I often seem to be dealing with "almost virgin" Linux installations: VMs that were created for a purpose, used briefly, but after a while we're not sure exactly what's on it.
What I'd like to be able to do is quickly (in keystrokes, if not time) get a quick picture of what's happened on a box since creation. Basically that would mean:
- Packages installed since initial server creation
- Folders and files created by users (especially in places like /usr/local, but they could really be anywhere).
I'm not sure how to do either of these things. Particularly the 2nd one: what would be a good way to distinguish between files created as a normal part of system activity (logs, pid files...) and those that a user had expressly created?
I tried this*:
find / -printf '%p %u\n' 2>/dev/null | grep -E `users | tr ' ' '|'`
But that turns up a lot of uninteresting stuff in /proc. I guess I could narrow the search to just /home and /usr, but that might be too prescriptive.
Suggestions? Better ways?