On a Linux environment sometimes I need to run a script as root which will add/modify serveral files on my fs.

Basically I'd like to know exactly which files are modified and how WITHOUT opening the script and trying to guess the code.

I was thinking about using something like unionfs: the main fs would be accessible in readonly mode and all changes are written on a file used as a partition and "mounted" in write mode.

Are there other ways to achieve the same goal (i.e. other than unionfs)?


An example for the LVM solution mentioned before.

Caveat: The filesystem you want to diff has to be on a lvm logical volume! (And you have to have some free space on disk.)

# lvcreate --size 2G --name your-fs-snapshot --snapshot /dev/vg0/your-fs 
  Logical volume "your-fs-snapshot" created

This takes a snapshot of /dev/vg0/your-fs at that moment. Then, do the changes you want to have recorded.

You can mount your snapshot as a copy of your-fs in the original state and diff with the tool of your choice, e.g. diff.

# mount /dev/vg0/your-fs-snapshot /mnt
# diff -q /original/volume/subdir /mnt/subdir

Do not forget to unmount and remove your snapshot, since while doing this, changes to the original volume are recorded as reverse diffs to the snapshot - until that fills up.

# umount /mnt
# lvremove /dev/vg0/your-fs-snapshot 
Do you really want to remove active logical volume your-fs-snapshot? [y/n]: y
  Logical volume "your-fs-snapshot" successfully removed

Hint: If your logical volume contains a partition-table, you can add device entries via:

# kpartx -av /dev/vg0/your-disk-snapshot

You can create a LVM snapshot, then mount the snapshot, run the script, then do a diff between the snapshot and the original.

  • how can I create a LVM snapshot? Can you provide a link? – Emiliano Jan 13 '11 at 13:23
  • A google search for "lvm snapshot" would get you there, but here you go: tldp.org/HOWTO/LVM-HOWTO – larsks Jan 13 '11 at 13:55

Before today's fancy snapshotting and tracing technologies, people solved this problem through clever use of the LD_PRELOAD environment variable, which lets you override C library functions with your own replacements (called function interposition). In this situation, you would wrap the open() system call, and when files are opened for writing you could:

  • Preserve the original (e.g., with a .bak extension or something)
  • Allow the installer to replace it
  • Produce a diff of the original vs. the modified version.

The installwatch program is one example of this sort of thing. There are many other examples of this sort of solution, and there are also lots of other ways of using LD_PRELOAD to modify the behavior of binary programs.


This sounds like something that systemtap may be good at. Here's a blog post where someone wrote a systemtap script which will print out every file a user opens. One thing to keep in mind is that it's not specific to a process, so if you're running the script as a user who is doing a lot of other things, this may be pretty noisy; some modifications may be required. Though, it's a start.

  • Looking through the code, it may be pretty easy to modify it to lock onto a given pid instead of a uid. – mkomitee Jan 13 '11 at 13:29

You might also want to look into inotify, which will allow you to monitor filesystem events as they occur. It's similar to OS X's fsevent framework. Most distros will have an inotify-tools package.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.