Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After installing an update/a new package there seems to be no standarized way to explore the changes made to the file system. A simple utililty creating a filelist of the whole system before and after installing something would help a lot, since diffing the two file lists would reveal the changes made to the file system. It would be also a great tool to detect which config files are modified by a particular gui settings panel. What's the most effective way to solve this problem?

Thanks for your help.

share|improve this question

Most package managers will tell you exactly what files they installed:

dpkg -L <pkgname>
rpm -ql <pkgname>

This won't, however, tell you anything about modifications their postinstall scripts may have made. I would argue that actually trying to diff a filesystem snapshot after install is overkill. There are a number of tools for tracking file access that may be of help.

  • InstallWatch will track filesystem changes during an install.
  • Any host-based intrusion detection system will complain loudly after installing a package. I use samhain.
  • The kernel's audit interface can be set to track this stuff for you.
share|improve this answer

How to Set Up and Use Tripwire.
Tripwire uses a checksum list of critical files to detect Intrusions.

You could use something similar
(either Tripwire itself or a script that generates checksums of files
before and after your change activity)

MD5 checksums are quite fast and already available as md5sum.

share|improve this answer

Find what's been modified:
In addition to what Instyle said, you could also use find to locate files modified in the past say 10 minutes:

find / -mmin -10

Revision control:
You could also put /etc under version control with subversion. Here is a blog entry about that.

You also could use lvm snapshots, this might be overkill to however.

share|improve this answer

if you are Debian/Ubuntu user try etckeeper

share|improve this answer

I'll come at this from another angle, since you didn't say exactly who you would be modifying the systems. Depending on your environment, maybe the right solution is not to allow changes to occur on the local system. Using a configuration management system like puppet in conjunction with revision control, all the changes would be recorded on a central system, and then applied as appropriate.

share|improve this answer

There is many such utilities. I use afick.

share|improve this answer
not helpful. only tell us about the Changes, but not about which process/user/script did the change – Farhan Oct 16 '12 at 15:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.