How can I tell when a file was compressed?

Question

I want to find out when my log files were compressed by logrotate because when I received them from cron in my email, the logs came in as text in the main body of the email instead.

I did:

ls -1la /var/log/some_services

And found that the logs in question are already in the compressed .gz format. So I was wondering if those files were emailed first, before being compressed.

However, the dates shown are not when the files were compressed, but when the logs were last updated.

How can I tell when a file was compressed?

Answer 1

There's no foolproof way to tell. However, for log files, the change time (as opposed to the modification time) which you see in the output of stat may be the time at which the compressed file was created, because the filesystem attributes of these compressed files are rarely modified after their creation.

For .gz files which were not created by compressing an existing file, according to the gzip file format, the time of compression is stored in the file itself, and you can see it in the output of the file command. But this will probably not be of much use to you, since your log files came from compressing existing files. In that case the time stored in the gzip file is the last modification time of the uncompressed log file, which will be before the compression occurred.