.gz files can sneak in if it shows up as a rename event in the filesystem. We don't look at those, we look at the current live access.log file