This is generally the method I use, especially if the command you take results in a file being created as a side effect For example disabling or enabling sites in Debian's apache2 package removes or creates links in
/etc/apache2 which you can test for using
A trick is to set an attribute after the execute resource has run:
execute "test" do
command "touch /tmp/foo"
ruby_block "did_test" do
node.normal["did_test"] = true
Note that it's still possible for the execute resource to be run twice in some situations so this technique isn't perfect, but you can now use knife-search to determine which nodes have performed the execute.