Re: How do I trace changes in configuration files?

[David Wright]

On Thu 02 May 2019 at 12:12:19 (-0400), Lee wrote:
> On 5/1/19, David Wright wrote:
> >
> > As for finding where the information went, I sometimes use
> > # find /boot /etc /home /lib /lib64 /var -type f -mmin -1440 -print | less #
> > one day
> > but changing 1440 to something more appropriate, like 10 (mins).
> 
> You can use "find -newer" and not have to guess/remember how long ago

Sure, but most people can think, "I did this since having lunch,
so I know it was in the last 2 hours" ⇨ -mmin -150

> $ cat makets
> #!/bin/sh
> # create a timestamp file
> #
> # useful for finding files created after the timestamp
> # eg. find files created/modified after timestamp
> #   find  ${HOME} -newer /tmp/timestamp
> # find all files created/modified after timestamp
> #   find  /cygdrive/c -newer /tmp/timestamp
> 
> TS=`date +%Y%m%d-%H%M`
> #   20160225-0734
> 
> touch /tmp/timestamp /tmp/timestamp-${TS}

I prefer to have both bounds available:

find-between () 
{ 
    [ -z "$3" ] && printf '%s\n' "Usage:        $FUNCNAME timedate timedate 
top-of-trees...
        finds files under top-of-trees with modification timestamps between
        the two timedates given (free format, in any order). The output is
        piped through ls -l -t into less." 1>&2 && return 1;
    local Timea="$(date --rfc-3339=seconds --date "$1")";
    [ -z "$Timea" ] && return 2;
    local Timeb="$(date --rfc-3339=seconds --date "$2")";
    [ -z "$Timeb" ] && return 2;
    shift 2;
    [ "$Timea" = "$Timeb" ] && printf '%s\n' "Times are the same (one minute 
resolution)" && return;
    [ "$Timea" \> "$Timeb" ] && local Swap="$Timea" && Timea="$Timeb" && 
Timeb="$Swap";
    printf '%s\n' "From $Timea to $Timeb";
    local Unique="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date +%s)"-XXXX)";
    local UniqueA="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date +%s)"-XXXX)";
    local UniqueB="$(mktemp ${Uniquetrash:-/tmp}/$FUNCNAME-"$(date +%s)"-XXXX)";
    touch -d "$Timea" "$UniqueA";
    touch -d "$Timeb" "$UniqueB";
    find "$@" -newer "$UniqueA" -a -not -newer "$UniqueB" -type f -print0 >> 
"$Unique";
    [ -s "$Unique" ] && xargs -0 ls -l -t < "$Unique" | less;
    rm "$UniqueA" "$UniqueB" "$Unique"
}

Cheers,
David.