3

What is the best way of getting a list of all files which have been written to, since power on?

Is a simple find (with mtime) best for this, or are there other ways?

(find won't list files which are written to, then deleted.)

I'm using Ubuntu Linux 12.04, if that makes a difference.

fadedbee
  • 1,988
  • 4
  • 22
  • 33
  • Can you provide more information on what you're trying to do (and why)? I think that context will help in shaping an appropriate answer. – ewwhite Oct 07 '13 at 13:11
  • @ewwhite I'm installing Linux on (not from) USB flash and want to mount `tmpfs` (or physical HDDs) on frequently written paths, to prolong the media's life. I don't want the fuss of going fully read-only (`aufs`, etc.). – fadedbee Oct 07 '13 at 13:15
  • Auditing is your friend http://serverfault.com/questions/320716/find-out-which-process-is-changing-a-file/320718#320718 – user9517 Oct 07 '13 at 13:15
  • @chrisdew See, that's a very specialized use case, where the normal answers to run `auditd` may not make sense. Thanks for the clarification. You should add that to the initial question. – ewwhite Oct 07 '13 at 13:16

1 Answers1

3

I could answer this with special auditd rules tailored to the specific situation, following some metering of a test system/workload, but I don't think that's the most scalable approach... Plus, there's the write load of actually auditing the system :)

I would instead rely on higher-quality SLC USB flash (versus MLC) for this application. A purpose-built drive like the sTec SLC USB drive would be my first choice, as it's rated for industrial and embedded applications. The characteristics of SLC flash should counter any concerns about workload or device lifespan.

ewwhite
  • 194,921
  • 91
  • 434
  • 799