1

I have a machine that is not in use and I wish to do a clean install of Linux on the machine. There may be important files on the machine.

How do you list all files created by the user after a clean install?

I was thinking of doing a simple find all files in / and then for loop to iterate followed by rpm -q --whatprovides to list all files that a user created (I.e not listed in any rpm's manifest). I think this would work... But it may be extremely slow and take more than 8 hours. I'll have to try.

I listed rpm but I think this also applies to any Linux distro... But I need a rpm solution first in the short term.

Trevor Boyd Smith
  • 3,772
  • 12
  • 36
  • 44

2 Answers2

3

rpm -qla will quickly list all the files coming from rpms. You can sort both lists and compare them with comm. However, what about config files from rpms that have been edited by the user, e.g. /etc/exports. You can use rpm -qVa to verify if installed files have changed, but it will ignore files that are destined to change e.g. /etc/shadow. It is usually a good idea to keep a copy of the whole of /etc just in case. You still have specific packages to worry about, e.g. mysql and files in /var ...

meuh
  • 49,672
  • 2
  • 52
  • 114
  • `comm`? Don't you mean `diff`? If you do mean `comm`, why? – Trevor Boyd Smith Nov 04 '16 at 11:24
  • `comm` is simpler than `diff`. `comm a b` will output 3 columns: lines only in a, only in b, and in common. The files must be sorted. You can suppress the 2nd and 3rd column with `-23`, and so have immediately all the lines only in `a`, where you should in your case put the list from `find`. – meuh Nov 04 '16 at 14:29
  • i tried out `comm` and IMO it is definitely the way to go. it's exactly like you said `diff` could probably be used... but would require a huge effort to make the output useful... where as `comm` is immediately useful. in my case i did exactly as you said and suppressed two of the three columns. – Trevor Boyd Smith Nov 04 '16 at 14:58
2

Two ways, depending on what you need:

  • You could use the ctime (change-time) of files with the find command to find those which are recently changed, and from that the corresponding packages. That can locate files which are not part of packages, e.g., if you find files under /var.

  • You could use rpm -qai to get the install-dates for all packages, and obtain a report of those which were installed recently, and from that list, using rpm -ql, list the files for each package which were installed.

    For example, CentOS: List the installed RPMs by date of installation/update? points out that the --last option sorts the list from rpm -qa by date, and you would only have to filter the list to limit the packages according to when you did the initial install.

Community
  • 1
Thomas Dickey
  • 75,040
  • 9
  • 171
  • 268