0

I'm evaluating a tool and I need to identify all files (including system config files) added, changed or removed by this application (it is installed using pip).

After installing on a external host, I'll track all the changes to bring the application to a different with the help of those tracked changes.

Note that I'm not looking for application or install logs, I'm looking for the changes made by this install and its application.

This can also be an useful scenario to audit the impact of any application being evaluated.

One possible solution is using fswatch (https://www.ostechnix.com/monitor-file-changes-using-fswatch-linux/), but it is not able to monitor the root directory.

A good decade ago, there was a tool for Windows called Norton CleanSweep (https://en.wikipedia.org/wiki/Norton_CleanSweep), that monitored a install app and tracked all files and registry entries added by this install to allow full deletion of this tracked install. That's exactly what I'm looking for, but for a unix box (Debian distros based would be the perfect one)

Any ideas on what can be used to track all changes in a unix host?

  • Using fswatch, could work, but apparently it's not able to watch the whole filesystem.: – Rafael Borja Mar 15 at 15:35
  • Using fswatch, could work, but apparently it's not able to watch the whole filesystem. sudo fswatch -r --monitor=inotify_monitor --batch-marker --exclude=/tmp/* --exclude=/lib/modules/.*-aws.* --exclude=///lib/terminfo.* --exclude=/dev/pts.* -r -x --event=Created --event=Updated --event=Created MovedTo --event=Removed --event=MovedTo /bin /dev /etc /home /root /sbin /usr /var – Rafael Borja Mar 15 at 15:35
0

Since fswatch could not handle the amount of operations properly when root directory is provided, inotifywait (https://linux.die.net/man/1/inotifywait) can be used.

It wait for changes to files using inotify. The following command can be used:

sudo inotifywait -m -r --exclude "(/tmp.*|/var/cache.*|/dev/pts/|/var/log.*)"  -e MOVED_TO -e CREATE -e CLOSE_WRITE -e DELETE -e MODIFY -o /tmp/my_tracked_install_files /

Where

  • -m: Uses monitoring mode
  • -r: recursive path
  • --exclude uses a regex to not watch events on some directories (temp, log directories, and /dev/pts due to the amount of unnecessary changes on those directories)
  • -e MOVED_TO, CREATE, CLOSE_WRITE, DELETE, and MODIFY: The only events we are interested on (inotifywait captures all kind of filesystem events, including listing)
  • -o: output file

Please not that inotifywait does not capture nfs files written from other hosts.

It is very likely that you must increase the number of inotifywatches (as described in (https://stackoverflow.com/questions/535768/what-is-a-reasonable-amount-of-inotify-watches-with-linux)

cat /proc/sys/fs/inotify/max_user_watches # default is 8192
sudo sysctl fs.inotify.max_user_watches=1048576 # increase to 1048576

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.