LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-15-2007, 10:48 AM   #1
sethsark
LQ Newbie
 
Registered: Nov 2007
Posts: 4

Rep: Reputation: 0
Does Linux keep a changed file log?


I need to know which files in multiple folders have been changed within a specified time period. I only know how to access Linux via putty, so please be specific if you can help.

Thank you in advance-
~c
 
Old 11-15-2007, 11:33 AM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Hi, and welcome to LQ!
Quote:
Does Linux keep a changed file log?
The quick answer is no.

The ellaborate answer is: you can make it do that. But
it can become a rather costly operation on a busy machine.

If you don't need a log you can easily use find to check
for times modification times.

e.g. find -mtime -5 -mtime +2
will list anything that was modified in between 5
and 2 days ago.




Cheers,
Tink

Last edited by Tinkster; 11-15-2007 at 11:36 AM.
 
Old 11-15-2007, 12:26 PM   #3
sethsark
LQ Newbie
 
Registered: Nov 2007
Posts: 4

Original Poster
Rep: Reputation: 0
Thank you! The files I am looking for (testing purposes) are not showing, but I am getting a good list (which is all that is needed for my usual purpose).
My new question is: How do I get just the last day? I changed the comment to find -mtime -5 -mtime +0 but it still is not showing my test file. Is it possible to get recent results?
 
Old 11-15-2007, 01:09 PM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
-mtime -1 by itself should do the trick. You need to bear in mind that it
will always compare against the current timestamp, and go back 24 hours.
If that's not the granularity you're after have a look into mmin instead,
which will look at the passed minutes.

What file-system is that machine using?



Cheers,
Tink
 
Old 11-15-2007, 01:17 PM   #5
sethsark
LQ Newbie
 
Registered: Nov 2007
Posts: 4

Original Poster
Rep: Reputation: 0
Thank you very much! One more question: Does this show only those files modified or does it also show files added or removed (or one or the other)?
I'm guessing only those modified...
 
Old 11-15-2007, 01:25 PM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Creating a new file is a modification (if you think about it - it can't have a
modify time-stamp that's older than the file's creation time). So a file
newly created should show up as well.



Cheers,
Tink
 
Old 11-15-2007, 01:37 PM   #7
sethsark
LQ Newbie
 
Registered: Nov 2007
Posts: 4

Original Poster
Rep: Reputation: 0
Awesome! Thanks so much for your help!!! I'm also assuming from your last comment about time stamps that files deleted would not be included because there is no time stamp.

I really appreciate you "dumbing it down".
 
Old 11-15-2007, 01:48 PM   #8
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
You're most welcome. And you're right - a deleted file doesn't have any allocated
inodes, and hence doesn't have time-stamps. In other words: with plain OS means
you can't find out whether a file has been deleted.

For that kind of thing you could use programs like AIDE or tripwire, which watch
for changes based on a schedule (e.g. every 30 minutes). You could use samhain
which allows for real-time monitoring (I think it does - been a while that I last
looked into it because it was quite heavy on CPU) or build your own based on e.g.
the dazuko library.

If that's more than you asked for, and you're not really after intrusion detection,
you could use a simple cron-job to take a directory listing every minute, compare
it against the previous run and notify you of changes. The greatest short-coming
of this would be the 1-minute granularity. In other words if something got created
and deleted within the 1-minute time-frame you'd never know about it.



Cheers,
Tink
 
Old 11-15-2007, 05:32 PM   #9
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,357

Rep: Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367Reputation: 2367
If you want real-time, I believe this is what you need: http://www-128.ibm.com/developerwork...l-inotify.html
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
any ideas to reduce log file size or make log file size managed? George2 Programming 2 08-13-2006 06:55 AM
Log out has changed royeo Linux - Newbie 2 08-04-2006 11:17 PM
I changed a file now I can't log in trappleye Linux - General 3 07-17-2006 01:50 PM
we changed permissions on the etc directory and now we can not log in vinces39 Red Hat 1 06-18-2004 10:20 AM
Wow, I changed my resolution now i cant log in! chornobyl Linux - Software 2 01-24-2004 02:06 PM


All times are GMT -5. The time now is 04:37 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration