2

If I run a command in bash, is there any way to determine which files and directories were modified as a result of running that command?

For example, if i run:

export $MYDIR="/home/users/myuser/"
touch $MY_DIR/*

I would like to be able to list the files that were modified:

/home/users/myuser/file1
/home/users/myuser/file2
/home/users/myuser/file3

But not specifically for touch. I would like the solution to be general for any command.

Is this possible?

moebius
  • 123

2 Answers2

2

There are a couple of tools which I quite like for this kind of use case:

  • maybe will run a command, but fake any modification to the file system (pretend it succeeded without performing it, and log it), then display a list of all the changes; you can then decide whether to run the command again — it’s not perfect, see the list of issues, but it’s good enough in many cases;
  • LoggedFS provides a logging file system overlay, which lets all changes to a file system go through but logs them, in a configurable manner (see LoggedFS configuration file syntax for details).

Other tools commonly used to trace file system operations include inotifywait and auditd; see Linux file access monitoring for details.

Stephen Kitt
  • 434,908
1

For a basic / simplistic solution, how about creating a file first, and then, after your operation, running a find to display files newer than said file ?

touch /tmp/myfile
( do stuff )
find ${MY_DIR} -newer /tmp/myfile

As @roaima points out, this only address your "which files and directories were modified as a result" requirement : it would not identify files that were removed.

steve
  • 21,892
  • 1
    You'd need a "before and after" to catch a tool that removed files – Chris Davies Aug 21 '18 at 08:18
  • Note that it's zsh syntax. With bash (see tag in OP's question), you'd need find "$MY_DIR". find ${MY_DIR} would only make sense in bash if $MY_DIR was meant to contain a $IFS-separated list of file patterns that you intended to expand. (:-b) – Stéphane Chazelas Aug 27 '18 at 18:18