zless Command in Linux: Complete Guide to Viewing Compressed Files and Parameters

I use zless almost every day when I’m digging through rotated log files, since so many production systems compress logs immediately after rotation, and decompressing each one just to read it would get old fast. zless solves a small but genuinely annoying problem: viewing compressed text without cluttering your disk with temporary decompressed copies. Here’s my full walkthrough.

What zless Does

zless lets you page through the contents of a compressed file exactly like you’d use less on a regular text file, except it transparently decompresses the content on the fly. It works with .gz, and depending on the build, other compressed formats as well. It never writes a decompressed copy to disk — the decompression happens in-memory as part of the pipeline behind the scenes.

I confirmed the tool’s own description of itself directly:

$ zless --help
Usage: /usr/bin/zless [OPTION]... [FILE]...
Like 'less', but operate on the uncompressed contents of any compressed FILEs.

Options are the same as for 'less'.

That’s really the whole concept in one sentence: it’s less, transparently wired up to decompress its input first.

Basic Syntax

zless [options] file.gz [file2.gz ...]

Since it accepts the same options as less itself, everything you already know about navigating less transfers directly.

Practical Example

Building on files compressed earlier in my testing:

$ gzip -k sample_gzip_test.txt
$ zless sample_gzip_test.txt.gz

This opens an interactive pager showing the decompressed content of sample_gzip_test.txt.gz, without ever creating a sample_gzip_test.txt file on disk. Inside the pager, all the usual less navigation applies.

Key Navigation and Options (Inherited from less)

Since zless simply passes through to less‘s interface, here are the controls I use constantly:

Since less reads all these from the same option parser, any flag valid for less is valid when passed to zless:

zless -N -i access.log.gz

This shows line numbers and enables case-insensitive search while paging through a compressed log.

How zless Works Internally

zless is typically implemented as a small shell script (part of the gzip package) rather than a standalone binary. Structurally, it works by decompressing the target file and feeding the result into less through a pipe, roughly equivalent to running:

zcat file.gz | less

but with the added convenience of less‘s own file-handling features (like accepting multiple files and searching across them) still working correctly, and with proper handling of less options passed on the command line. Since decompression is streamed rather than done all at once, zless can start displaying content quickly even for very large compressed files — you don’t have to wait for the entire file to decompress before you can start scrolling through the beginning of it.

Real-World Use Cases

Reading rotated compressed logs directly without decompressing them first. This is genuinely my most common use case:

zless /var/log/nginx/access.log.2.gz

Searching through historical compressed logs for a specific error without cluttering disk space:

zless /var/log/myapp/app.log.5.gz
# then inside the pager:
/ERROR

Reviewing old compressed configuration backups before deciding whether to restore them:

zless /backup/etc-20260101.tar.gz

Note: for tar archives, you’d typically want to list contents (tar -tzvf) rather than view raw content through zless, since a .tar.gz isn’t plain text — but for single compressed text files, logs, or config dumps, zless is exactly the right tool.

Comparing whether a compressed log rotation captured an incident window correctly, paging quickly to a timestamp using / search rather than fully decompressing multi-gigabyte files just to check.

zless vs zcat vs zmore vs gunzip -c | less

These all solve a similar problem with slightly different interaction models:

• zcat file.gz dumps the entire decompressed content to stdout at once — great for piping into other tools like grep or awk, but not for interactive reading of long files since it doesn’t paginate.
• zless file.gz pages through content interactively, with full search and navigation — my default choice for actually reading something at the terminal.
• zmore file.gz is an older, more limited pager (based on more rather than less), lacking backward scrolling and some of less‘s richer navigation; largely superseded by zless where available.
• gunzip -c file.gz | less is functionally identical to zless file.gz — it’s literally what zless does under the hood, just spelled out manually.

Given that these are functionally close, I default to zless purely for the convenience of not having to remember or type the explicit pipe every time.

Troubleshooting Common Problems

“zless: command not found” — this would be unusual since it ships with gzip, which is present virtually everywhere, but on a truly minimal container image you may need to explicitly install the gzip package.

Garbled or binary-looking output — you’re trying to view a compressed file that isn’t actually plain text once decompressed (e.g., a compressed tar archive, image, or binary blob). zless decompresses correctly but can’t make binary data readable — use tar -tzvf for archive listings or file to check what you’re actually dealing with first.

Search inside zless not finding expected content — remember that zless decompresses the entire file for searching purposes (streamed), so a search miss usually means the pattern genuinely isn’t present, rather than a limitation of partial decompression; double check case sensitivity with -i if unsure.

Slow initial display on very large compressed files — since content is decompressed as you scroll, extremely large files (multi-gigabyte logs) can feel sluggish when jumping to the very end (G), since less in that mode may need to process through much of the stream first. For huge files, targeted zgrep searches are often faster than manually scrolling in zless.

