CertGrid CertGrid
Hands-on Lab·Red Hat Certified System Administrator

Archive and Compression Tools

One objective naming three tools. The mechanics are quick; the two things worth the guide are that tar strips the leading `/` from absolute paths - so an archive of `/etc` extracts relative to wherever you happen to be - and that gzip replaces the file it compresses unless told otherwise.

Essential Tools Guide 9 of 67 Beginner

Written against the versions above. `-z` gzip, `-j` bzip2, `-J` xz. Modern tar detects the compression when reading, so `tar -xf` unpacks any of them without naming the format; the flag is only required when creating.

Every command on this page runs on RHCSA-A01.
Server NameIP AddressOSRolesCPURAMHDD
RHCSA-A01192.168.0.31RHEL 10.0 (Coughlan)Practice node (graded) - spare /dev/sda2 Core4 GB50 GB + 15 GB

Before you start

  1. An archive is not compression

    src/
src/f1.txt
src/f2.txt
src/f3.txt

    tar -cf creates - create, file - and does no compression at all. A tar file is a concatenation of its members plus headers, which is why it is slightly larger than the sum of the files.

    -t lists the contents without extracting, and it is the command to run before every extraction. It shows you what paths the archive will produce, which is the difference between unpacking into a directory and spraying files across your home.

    The three flags to keep: -c create, -t list, -x extract. Exactly one of them per command.

    bash Example session 
    cd ~/arc && tar -cf plain.tar src && ls -l plain.tar-rw-r--r--. 1 sysadmin sysadmin 71680 Aug 23 11:08 plain.tarcd ~/arc && tar -tf plain.tarsrc/src/f1.txtsrc/f2.txtsrc/f3.txt

    Expected resultAn uncompressed archive, and its contents listed.

    Success conditionYou always look inside an archive before unpacking it.

  2. The three compressors, measured

    -rw-r--r--. 1 sysadmin sysadmin 30720 plain.tar
-rw-r--r--. 1 sysadmin sysadmin  ...  gz.tar.gz
-rw-r--r--. 1 sysadmin sysadmin  ...  bz.tar.bz2
-rw-r--r--. 1 sysadmin sysadmin  ...  xz.tar.xz

    Same content, four sizes. As a rule xz compresses hardest and slowest, gzip is fastest, bzip2 sits between them - on this small sample the differences are modest, and on a real backup they are not.

    file confirms what each actually is rather than trusting the extension, which matters because an archive named .tar.gz is not necessarily gzipped.

    And reading needs no flag:

    tar -tf gz.tar.gz
src/
src/f1.txt
--- tar detects the compression on read, no flag needed

    So tar -xf works. The compression flag is only needed when creating, and the exam phrasing "create a gzip-compressed archive" is asking for -z specifically.

    bash Example session 
    cd ~/arc && tar -czf gz.tar.gz src && tar -cjf bz.tar.bz2 src && tar -cJf xz.tar.xz src && ls -l plain.tar gz.tar.gz bz.tar.bz2 xz.tar.xz-rw-r--r--. 1 sysadmin sysadmin  9414 Aug 23 11:08 bz.tar.bz2-rw-r--r--. 1 sysadmin sysadmin  6845 Aug 23 11:08 gz.tar.gz-rw-r--r--. 1 sysadmin sysadmin 71680 Aug 23 11:08 plain.tar-rw-r--r--. 1 sysadmin sysadmin  5608 Aug 23 11:08 xz.tar.xzcd ~/arc && for f in gz.tar.gz bz.tar.bz2 xz.tar.xz; do printf '%-14s %s\n' "$f" "$(file -b $f | cut -c1-40)"; donegz.tar.gz      gzip compressed data, from Unix, originabz.tar.bz2     bzip2 compressed data, block size = 900kxz.tar.xz      XZ compressed data, checksum CRC64cd ~/arc && tar -tf gz.tar.gz | head -3; echo "--- tar detects the compression on read, no flag needed"src/src/f1.txtsrc/f2.txt--- tar detects the compression on read, no flag needed

    Expected resultFour archives of different sizes, and tar auto-detecting on read.

    Success conditionYou can pick a compressor and read any archive without knowing its format.

  3. Extracting where you meant to

    out/src/f1.txt
out/src/f2.txt
out/src/f3.txt

    -C changes directory before extracting, and it is the habit that prevents accidents. Without it, tar unpacks into the current directory, and an archive whose members are named etc/, home/ or .bashrc will happily overwrite what is already there.

    You can also pull one member out:

    tar -xf gz.tar.gz -C out src/f1.txt

    naming the path exactly as -t printed it. That is why listing first matters - the member name must match, and it will not be the absolute path you archived.

    bash Example session 
    cd ~/arc && mkdir -p out && tar -xf gz.tar.gz -C out && find out -type f | sortout/src/f1.txtout/src/f2.txtout/src/f3.txtcd ~/arc && tar -xf gz.tar.gz -C out src/f1.txt && ls -l out/src/f1.txt-rw-r--r--. 1 sysadmin sysadmin 20000 Aug 23 11:08 out/src/f1.txt

    Expected resultA whole archive and then a single member, both extracted into out.

