I want to find out when my log files were compressed by logrotate because when I received them from cron in my email, the logs came in as text in the main body of the email instead.

I did:

ls -1la /var/log/some_services

And found that the logs in question are already in the compressed .gz format. So I was wondering if those files were emailed first, before being compressed.

However, the dates shown are not when the files were compressed, but when the logs were last updated.

How can I tell when a file was compressed?

  • 2
    AFAIK, you can't. But does this really matter? – vinc17 Jul 8 '14 at 2:31
  • Voting to reopen as this question is not about whether a file was compressed but when it was compressed. – Question Overflow Jul 8 '14 at 7:20
  • @QuestionOverflow Did you check the answers of that question? The top-voted answer contains the answer, as far as I can see. I assume that is the reason for the closure of this question. – Bernhard Jul 8 '14 at 8:43
  • 1
    No, it doesn't. The file command does not give the date/time when the file was compressed, but the last-modification time of the original file. So, this doesn't answer the question (which IMHO, has no answers as the information is lost / never saved). – vinc17 Jul 8 '14 at 8:46

There's no foolproof way to tell. However, for log files, the change time (as opposed to the modification time) which you see in the output of stat may be the time at which the compressed file was created, because the filesystem attributes of these compressed files are rarely modified after their creation.

For .gz files which were not created by compressing an existing file, according to the gzip file format, the time of compression is stored in the file itself, and you can see it in the output of the file command. But this will probably not be of much use to you, since your log files came from compressing existing files. In that case the time stored in the gzip file is the last modification time of the uncompressed log file, which will be before the compression occurred.

  • Thank you David, will accept your answer in a day's time if nobody can find a solution. – Question Overflow Jul 8 '14 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.