How to find all Debian managed configuration files which have been changed from the default?

  • 2
    The question goes here. The answer goes below. Commented Dec 2, 2009 at 22:29
  • I moved the answer you provided into your answer.
    – Zoredache
    Commented Dec 2, 2009 at 22:44

7 Answers 7


To find all Debian managed configuration files which have been changed from the default you can use a command like this.

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}'

Edit (works with localized systems):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK/{print $1}' | sort | less

Edit (works with packages with OK in the filename):

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | LANG=C md5sum -c 2>/dev/null | awk -F': ' '$2 !~ /OK$/{print $1}' | sort | less

Edit (works independently of localization or filename)

dpkg-query -W -f='${Conffiles}\n' '*' | awk 'OFS="  "{print $2,$1}' | md5sum --quiet -c 2>/dev/null | cut -d : -f 1
  • Works like charm on Ubuntu 10.4, I would upvote you a thousand times:-) Commented May 2, 2010 at 19:30
  • 1
    works great. you could use md5sum --quiet though to avoid filtering OK files with awk (and thus the localization issues?). By the way: you don't know how to include untracked files within /etc? Like those in /etc/apache2/sites-available for instance? Commented May 31, 2013 at 10:02
  • 1
    Would be interesting to know how my answer (debsums -ec) actually works, because it seems to get a lot less results than this.
    – naught101
    Commented Jul 21, 2013 at 22:59
  • Also, apparently the only conf files are checked for package versions are then ones that come up in debsums -ec: if I use this method to re-instate package versions, then some of the files listed via this method aren't changed.
    – naught101
    Commented Jul 21, 2013 at 23:20
  • As an additional check to see what config changes might be pending or obsolete find /etc -type f \( -iname '*.ucf-dist' -o -iname '*.ucf-old' -o -iname '*.dpkg-old' -o -iname '*.dpkg-dist' \) -print | sort
    – sphakka
    Commented Oct 24, 2019 at 15:10

from man debsums:

  debsums -ce
          List changed configuration files.
  • 2
    This is by far the simplest and best answer.
    – mfisch
    Commented Dec 19, 2013 at 15:53
  • 2
    Only debsums is not installed by default and you may not want to install it. Commented Jul 16, 2016 at 21:08
  • 2
    @AlexisWilke: it's 218kb and has minimal dependencies...
    – naught101
    Commented Jul 18, 2016 at 2:03
  • 1
    Where have you been for the last decade?!?! I used to use rpm -Va on redhat systems a decade ago to do something similar. I've been needing this one. Thanks. Commented Dec 30, 2019 at 16:13
  • The two downsides for using debsums over the dpkg approach is that (a) debsums isn't installed by default (anywhere AFAIK); (b) it is much slower for some reason...
    – Guss
    Commented Apr 16 at 8:30

This finds both added and modified files in /etc:

find /etc -type f | grep -vFf <(debsums -e | grep OK$ | sed 's/[[:space:]]*OK$//') 

This finds all files in /etc, and then removes all from the list that debsums reports as valid (i.e. provided by packages). This means either untracked files or files that are not "OK" (hashes don't match).

  • One should also run debsums --list-missing to check if one or more packages are missing checksums of included files. Nowadays the output should be empty. Commented Sep 22, 2019 at 16:53

I generally like to setup etckeeper on the system pretty much immediately. With something like etckeeper I can find not only when the file is different, but I can actually get a diff of exactly how it is different.



Or debsums -e | grep FAILED which will also show all missing conffiles

(from the debsums package)


This might be overkill but since somebody mentioned etckeeper and while I was investigating that I came across this other gem that might be more useful if you are attempting to figure out things "after the fact".


Blueprint is a simple configuration management tool that reverse-engineers servers. It figures out what you’ve done manually, stores it locally in a Git repository, generates code that’s able to recreate your efforts, and helps you deploy those changes to production.

  • Not clear from their homepage (looks a bit outdated) if Python-3 is supported. Did anybody try?
    – sphakka
    Commented Oct 24, 2019 at 16:09
  • Judging from the GitHub repo last being active several years ago I wouldn't bet too much money on it working in Python3 out of the box, but it seems pretty well written, so it might not be a huge amount of effort to add in Python3 support.
    – dragon788
    Commented Oct 24, 2019 at 19:24

This departs a little from the original question in that it will also give ADDED config files as opposed to just those modified. Although files not included in any deb package will also be caught. Both behaviours may well be desirable.

It depends on having used etckeeper with git vcs ideally from the get go, although it should also work if you specifically add and commit previously changed files after the first commit. Note that one gotcha here is that Ubuntu configures etckeeper to use Bazaar by default (Canonical sponsor Bazaar), rather than the git default set by the etckeeper developers.

The idea is to get a list of all commits that aren't made automatically after and apt run. Then list the files changed in all but the very first commit:

filter_sed="/committing changes in \/etc after apt run\$/d"

etckeeper vcs log --oneline |
  sed "$filter_sed; \$d; s/ .*//" |
  xargs etckeeper vcs show --name-only --format=format: |
  sort |
  uniq |
  sed "/^\$/d"

The filter string could also be extended to encompass other commits if they are named consistently. Might be good for installs directly from a deb file or from source code.

A notable file that this picks up for me is my xorg.conf - you currently have to add this to /etc/X11 yourself if you need it. Also my default/grub changes are picked up, it seems this is copied from /usr/share by a post install script rather than being listed as part of a package. If a change has been made to a file like this, dpkg related methods won't reveal it.

  • 1
    FYI, git log now has a an --invert-grep option which allows filtering out uninteresting commits without the use of sed. Commented Sep 19, 2016 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .