zcat

What it does

zcat decompresses one or more gzip-compressed (.gz) files and writes the result straight to stdout, without creating a decompressed copy on disk and without modifying the original file. It's functionally identical to gzip -dc, and exists as a convenience alias so you don't have to remember the -dc flag combination every time you want to peek inside or pipe a compressed file into another command.

Beginner examples

• zcat file.gz — print the decompressed contents to the terminal
• zcat file.gz | less — page through a compressed file's contents
• zcat file.gz > file — decompress to a new file while keeping file.gz
• zcat file.gz | wc -l — count lines in a compressed file without extracting it

zcat nginx-access.log.gz | less

Advanced examples

• Search across many rotated, compressed logs at once: zcat /var/log/app/*.log.gz | grep "timeout"
• Feed a compressed CSV directly into a processing pipeline: zcat data.csv.gz | cut -d, -f2 | sort | uniq -c
• Concatenate a series of log rotations into a single decompressed archive: zcat access.log.1.gz access.log.2.gz access.log.3.gz > access-combined.log
• Check a compressed file's stats before deciding whether to fully decompress it: zcat -l big-dataset.gz

zcat /var/log/nginx/access.log.*.gz | awk '{print $1}' | sort | uniq -c | sort -rn | head

Common mistakes

• Trying to run zcat on a non-gzip file (like plain text or .zip) and getting a "not in gzip format" error — check the file type with file first.
• Forgetting zcat doesn't remove or modify the source .gz file, and then separately running rm unnecessarily, thinking the original needs cleanup.
• Redirecting zcat's output over the compressed file itself (zcat file.gz > file.gz), which corrupts data because the shell truncates the output file before zcat finishes reading input.
• Using zcat on huge files and printing straight to a terminal instead of piping to less or head, flooding the screen.

Tips

• Use zgrep, zless, zdiff, and zcmp as siblings of zcat — they all operate on compressed files by decompressing on the fly, so you rarely need to manually decompress just to inspect content.
• Combine with tar: zcat archive.tar.gz | tar -tvf - lists an archive's contents without extracting (though tar tzf archive.tar.gz is more idiomatic for tarballs).
• When only checking a compressed log's size stats, use -l instead of decompressing the whole thing.

Best practices

• Prefer streaming (zcat file.gz | some-command) over decompressing to a temporary file when you only need to read the data once — it saves disk I/O and cleanup.
• Avoid zcat-ing untrusted files of unknown size directly into memory-hungry commands; check -l output first so you don't accidentally decompress a multi-gigabyte "gzip bomb."
• In scripts, check the exit status of zcat (or the pipeline via PIPESTATUS) rather than assuming decompression succeeded, especially with truncated or corrupted files.

Real-world use cases

• Reading rotated log files (access.log.2.gz, access.log.3.gz) that logrotate has already compressed, without restoring them to disk first.
• Feeding compressed data exports (database dumps, CSV extracts) directly into downstream processing tools like awk, cut, or jq in a pipeline.
• Quickly grepping across years of compressed historical logs during an incident investigation, one zcat ... | grep ... pipeline at a time.

Common interview questions

• What is zcat equivalent to? gzip -dc — decompress to stdout, leaving the source file untouched.
• How would you search for a string across multiple compressed log files without extracting them? zcat *.gz | grep "pattern", or more directly zgrep "pattern" *.gz.
• Why shouldn't you redirect zcat's output back onto the same .gz file? The shell truncates the destination file for writing before zcat reads it, so you'd be reading from a file that's simultaneously being emptied — resulting in data loss.