Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to find all Debian managed configuration files which have been changed from the default?

share|improve this question
The question goes here. The answer goes below. – Dennis Williamson Dec 2 '09 at 22:29
I moved the answer you provided into your answer. – Zoredache Dec 2 '09 at 22:44

To find all Debian managed configuration files which have been changed from the default you can use a command like this.

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}'

Edit (works with localized systems):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}' | sort | less

Edit (works with packages with OK in the filename):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK$/{print $1}' | sort | less
share|improve this answer
Works like charm on Ubuntu 10.4, I would upvote you a thousand times:-) – Ludwig Weinzierl May 2 '10 at 19:30
works great. you could use md5sum --quiet though to avoid filtering OK files with awk (and thus the localization issues?). By the way: you don't know how to include untracked files within /etc? Like those in /etc/apache2/sites-available for instance? – sfussenegger May 31 '13 at 10:02
Would be interesting to know how my answer (debsums -ec) actually works, because it seems to get a lot less results than this. – naught101 Jul 21 '13 at 22:59
Also, apparently the only conf files are checked for package versions are then ones that come up in debsums -ec: if I use this method to re-instate package versions, then some of the files listed via this method aren't changed. – naught101 Jul 21 '13 at 23:20

from man debsums:

  debsums -ce
          List changed configuration files.
share|improve this answer
This is by far the simplest and best answer. – mfisch Dec 19 '13 at 15:53
Only debsums is not installed by default and you may not want to install it. – Alexis Wilke Jul 16 at 21:08
@AlexisWilke: it's 218kb and has minimal dependencies... – naught101 Jul 18 at 2:03

I generally like to setup etckeeper on the system pretty much immediately. With something like etckeeper I can find not only when the file is different, but I can actually get a diff of exactly how it is different.


share|improve this answer

Sorry to necro, but while @naught101's answer was correct for modified files, it didn't help for added files. @Graeme's solution is nice, but depends on etckeeper; I don't want to modify the filesystem.

find /etc -type f | grep -vFf <(debsums -e | sed 's/[[:space:]]*OK$//')

Find files in /etc/ that debsums does not report as valid. This means either untracked files or files that are not "OK" (hashes don't match).

share|improve this answer

Or debsums -e | grep FAILED which will also show all missing conffiles

(from the debsums package)

share|improve this answer

This departs a little from the original question in that it will also give ADDED config files as opposed to just those modified. Although files not included in any deb package will also be caught. Both behaviours may well be desirable.

It depends on having used etckeeper with git vcs ideally from the get go, although it should also work if you specifically add and commit previously changed files after the first commit. Note that one gotcha here is that Ubuntu configures etckeeper to use Bazaar by default (Canonical sponsor Bazaar), rather than the git default set by the etckeeper developers.

The idea is to get a list of all commits that aren't made automatically after and apt run. Then list the files changed in all but the very first commit:

filter_sed="/committing changes in \/etc after apt run\$/d"

etckeeper vcs log --oneline |
  sed "$filter_sed; \$d; s/ .*//" |
  xargs etckeeper vcs show --name-only --format=format: |
  sort |
  uniq |
  sed "/^\$/d"

The filter string could also be extended to encompass other commits if they are named consistently. Might be good for installs directly from a deb file or from source code.

A notable file that this picks up for me is my xorg.conf - you currently have to add this to /etc/X11 yourself if you need it. Also my default/grub changes are picked up, it seems this is copied from /usr/share by a post install script rather than being listed as part of a package. If a change has been made to a file like this, dpkg related methods won't reveal it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.