Learn › RHCSA (EX200) › Exam Orientation + Essential Tools
tar - a hands-on Linux lab on a real virtual machine.
Create and extract tar archives on RHEL 10 for the EX200 file tasks. Create, list, and extract with -c -t -x and -f, three compressors (-z gzip, -j bzip2, -J xz), -C to land an extract in place, and file to prove the compression. The exam move: tar -cjf name.tar.bz2 dir.
The exam hands you a directory full of files and one sentence: pack it into a bzip2-compressed archive at a named path. It sounds like nothing. Then you type the command, mix up one letter, and the grader opens a file that is gzip when it asked for bzip2. Zero points on a task you knew.
The RHCSA (EX200) exam has two archive moves woven through its file tasks: build a compressed archive of a directory someone names, and extract an archive so its folders land exactly where they belong. One command does both. It is called tar, and by the end of this lesson the flags will not bite you.
The black boxes below are a practice terminal: a safe sandbox that checks only the one command each step teaches, so you cannot break anything. The outputs shown are a real capture from a RHEL 10 machine. A few values, like the size number inside a gzip file, are computed per archive and will read differently when you build your own. Those are flagged where they appear.
tar is short for tape archive, a name from the era when backups went to tape. What it does today is simple: it takes many files and folders and bundles them into a single file, called an archive or a tarball. Extracting reverses that, unpacking the archive back into the original files and folders.
Here is the part that trips people. tar by itself does not compress anything. It just glues files into one stream, so a plain .tar is often bigger than the sum of its parts, not smaller. Compression is a separate job you switch on with one flag. tar is the box; the compressor is the vacuum seal you choose to add.
Three ideas run through every tar command you will type:
You pick exactly one of those three per command, then pair it with -f and a filename. -f means file: it tells tar the next word is the archive name to read or write. Forget -f and tar reaches for an ancient tape device instead and appears to hang. Always include it.
Start with the plainest form so the compression is not yet in the way. Imagine a folder named notes and a file named report.txt in your current directory. You want them bundled into one file called work.tar.
The flags read left to right: c to create, f to name the file, then the archive name, then the things to pack. Say the shape out loud before you run it: create, file, work.tar, then notes and report.txt.
tar -cf work.tar notes report.txt
prompt: student@servera:~$ answer: tar -cf work.tar notes report.txt output: hint: You want to CREATE, so the first letter is c. Add f for the file name, then the archive name work.tar, then what to pack.
Nothing printed, and that is success. tar is silent when it works, the same quiet as cp or mv. It read notes and report.txt and wrote them both into work.tar. No compression happened yet: work.tar is a bundle, not a squeezed one. Next you add the seal.
Three compressors ship on RHEL 10, and tar reaches each with a single flag. Learn all three, because the exam names the one it wants:
Watch the case. Lowercase z is gzip, lowercase j is bzip2, and uppercase J is xz. A lowercase j where the task wanted J gives you bzip2 instead of xz, and the grader notices. This case slip is the single most common tar mistake on the exam.
Build a gzip archive of the same two items. Drop z into the create command and give the file the matching .tar.gz name so anyone can see at a glance what is inside:
tar -czf work.tar.gz notes report.txt
prompt: student@servera:~$ answer: tar -czf work.tar.gz notes report.txt output: hint: Take the create command and slide z in before f for gzip. Name the file work.tar.gz so the name matches the compression.
Silent again, and work.tar.gz now exists. The only change from the plain archive was one letter, z, and one honest file name. That is the whole pattern: c f builds a box, and a compressor letter tucked in front of f seals it. Swap z for j and you get bzip2; swap it for J and you get xz. Now do the bzip2 one, because that is the exact form the exam loves to ask for.
This is the sentence that shows up on the exam: create a bzip2-compressed archive of a named directory at a named path. The precise command is tar -cjf name.tar.bz2 dir. Read it as create, bzip2, file, then the target name, then the directory.
The way to never miss it: let the compressor the task names pick your letter. Task says bzip2, you reach for -j and end the name in .tar.bz2. Task says gzip, -z and .tar.gz. Task says xz, uppercase -J and .tar.xz. The flag and the extension always travel together.
Pack the notes directory into a bzip2 tarball:
tar -cjf work.tar.bz2 notes
prompt: student@servera:~$ answer: tar -cjf work.tar.bz2 notes output: hint: bzip2 is the lowercase j. The command is create, j, file, then the name work.tar.bz2, then the directory notes.
Never trust the name alone. A file called work.tar.bz2 could hold gzip data if you fumbled the flag, and the grader checks the real contents, not the label. The file command reads the first bytes of a file, its magic number, and tells you what it truly is. Run it against both archives you built.
file work.tar.gz work.tar.bz2
prompt: student@servera:~$ answer: file work.tar.gz work.tar.bz2 output: work.tar.gz: gzip compressed data, from Unix, original size modulo 2^32 10240 work.tar.bz2: bzip2 compressed data, block size = 900k
There is your proof. The first archive reports gzip compressed data and the second reports bzip2 compressed data. The label matched the reality because the flag matched the extension. This is the fastest check on the exam: build the archive, run file on it, and read the first two words to confirm you used the compressor the task asked for.
