct 20 11:05 site.conf

-r compresses or decompresses the files in a folder one by one and does not bundle several files into one. To turn a folder into a single compressed file, use the tar command to bundle and compress it in one step. Compressing the config folder with tar -czf puts the folder and both files into a single config.tar.gz.

tar -czf config.tar.gz config

tar -tzvf config.tar.gz

drwxr-xr-x root/root         0 2026-10-29 00:19 config/
-rw-r--r-- root/root       840 2026-10-20 11:00 config/app.conf
-rw-r--r-- root/root       528 2026-10-20 11:05 config/site.conf

📌 Main options: results from this article

📎 Other options: per the official manual

🔲 gzip command simulator

In the simulator below, you can type the commands yourself to compress with gzip, decompress, and view the contents with zcat and zgrep.

4️⃣ Viewing gzip file contents

Old logs saved with a date in their name take up less space once compressed with gzip. The command below compresses access.log-20261027, the log from the previous day.

gzip access.log-20261027

A compressed log can be printed to the screen with zcat without decompressing it. zcat is the same as gunzip -c (according to the official manual), so the .gz file stays as it is.

zcat access.log-20261027.gz | head -3

192.0.2.50 - - [27/Oct/2026:00:00:00 +0000] GET / HTTP/1.1 200 15929
192.0.2.54 - - [27/Oct/2026:00:00:07 +0000] GET / HTTP/1.1 200 17699
192.0.2.4 - - [27/Oct/2026:00:00:14 +0000] GET / HTTP/1.1 200 13813

The output of zcat can be piped to other commands, and counting with wc -l shows that this log has 600 lines.

zcat access.log-20261027.gz | wc -l

600

To search for specific text in a compressed log, use zgrep. With -c, it prints only the number of lines containing [ 404 ]; to see the lines themselves, run it without -c.

zgrep -c ' 404 ' access.log-20261027.gz

37

zgrep ' 404 ' access.log-20261027.gz | head -3

192.0.2.23 - - [27/Oct/2026:00:02:06 +0000] GET /old-page-6/ HTTP/1.1 404 229
192.0.2.38 - - [27/Oct/2026:00:04:40 +0000] GET /old-page-2/ HTTP/1.1 404 217
192.0.2.22 - - [27/Oct/2026:00:07:42 +0000] GET /old-page-6/ HTTP/1.1 404 414

When zcat gets a file that is not compressed, it prints [not in gzip format] and stops.

zcat access.log | head -1

gzip: access.log: not in gzip format

zgrep also reads uncompressed files as they are, so you can search the current log and the compressed old logs in one go. With two or more files, each line count is prefixed with the file name.

zgrep -c wp-login.php access.log access.log-20261027.gz

access.log:36
access.log-20261027.gz:52

5️⃣ gzip errors

Compressing a file that already ends in .gz prints [already has .gz suffix -- unchanged] and leaves the file as it is.

gzip access.log.gz

gzip: access.log.gz already has .gz suffix -- unchanged

Conversely, decompressing a file that does not end in .gz with -d prints [unknown suffix -- ignored].

gzip -d memo.txt

gzip: memo.txt: unknown suffix -- ignored

A file that is only named .gz but was not compressed with gzip ends with [not in gzip format]. This message appeared when the text file memo.txt was copied as notgzip.gz and decompressed.

cp memo.txt notgzip.gz

gzip -d notgzip.gz

gzip: notgzip.gz: not in gzip format

A .gz file whose end was cut off, for example by an interrupted download, ends with [unexpected end of file]. This is the result of checking broken.gz, which kept only the first 2,000 bytes of a compressed old log, with -t.

head -c 2000 access.log-20261027.gz > broken.gz

gzip -t broken.gz

gzip: broken.gz: unexpected end of file

Even from a truncated file, zcat can recover the content up to the point where it was cut. Of the 600-line log, 162 lines were left in restore/broken.log, and the official manual also recommends using zcat to rescue the beginning of a damaged compressed file.

zcat broken.gz > restore/broken.log

wc -l restore/broken.log

gzip: broken.gz: unexpected end of file
162 restore/broken.log

If a file with the same name as the .gz file to be created already exists, gzip asks whether to overwrite it. Typing n ends the command with [not overwritten] and changes nothing.

gzip memo.txt

gzip: memo.txt.gz already exists; do you wish to overwrite (y or n)? n
	not overwritten

With -f, gzip overwrites without asking. Because -k was not added, memo.txt disappears and only memo.txt.gz remains.

gzip -f memo.txt

ls -l memo.txt memo.txt.gz

ls: cannot access 'memo.txt': No such file or directory
-rw-r--r-- 1 root root 71 Oct 28 14:30 memo.txt.gz

The error messages that came up while working with compression, and what to check next, are as follows.

🔢 FAQ & Recommended Content

🔗 Recommended Reading

Logs · Administration Linux Logrotate: concept and settings The concept and configuration of logrotate, which replaces log files with new ones at set intervals and cleans up old logs. You can continue with where the compressed old logs come from. Read post →

Search Linux grep command The grep command for finding a string in text files such as logs, with examples that pipe it together with tail and find. Disk du command: checking file disk usage The du command for checking how much disk space files and directories use. Viewing files Linux head command & tail command The head and tail commands for viewing the first and last lines of a file, often used to check server access logs.

ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays^{(it goes down during event discounts ↓)}does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.