Thanks for info, although the audit system seems a lot more complex than what I need. Would still be nice if they fixed bart to work on large filesystems, though.
Turns out the solution was right under my nose -- rsync in dry-run mode works quite well as a "snapshot diff" tool. I'll share this with the list, in case it helps anyone else. For example: rsync -avn --delete-before /export/ims/.zfs/snapshot/zfs-auto-snap_daily-2009-11-09-1900/ /export/ims/.zfs/snapshot/zfs-auto-snap_daily-2009-11-08-1900/ This makes a list of what files have been changed, added, or deleted between these two snapshots, and runs in about 10 seconds. If you cared to see changes within files (I don't), it would be trivial to add a loop along the lines of '$rsync_cmd | while read file; do diff $snap1/$file $snap2/file; done'. Note the trailing slashes (otherwise rsync works one directory higher and considers the snapshot directory name, which we don't want) and that the newer snapshot is the "source" and the older snapshot, the destination. I'm [ab]using rsync to have it tell me exactly how it would make the "destination" be a replica of the "source". FWIW, I'm using rsync 3.0.6 from opencsw. Older rsync should work fine but may take longer to run. -Andrew >>> Richard Elling <richard.ell...@gmail.com> 11/9/2009 7:33 PM >>> Seems to me that you really want auditing. You can configure the audit system to only record the events you are interested in. http://docs.sun.com/app/docs/doc/816-4557/auditov-1?l=en&a=view -- richard _______________________________________________ zfs-discuss mailing list zfs-discuss@opensolaris.org http://mail.opensolaris.org/mailman/listinfo/zfs-discuss
