Is there a way of listing all the instances when a particular file was modified/edited?

Question

I currently have a file abc.txt. I am curious to know if it is possible to see all the instances when this file was edited, from the date it was created?

Q: How can I make it possible [if I would like] to see the backlog of date & time for when the contents of a particular file (abc.txt) was edited, from the terminal?

I am using Ubuntu 14.04.1 LTS

score 3 · Answer 1 · answered May 27 '15 at 01:38

This is not possible with native files in the filesystem. What you may be seeking is a version control system, like git (or svn, etc.), where users check files out and in, and all information about the activities and changes is stored in the database of the respective version control system.

score 2 · Answer 2 · edited Apr 13 '17 at 12:36

2

Most filesystems don't provide any means of doing this. There are a few different ways of tracking file changes on Unix/Linux systems though:

Log-structured filesystems, such as NILFS, track all changes as snapshots. These snapshots are preserved as long as possible (which depends on the nilfs_cleanerd settings and the amount of changes in the filesystems), and the snapshots available for a given file can be determined using lscp. This gives a (possibly partial) history of a file. Snapshots can be converted to checkpoints which are preserved.
Continuous backup systems regularly snapshot the files they keep track of. Most such systems are commercial; there's a list on Wikipedia of course. Dropbox and CrashPlan are two systems I know which go some way towards continuous backup; they don't track every single change but they do keep all the history of a given file.
As Janis mentioned, version control systems allow users to store a file's history, but the changes stored are generally voluntary (so a file's history only reflects the points where changes were stored, not the actual editing activity on the file). Some VCS wrappers can provide automation to a certain extent; etckeeper comes to mind: it automatically tracks changes every time a package management tool is used.

edited Apr 13 '17 at 12:36

Community

1

answered May 27 '15 at 04:56

Stephen Kitt

434,908

To add to the list, I believe that there are some fuse based versioning file systems (potentially using git underneath) – Stéphane Chazelas May 27 '15 at 09:23
You can also mount a svn repo over webdav with autoversioning upon writes – Stéphane Chazelas May 27 '15 at 09:23
You could use auditd to log all write/truncate/fallocate... system calls to the file (not operations over mmap though) – Stéphane Chazelas May 27 '15 at 09:23
beside nilfs2, zfs and btrfs could be used to take snapshots every few minutes. – Stéphane Chazelas May 27 '15 at 09:25
All good ideas, thanks @StéphaneChazelas. From experience though SVN auto-versioning over WebDAV generates too many commits to be workable (the file's history would be too difficult to understand). With ZFS or btrfs snapshots, is it possible to list snapshots where a given file changed? – Stephen Kitt May 27 '15 at 09:45

score 1 · Answer 3 · edited Apr 13 '17 at 12:36

This is not possible after the fact. “Normal” filesystems don't keep a log of the past versions of a file. All you can know is the last time the file was modified (that's the file's modification time, which is shown by ls -l and by most file managers). You can't find past versions or know when they were made unless the editor happened to leave a backup file behind.

The owner of the file can change the modification time, so it is not useful if you have security concerns and don't trust the author. Files have another timestamp, the ctime (inode change time), which cannot be set manually and is updated whenever the file is modified or moved or its metadata (including the modification time) is modified. So the ctime of a file shows that the current version of the file was created at that time at the latest (assuming you trust the system administrator). You can see the ctime with ls -lc.

If you want to record the activity around a file, you can use the same methods as for recording when a fle is accessed: an inotify watch, LoggedFS, audit rules, etc. All of these methods only record what happens once they've been set up.

If you want to keep track of the state of the file at certain dates, make backups.

If you want to automatically save all successive versions of a file, edit it via a CopyFS filesystem.

If you want to keep track of successive versions of the file in a convenient way, use a revision control system. This is a cooperative mechanism: versions are recorded when the person doing the modification decides to commit a new version.

Is there a way of listing all the instances when a particular file was modified/edited?

3 Answers3