Grep a tar.gz file

[Richard Briggs]

I have a huge log file (syslogs from other boxes)...and it is tar'd and then gzip'd.

I'd like to grep for an IP within this monster file on the fly without unzipping and untarring it in separate steps...

is there a way to grep an IP out of this log file in one command that will leave the tar.gz file in place while temporarily inflating to search the text?

[Jeff_Traigle]

For one log file, why tar it? If it's only gzip'd, you could do gzcat file | grep IP.

[Geoff Wild]

How about:

tar zxvf tar.gz |grep ip


Rgds...Geoff

[doug mielke]

The only tool I can think of is strings, but a zipped ind tar'd file? MAy be woorth a shot.

[Richard Briggs]

tar zxvf ...


.... tar: z: unknown option. tar: usage tar {txruc}[eONvVwAfblhm{op}][0-7[lmh]] [tapefile] [blocksize] [[-C directory] file] ...


I'm guessing "z" don't work ;-)

[Geoff Wild]

Ah - sorry - you need the gnu tar with option z:

http://hpux.ee.ualberta.ca/hppd/hpux/Gnu/tar-1.13.25/

Rgds...Geoff

[Jeff_Traigle]

And even with GNU tar, aren't you missing an argument for the f option, Geoff? Shouldn't it be:

tar zxf - tar.gz | grep ip

Of course, without GNU tar and having the log file tar'd anyway, I believe you can still accomplish the same thing with

gzcat tar.gz | tar xf - | grep ip

At least I think I got that syntax correct. It's proving to be a long day. :)

[H.Merijn Brand (procura]

if it is indeed only one file only in the file, the change is low that the pattern is in the tar archive header, and you can ignore the tar format

# gzip -d < file.tar.gz | grep pattern

that's because tar does store the files unmodified. Same for GNU tar, which you don't need here.

Enjoy, Have FUN! H.Merijn

[Rodney Hills]

I think you will have restore the file from the tar archive before you can look for an "IP".

Doing a tar zxf file | grep ip will not work since tar (or even gnu tar) will restore content, not display the contents of an archived file.

If the tar archive truly only contains your one log file, then it would be better to just compress the log file and not deal with tar.

Then you could do a command like-
zcat mylogfile.Z | grep 10.10.10.10

HTH

-- Rod Hills

[Stuart Browne]

I agree with Merijn, but if you want to go the whole-hog, you could always:

gzip -cd file.tar.gz | tar xvf - | grep

But this does pretty much the same as what Merijn said.

But as has already been said, why 'tar' a single file? The whole point of 'tar' (tape archive) is to concatenate multiple-files into a single-file stream good for outputting to a tape device. The basic syntax is very similar to 'ar', used for making static-link libraries and other basic archive files.

Anybody know the history of the two, code wise?

Anyway, getting side tracked..

Admittadly not many use it for that purpose any more as there are much better backup routines/commands available, but instead use it to dump to a local filesystem, thus the '.tar' file ;)