Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Linux environment sometimes I need to run a script as root which will add/modify serveral files on my fs.

Basically I'd like to know exactly which files are modified and how WITHOUT opening the script and trying to guess the code.

I was thinking about using something like unionfs: the main fs would be accessible in readonly mode and all changes are written on a file used as a partition and "mounted" in write mode.

Are there other ways to achieve the same goal (i.e. other than unionfs)?

share|improve this question
add comment

5 Answers

up vote 1 down vote accepted

An example for the LVM solution mentioned before.

Caveat: The filesystem you want to diff has to be on a lvm logical volume! (And you have to have some free space on disk.)

# lvcreate --size 2G --name your-fs-snapshot --snapshot /dev/vg0/your-fs 
  Logical volume "your-fs-snapshot" created

This takes a snapshot of /dev/vg0/your-fs at that moment. Then, do the changes you want to have recorded.

You can mount your snapshot as a copy of your-fs in the original state and diff with the tool of your choice, e.g. diff.

# mount /dev/vg0/your-fs-snapshot /mnt
# diff -q /original/volume/subdir /mnt/subdir

Do not forget to unmount and remove your snapshot, since while doing this, changes to the original volume are recorded as reverse diffs to the snapshot - until that fills up.

# umount /mnt
# lvremove /dev/vg0/your-fs-snapshot 
Do you really want to remove active logical volume your-fs-snapshot? [y/n]: y
  Logical volume "your-fs-snapshot" successfully removed

Hint: If your logical volume contains a partition-table, you can add device entries via:

# kpartx -av /dev/vg0/your-disk-snapshot
share|improve this answer
add comment

You can create a LVM snapshot, then mount the snapshot, run the script, then do a diff between the snapshot and the original.

share|improve this answer
    
how can I create a LVM snapshot? Can you provide a link? –  Emiliano Jan 13 '11 at 13:23
    
A google search for "lvm snapshot" would get you there, but here you go: tldp.org/HOWTO/LVM-HOWTO –  larsks Jan 13 '11 at 13:55
add comment

Before today's fancy snapshotting and tracing technologies, people solved this problem through clever use of the LD_PRELOAD environment variable, which lets you override C library functions with your own replacements (called function interposition). In this situation, you would wrap the open() system call, and when files are opened for writing you could:

  • Preserve the original (e.g., with a .bak extension or something)
  • Allow the installer to replace it
  • Produce a diff of the original vs. the modified version.

The installwatch program is one example of this sort of thing. There are many other examples of this sort of solution, and there are also lots of other ways of using LD_PRELOAD to modify the behavior of binary programs.

share|improve this answer
add comment

This sounds like something that systemtap may be good at. Here's a blog post where someone wrote a systemtap script which will print out every file a user opens. One thing to keep in mind is that it's not specific to a process, so if you're running the script as a user who is doing a lot of other things, this may be pretty noisy; some modifications may be required. Though, it's a start.

share|improve this answer
    
Looking through the code, it may be pretty easy to modify it to lock onto a given pid instead of a uid. –  mkomitee Jan 13 '11 at 13:29
add comment

You might also want to look into inotify, which will allow you to monitor filesystem events as they occur. It's similar to OS X's fsevent framework. Most distros will have an inotify-tools package.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.