    Success conditionYou extract into a directory you chose.

  4. The leading slash

    Archive two absolute paths and tar says something:

    tar: Removing leading `/' from member names
tar: Removing leading `/' from hard link targets

    That is not a warning to skim. Look at what was stored:

    etc/hostname
etc/hosts

    Relative paths. So extraction lands wherever you are standing:

    absout/etc/hostname
absout/etc/hosts

    The files went to absout/etc/, not to /etc/. This is deliberate and it is a safety feature - an archive of /etc cannot silently overwrite the real /etc just by being unpacked.

    The consequence for restoring a backup: you must extract from / to put files back where they came from, sudo tar -xf backup.tar -C /. Doing that from the wrong directory is how people restore a backup into their home directory and wonder why nothing changed.

    bash Example session 
    cd ~/arc && tar -cf abs.tar /etc/hostname /etc/hosts 2>&1 | head -2tar: Removing leading `/' from member namestar: Removing leading `/' from hard link targetscd ~/arc && tar -tf abs.taretc/hostnameetc/hostscd ~/arc && mkdir -p absout && tar -xf abs.tar -C absout && find absout | sortabsoutabsout/etcabsout/etc/hostnameabsout/etc/hosts

    Expected resultAbsolute paths stored relative, and extracting under the current directory.

    Success conditionYou know where a restored backup will actually land.

  5. gzip and bzip2 without tar

    The objective names them separately because they work on single files, and they behave in a way that surprises people:

    -rw-r--r--. 1 sysadmin sysadmin 20000 solo.txt
-rw-r--r--. 1 sysadmin sysadmin   ... solo.txt.gz
--- note the ORIGINAL is gone

    gzip replaces the file. There is no solo.txt any more - it became solo.txt.gz. gunzip reverses it. That is the opposite of tar, which leaves its input alone, and it is why compressing a file you have not backed up feels alarming the first time.

    -k keeps the original:

    solo.txt
solo.txt.bz2

    And both have a read-without-unpacking form - zcat for gzip, bunzip2 -c (or bzcat) for bzip2. Combined with a pipe that lets you inspect a compressed archive without ever writing it to disk, which on a machine short of space is the only way.

    bash Example session 
    cd ~/arc && cp src/f1.txt solo.txt && ls -l solo.txt && gzip solo.txt && ls -l solo.txt.gz; echo "--- note the ORIGINAL is gone"-rw-r--r--. 1 sysadmin sysadmin 20000 Aug 23 11:08 solo.txt-rw-r--r--. 1 sysadmin sysadmin 6085 Aug 23 11:08 solo.txt.gz--- note the ORIGINAL is gonecd ~/arc && gunzip solo.txt.gz && ls -l solo.txt-rw-r--r--. 1 sysadmin sysadmin 20000 Aug 23 11:08 solo.txtcd ~/arc && bzip2 -k solo.txt && ls -l solo.txt solo.txt.bz2; echo "--- -k keeps the original"-rw-r--r--. 1 sysadmin sysadmin 20000 Aug 23 11:08 solo.txt-rw-r--r--. 1 sysadmin sysadmin  6424 Aug 23 11:08 solo.txt.bz2--- -k keeps the originalcd ~/arc && zcat gz.tar.gz | tar -tf - | head -2; echo "--- and reading without extracting:"; bunzip2 -c solo.txt.bz2 | head -2src/src/f1.txt--- and reading without extracting:108010-point

    Expected resultgzip consuming its input, -k preserving it, and reading without unpacking.

    Success conditionYou will not lose a file to gzip.

  6. Preserving permissions and contexts

    -rw-r--r-- sysadmin/sysadmin ... src/f1.txt

    -p preserves permissions, and on RHEL the flags that matter beyond that are --selinux --acls --xattrs. Without them an archive of a directory with SELinux contexts restores files that are labelled wrong, and on a machine with SELinux enforcing that means services cannot read them - a failure that looks like a permissions problem and is not.

    -v prints members as it works, which is worth having on a long archive so you can see it progressing.

    For the exam: tar -czvf name.tar.gz /path to create, and tar -xvf name.tar.gz -C /dest to extract, are the two commands to have in your fingers. Everything else can be looked up.

    bash Example session 
    cd ~/arc && sudo tar -cpf perms.tar --selinux --acls --xattrs src && sudo tar -tvf perms.tar | head -3drwxr-xr-x sysadmin/sysadmin 0 2026-08-23 11:08 src/-rw-r--r-- sysadmin/sysadmin 20000 2026-08-23 11:08 src/f1.txt-rw-r--r-- sysadmin/sysadmin 20000 2026-08-23 11:08 src/f2.txtcd ~/arc && tar -czvf verbose.tar.gz src 2>&1 | head -4src/src/f1.txtsrc/f2.txtsrc/f3.txt

    Expected resultAn archive carrying permissions, and verbose output.

    Success conditionYou can archive a directory without losing its SELinux labels.

Troubleshooting

Official sources

← All RHCSA guides