Re: How do I trace changes in configuration files?

[Lee <ler762@gmail.com>]

On 5/2/19, David Wright <deblis@lionunicorn.co.uk> wrote:
> On Thu 02 May 2019 at 12:12:19 (-0400), Lee wrote:
>> On 5/1/19, David Wright wrote:
>> >
>> > As for finding where the information went, I sometimes use
>> > # find /boot /etc /home /lib /lib64 /var -type f -mmin -1440 -print |
>> > less #
>> > one day
>> > but changing 1440 to something more appropriate, like 10 (mins).
>>
>> You can use "find -newer" and not have to guess/remember how long ago
>
> Sure, but most people can think, "I did this since having lunch,
> so I know it was in the last 2 hours" ⇨ -mmin -150

^shrug^ whatever floats your boat.
  makets
  # do something
  find  ${HOME} -newer /tmp/timestamp
has been good enuf for my purposes.  ... well, almost enough.
Occasionally I'll use meld  (https://packages.debian.org/stretch/meld)
to take a quick look at what all changed between current & backed up
files.

cool script for finding files modified between certain times tho -
thanks for sharing!
Maybe someday I'll get up to that level :)

Lee

>> $ cat makets
>> #!/bin/sh
>> # create a timestamp file
>> #
>> # useful for finding files created after the timestamp
>> # eg. find files created/modified after timestamp
>> #   find  ${HOME} -newer /tmp/timestamp
>> # find all files created/modified after timestamp
>> #   find  /cygdrive/c -newer /tmp/timestamp
>>
>> TS=`date +%Y%m%d-%H%M`
>> #   20160225-0734
>>
>> touch /tmp/timestamp /tmp/timestamp-${TS}
>
> I prefer to have both bounds available:
>
> find-between ()
> {
>     [ -z "$3" ] && printf '%s\n' "Usage:        $FUNCNAME timedate timedate
> top-of-trees...
>         finds files under top-of-trees with modification timestamps between
>         the two timedates given (free format, in any order). The output is
>         piped through ls -l -t into less." 1>&2 && return 1;
>     local Timea="$(date --rfc-3339=seconds --date "$1")";
>     [ -z "$Timea" ] && return 2;
>     local Timeb="$(date --rfc-3339=seconds --date "$2")";
>     [ -z "$Timeb" ] && return 2;
>     shift 2;
>     [ "$Timea" = "$Timeb" ] && printf '%s\n' "Times are the same (one minute
> resolution)" && return;
>     [ "$Timea" \> "$Timeb" ] && local Swap="$Timea" && Timea="$Timeb" &&
> Timeb="$Swap";
>     printf '%s\n' "From $Timea to $Timeb";
>     local Unique="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date
> +%s)"-XXXX)";
>     local UniqueA="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date
> +%s)"-XXXX)";
>     local UniqueB="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date
> +%s)"-XXXX)";
>     touch -d "$Timea" "$UniqueA";
>     touch -d "$Timeb" "$UniqueB";
>     find "$@" -newer "$UniqueA" -a -not -newer "$UniqueB" -type f -print0 >>
> "$Unique";
>     [ -s "$Unique" ] && xargs -0 ls -l -t < "$Unique" | less;
>     rm "$UniqueA" "$UniqueB" "$Unique"
> }
>
> Cheers,
> David.