Linux如何查看命令执行后哪些文件被修改了-工具盒子

示例

查看dnf makecache;命令修改了哪些文件

[root@dameng linuxscript]# T="$(date "+%F %T.%N")"; dnf makecache; find / -xdev -newermt "$T"
CentOS-8.5.2111 - Base - mirrors.aliyun.com                                                                                                                             279 kB/s | 3.9 kB     00:00    
CentOS-8.5.2111 - Extras - mirrors.aliyun.com                                                                                                                           119 kB/s | 1.5 kB     00:00    
CentOS-8.5.2111 - AppStream - mirrors.aliyun.com                                                                                                                        331 kB/s | 4.3 kB     00:00    
Metadata cache created.
/tmp
/var/log/dnf.log
/var/log/dnf.librepo.log
/var/log/dnf.rpm.log
/var/log/hawkey.log
/var/lib/rpm/__db.002
/var/lib/rpm/__db.001
/var/lib/rpm/__db.003
/var/cache/dnf
/var/cache/dnf/extras-e503dfa263573efa/repodata/86501a1d822eea269ca494f23adb73be14166b426a1a2bcdaaacf5cef2859b5e-primary.xml.gz
/var/cache/dnf/AppStream-c40f4caedb6d900a/repodata/d8472d61c5e53a3e9cbffb68e0dddbd04a07c2b7d864b07ddd211c6ad1380c6e-primary.xml.gz
/var/cache/dnf/base-c446c86678567d00/repodata/ca039bbfe8297c592cdc0e7251689f5d597771d39b2ddede01106ad0a7f0ba60-primary.xml.gz
/var/cache/dnf/expired_repos.json

验证

[root@dameng linuxscript]# T="$(date "+%F %T.%N")"; tarthis ;find / -xdev -newermt "$T"
/root/#linuxscript#-2024-12-16.tgz
/tmp
/usr/local/uniagent/log/uniagent.log
/var/log/hostguard/hostwatch.log

延伸方法

查看某脚本script.sh修改的文件

[root@dameng ~]# T="$(date "+%F %T.%N")"; ./script.sh; find / -xdev -newermt "$T"

例如：

[root@dameng linuxscript]# T="$(date "+%F %T.%N")"; ./file_size_distribution.sh /dmbak/; find / -xdev -newermt "$T"
From    To      Count                                                                                                                                                                                  

1KB	10KB	2
10KB	100KB	5
100KB	1MB	13
1MB	10MB	2
10MB	100MB	1
100MB	1GB	1

`Total: 281.9 MB in 24 files
/usr/local/hostguard/run/heartbeat.tick
/var/log/hostguard/containers.log
/var/log/hostguard/hostguard.log`

由于上述脚本file_size_distribution.sh没有操作文件的步骤，所以只列出了系统执行日志变化的文件。