0

I need to find out what changes are being made by a Linux program running on Centos 7.4 so that I can automate the changes. The program asks for user input that I can't easily replicate in an automated system.

Is there a way I can find out what file / directory modifications a program performs?

  • What would you do if part of the user input (that you can't replicate) was response to a question Update file system y/n?? It isn't clear if you want to know what files it (might) update, or what data it (might) change or if it would (for example) under some user entered condition send an email. I think it is too vague to answer as it is (and in the case the updates made are dependent on user input possibly impossible to answer) - perhaps you could add some more detail. – lx07 Mar 15 at 14:59
1

You can find out which files a program is accessing for read or write operations using strace:

strace -e open ${PROGRAM}

For example:

$ strace -e open touch thing
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/librt.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("thing", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
0

what I've done in the past is use find /somedir -ls and save the output. Later, after the program runs, issue the same command and compare.

# find /tmp/home -ls
   393227      4 drwxrwxr-x   3 root     root         4096 Mar 15 13:21 /tmp/home
   393236      4 -rw-------   1 nobody   nogroup      3323 Mar 15 13:14 /tmp/home/tmp.xRG2C4xlY8
   393235      4 -rw-------   1 nobody   nogroup      2682 Mar 15 13:14 /tmp/home/tmp.TISDeEMGWH
   393230      8 -rw-------   1 nobody   nogroup      6548 Mar 15 13:14 /tmp/home/tmp.8LsD1tXBcr
   393237      8 -rw-------   1 nobody   nogroup      4799 Mar 15 13:14 /tmp/home/tmp.ZBbC7t3cOq
   393228      0 -rw-------   1 nobody   nogroup         0 Mar 15 13:14 /tmp/home/tmp.1h4XseOLN6
   393238      4 drwxrwxr-x   2 www-data www-data     4096 Mar 15 13:21 /tmp/home/bin
   393247      4 -rw-------   1 www-data www-data     3323 Mar 15 13:14 /tmp/home/bin/tmp.xRG2C4xlY8
   393244      4 -rw-------   1 www-data www-data     4062 Mar 15 13:14 /tmp/home/bin/tmp.r6NOlfBC82
   393242      8 -rw-------   1 www-data www-data     7000 Mar 15 13:14 /tmp/home/bin/tmp.LvCMFtnpCy
   393241      8 -rw-------   1 www-data www-data     6548 Mar 15 13:14 /tmp/home/bin/tmp.8LsD1tXBcr
   393243      0 -rw-------   1 www-data www-data        0 Mar 15 13:14 /tmp/home/bin/tmp.mhBkDbIVvR
   393234      4 -rw-------   1 nobody   nogroup       933 Mar 15 13:14 /tmp/home/tmp.rFQNEwUlR2
   393232      0 -rw-------   1 nobody   nogroup         0 Mar 15 13:14 /tmp/home/tmp.mhBkDbIVvR

If you want to track changed file contents, look into sha1sum. You can save the output it generates to use as a source to compare the contents later. One drawback is that it won't detect new files. It will only tell you what's modified or deleted.

# find /tmp/home -type f -exec sha1sum '{}' \; 
d8133c17ae746cc60deaefd4030a7bf96b2f1370  /tmp/home/tmp.xRG2C4xlY8
0c71d55833cd2367f05004b02ca66b96381c7917  /tmp/home/tmp.TISDeEMGWH
611131bb6b5e5089b04cb4a8e6b00f34c8065da4  /tmp/home/tmp.8LsD1tXBcr
27ad4649e2eec4ca60588eed88f3ca411907fb2f  /tmp/home/tmp.ZBbC7t3cOq
da39a3ee5e6b4b0d3255bfef95601890afd80709  /tmp/home/tmp.1h4XseOLN6
d8133c17ae746cc60deaefd4030a7bf96b2f1370  /tmp/home/bin/tmp.xRG2C4xlY8
9b1c0004dbd92c6c87fe6eec90f3b7926326855b  /tmp/home/bin/tmp.r6NOlfBC82
a69ee2ae248b234ee218606140bd025b9581934f  /tmp/home/bin/tmp.LvCMFtnpCy
611131bb6b5e5089b04cb4a8e6b00f34c8065da4  /tmp/home/bin/tmp.8LsD1tXBcr
da39a3ee5e6b4b0d3255bfef95601890afd80709  /tmp/home/bin/tmp.mhBkDbIVvR
4054b99cb44526cb04c913e29513975688f11714  /tmp/home/tmp.rFQNEwUlR2
da39a3ee5e6b4b0d3255bfef95601890afd80709  /tmp/home/tmp.mhBkDbIVvR

If you save that output:

# find /tmp/home -type f -exec sha1sum '{}' \; > /tmp/my_sums

and want to check these files later (after tmp.1h4XseOLN6 has been modified):

# sha1sum -c /tmp/my_sums 
/tmp/home/tmp.xRG2C4xlY8: OK
/tmp/home/tmp.TISDeEMGWH: OK
/tmp/home/tmp.8LsD1tXBcr: OK
/tmp/home/tmp.ZBbC7t3cOq: OK
/tmp/home/tmp.1h4XseOLN6: FAILED
/tmp/home/bin/tmp.xRG2C4xlY8: OK
/tmp/home/bin/tmp.r6NOlfBC82: OK
/tmp/home/bin/tmp.LvCMFtnpCy: OK
/tmp/home/bin/tmp.8LsD1tXBcr: OK
/tmp/home/bin/tmp.mhBkDbIVvR: OK
/tmp/home/tmp.rFQNEwUlR2: OK
/tmp/home/tmp.mhBkDbIVvR: OK
sha1sum: WARNING: 1 computed checksum did NOT match

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.