The trailing number in the gzip line, original size modulo 2^32 10240, is computed from the exact bytes of your archive, so it will differ when you pack your own files. The words that matter, gzip compressed data and bzip2 compressed data, are the identity, and those are what you confirm against the task.
Before you extract an archive onto a machine, it is worth seeing what is inside. Extracting blind can scatter files across your current directory or overwrite work. The list mode, t, prints every path in the archive without unpacking a single one. It is read-only and always safe.
Swap the c for t and keep -f and the name. Peek inside the bzip2 archive. Modern tar on RHEL 10 detects the compression on its own, so you do not even need to name the compressor to list:
tar -tf work.tar.bz2
prompt: student@servera:~$ answer: tar -tf work.tar.bz2 output: notes/ notes/inner.txt report.txt hint: List mode is the letter t. Keep f and the archive name: t, f, then work.tar.bz2. No extraction happens.
The listing shows the exact paths stored inside: the notes/ directory, the notes/inner.txt file within it, and report.txt at the top. That trailing slash on notes/ marks it as a directory, so you know the folder structure travels with the archive and will be rebuilt on extract. This is how you verify you packed the right things, and where they will land, before you commit to unpacking.
Extracting is the mirror of creating. Use x for extract, keep -f and the name, and tar rebuilds the files and their folders exactly as the listing showed. Run bare, it unpacks into your current directory, which is fine when you are standing where you want the files.
Often you want them somewhere specific. The -C flag, uppercase C for change directory, tells tar to move into a target directory first and unpack there, without you having to cd around. The exam leans on this: extract this archive into /opt/thing and keep its structure. That is -x, -f, the archive, then -C and the destination.
Extract the bzip2 archive into a directory called /tmp/restore, preserving the notes/ structure inside it:
tar -xf work.tar.bz2 -C /tmp/restore
prompt: student@servera:~$ answer: tar -xf work.tar.bz2 -C /tmp/restore output: hint: Extract is the letter x. Keep f and the archive name, then add -C and the destination /tmp/restore to unpack there instead of here.
Silent success once more, and /tmp/restore now holds notes/, notes/inner.txt, and report.txt, the same tree the listing promised. The -C /tmp/restore sent everything there instead of your current folder. tar recreates directories automatically, so the structure is preserved end to end. That is the second exam move complete: extract an archive and land it, whole, exactly where the task said.
The destination for -C must already exist. If /tmp/restore is missing, tar stops with Cannot open: No such file or directory. Create it first with mkdir -p /tmp/restore, then extract.
Scaffolding off. No command is printed this time. You have every piece.
The task hands you a directory named notes and asks for a bzip2-compressed archive of it, written to a file named work.tar.bz2 in your current directory. Pick the compressor letter the word bzip2 demands, match the extension, and remember -f before the name.
prompt: student@servera:~$ answer: tar -cjf work.tar.bz2 notes output: hint: bzip2 is the lowercase j, and it pairs with a .tar.bz2 name. Think create, the bzip2 letter, file, the name, then the directory.
That is the exam form exactly: tar -cjf work.tar.bz2 notes. Create with c, bzip2 with j, file with f, the honest .tar.bz2 name, then the directory to pack. If you paused and let the word bzip2 pull up the j, you used the same recall the real machine asks for. Run file work.tar.bz2 after and you would read bzip2 compressed data, the proof that seals the points.
You earned this cheat sheet. Every row is a form of tar you just ran:
The three compressors, one more time, because the case is what catches people: -z gzip, -j bzip2, -J xz. Flag and extension always travel together. Build the archive, then file it, and read the first two words to prove you used what the task named.
Add v for verbose any time you want tar to name each file as it works: tar -cvzf work.tar.gz notes. The v turns the silent run into a running list, handy when you want to confirm every file made it into the archive.
The practice terminal has shown you the shape of tar. Create with c, list with t, extract with x, always paired with -f and a name. You added compression with -z, -j, and -J, matched each to its extension, confirmed the result with file, and landed an extract exactly where you wanted with -C. Every one of those you typed yourself.
The Essential Tools module ends on one real RHEL 10 machine, the essential-tools capstone mission, and that is where you run tar for real. It boots just for you, with its own filesystem. It hands you objectives that use exactly what you drilled: pack a named directory into the compressed archive a task specifies, and extract an archive so its structure lands intact. One difference from here: the mission shows no commands. You read the objective, recall the flags, and type them. That recall is what makes the points stick on exam day.
Finish the other Essential Tools lessons, then go archive a real directory for yourself.
Practice Archives and Compression in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.