Monitor changes to a directory tree without root access

Question

I had an incident recently where some files were accidentally deleted. These are files on a shared webhosting account (FreeBSD), but the directory tree is deep.

My inclination is to write something myself in PHP or Python that does this:

1. Scan each and every directory for the number of files contained in each
2. Store that data, probably in a MySQL database
3. Run a report daily that tells me where there's activity (so, I'd see that the uploads directory has 3 new files, or that the thumbnails directory has 10 fewer files in it, or even on a per-file basis tell me it's changed (maybe it takes a hash of each file and stores that?).
4. Run a daily cron job with the changes from the day before (or weekly cron job with changes from the week before, or whatever interval makes sense)

But I sense that this is something people have done before me. Does this exist and I just don't know it?

Answer 1

If you're only concerned with files being added or removed, you can use a combination of find and diff to monitor changes:-

find /some/dir -print > file-list.expected # baseline

  # Add/remove files

find /some/dir -print > file-list.current
diff file-list.expected file-list.current # look for changes

mv file-list.old file-list.new # update baseline (optional)

However, if you need (or want) to know if the contents of a file have changed, too, FreeBSD comes with a utility called [mtree][1] that can be used to report on any changes found between a directory hierarchy and an expected baseline:-

mtree -c -i -n -K cksum -p /some/dir > baseline.mtree # baseline

  # Add/remove/change files

mtree -f baseline.mtree -p /some/dir # look for changes
mtree -c -i -n -K cksum -p /some/dir > baseline.mtree # update baseline (optional)

For either method, it's might be prudent to make your baseline file immutable ("chflags uchg baseline.file"), which should help prevent accidental deletion of your files by anyone other than root (including yourself).