Performance Considerations

Because zless streams decompression rather than materializing a full decompressed copy on disk, it’s generally more disk-efficient than manually running gunzip followed by less on the result — you avoid the extra disk write entirely, and you avoid needing enough free space to hold the fully decompressed file. For very large files, this streaming behavior is a meaningful practical advantage, not just a convenience.

Security Implications

There’s no unique security exposure introduced by zless beyond the general decompression concerns already inherent in gzip/zcat — a maliciously crafted compressed file could theoretically be used to try to exhaust memory or CPU if you attempt to page through something absurdly large, but the streaming nature of less limits how much has to be buffered in memory at once, which mitigates (though doesn’t fully eliminate) risk compared to decompressing an entire hostile file up front.

Compatibility Across Distributions

zless ships as part of the gzip package on Debian, Ubuntu, RHEL, Fedora, Arch, and openSUSE, so it’s essentially guaranteed to be present anywhere gzip is installed, which is to say nearly everywhere. The related bzip2 and xz packages also ship their own equivalents (bzless, xzless), following the same naming convention and interface philosophy, so once you know zless, those tools require no additional learning at all.

Using zless Across Multiple Files

Just like less itself, zless accepts multiple files and lets you navigate between them without restarting the pager:

zless access.log.1.gz access.log.2.gz access.log.3.gz

Inside the pager, :n moves to the next file and :p moves to the previous one — exactly the same controls you’d use in plain less when given multiple arguments. This is genuinely convenient when reviewing a sequence of rotated logs from an incident window without needing to exit and re-invoke the command for each file individually.

Searching Across a Session Without Losing Your Place

One less feature I lean on heavily inside zless sessions is marking positions with m followed by a letter, then jumping back to that mark later with ' (apostrophe) followed by the same letter:

m a          # set mark 'a' at current position
/ERROR       # search forward
'a           # jump back to the marked position

This is particularly useful when you’ve found something interesting deep in a large compressed log, want to keep scrolling to check for related entries further along, but need a reliable way back to your original spot without re-searching from scratch.

Piping zless Output for Automated Reporting

While zless is fundamentally an interactive tool, you can still use less in non-interactive contexts through its --no-init and output-redirection behavior, though at that point I’d generally just switch to zcat directly, since zless‘s value specifically comes from interactive pagination. That said, some administrators wrap zless inside a controlled environment (like script for session logging) to capture what was reviewed during a compliance audit of compressed historical logs:

script -c "zless sensitive-audit.log.gz" audit-review-session.log

This records everything displayed and any commands typed during the review, which some regulated environments require as part of an audit trail when reviewing historical security logs.

Comparing zless Behavior With bzless and xzless

Since bzless and xzless follow the exact same design pattern as zless — just wired to bzip2/xz decompression instead of gzip — switching between compression formats in your daily workflow requires no new mental model at all:

bzless archive.log.bz2
xzless release-notes.txt.xz

I’ve found this consistency across the whole z*/bz*/xz* tool family to be one of the more pleasant aspects of the Unix compression ecosystem — once you’ve internalized zless‘s behavior, the rest come essentially for free.

Customizing zless’s Default Behavior With Environment Variables

Since zless delegates its display behavior to less, you can customize its defaults through the same environment variables less respects, most notably LESS:

export LESS="-N -i -S"
zless big-report.log.gz

This sets line numbers on, case-insensitive search, and long-line chopping as persistent defaults for every zless (and plain less) invocation in that shell session, without needing to type the flags each time. I keep a version of this in my personal shell profile specifically because I almost always want line numbers visible when reviewing logs, and typing -N every single time got old fast.

Using zless for Quick Config Comparisons

A workflow I use occasionally when reviewing archived configuration snapshots: opening two compressed config backups side by side isn’t something zless does natively (it’s not a diff tool), but combining it with diff against a decompressed working copy is straightforward:

diff <(zcat old-config.tar.gz | tar -xO etc/nginx/nginx.conf) /etc/nginx/nginx.conf

While this technically uses zcat rather than zless for the comparison itself, I typically start by using zless interactively to locate the right file or section within a large compressed archive before deciding exactly what to diff — the two tools work well together in that reconnaissance-then-comparison workflow.

Handling Very Wide Log Lines

Some structured logs (particularly JSON-formatted application logs) produce extremely long single lines that wrap awkwardly in a terminal. The -S option, inherited directly from less, disables line wrapping in favor of horizontal scrolling:

zless -S app.log.gz

Once inside the pager with -S active, the arrow keys (or less‘s own left/right scroll bindings) let you pan across a single long line horizontally rather than having it wrap across multiple visual lines, which makes scanning wide JSON log entries considerably more readable than the default wrapped view.

Summary

zless solves a small annoyance elegantly: reading compressed text files interactively without ever needing a decompressed copy sitting on disk. Since it’s really just less wired up to decompress on the fly, everything you already know about less navigation, searching, and options carries over directly — making it one of those tools that requires almost no dedicated learning once you already know the underlying pager.

References

• GNU Gzip Manual: https://www.gnu.org/software/gzip/manual/gzip.html
• man less (for the full set of inherited navigation and options)
• man zless