4

Hi I'm looking to see what file is changing in a directory i'd like to get the md5sum of every file and write it to a text file. Then after i know a file has changed i'd like to run it again so i can diff the output files to see what exactly changed. Here is what i've tried however it doesn't work as i need.

Also not only do i need to get the md5sum of every file in a folder including subdirectories i need it to not follow symlinks 

#!/bin/bash
#

cd /sys/class
for i in $(find . -type f)
do
    ls -lt "$i" >> /home/george/Desktop/before.txt
done
echo "Finished!"

Thank you for any help

===Edit===

I put my actual paths in as i don't really see a need to hide them. Anyway running this returned only a few files (outputted file below) which are the files in the folders meaning it's not going into subdirectories and finding those files too. Btw sorry my bash is way rusty

--w------- 1 root root 4096 Jun 20 03:03 ./gpio/export
--w------- 1 root root 4096 Jun 20 03:03 ./gpio/unexport
-rw-r--r-- 1 root root 4096 Jun 20 03:03 ./firmware/timeout
-r--r--r-- 1 root root 4096 Jun 20 03:04 ./drm/version

===Edit2===

Not exactly sure why some of these files aren't being found for instance /sys/class/backlight/intel_backlight/brightness

And many others like that there are so many files that aren't being found for some reason

user577732
  • 3,956
  • 11
  • 55
  • 76
  • Just change -type d to -type f ? I don't think find follows symlinks by default so you'll be OK. Your for loop won't work with spaces in filenames, you'd be better using an alternative approach - discussed here http://stackoverflow.com/questions/7039130/bash-iterate-over-list-of-files-with-spaces – Adam Jun 20 '12 at 07:44
  • I suppose checking latest modification date is not an option, right? It would be way faster and simpler, but of course, not nearly as secure – Miquel Jun 20 '12 at 07:45
  • i'll try f thanks adam and miquel i guess that could work too at least i think it would makes sense i know md5 is slow and there are a lot of files – user577732 Jun 20 '12 at 07:46
  • 3
    The `md5deep` tool is designed to do this. Must Linux distributions include it in a package called `md5deep`. – David Schwartz Jun 20 '12 at 07:47
  • @Adam `md5sum` will certainly follow a symlink if you feed it one. You need to exclude symlinks in the `find` command, or bypass them in the loop. – tripleee Jun 20 '12 at 07:52
  • 2nd edit not sure why these files aren't being found there are tons that are missing i don't know why – user577732 Jun 20 '12 at 08:28
  • You have made a significant edit. A lot of the entries in the `/sys` hierarchy are not regular files, you need to change the `-type` to match the kind of entries you are looking for. – tripleee Jun 25 '12 at 15:11

2 Answers2

14

The cd is unnecessary, and with type -f you are already in fact bypassing symlinks. So the loop is unnecessary, too:

find /path/to/directory -type f -exec md5sum {} + >before.txt

If your find is too old to support -exec {} + try with -exec {} \; instead.

For the md5sum comparison, you could try simply removing identical lines;

fgrep -vxf before.txt after.txt | less

This is assuming the list in before.txt will fit into fgrep; but if you are dealing with a few dozen thousand files tops, it can probably cope. This will not identify deleted files from before.txt, though.

tripleee
  • 175,061
  • 34
  • 275
  • 318
  • same thing as my edit still only outputted 4 things for some reason but like the solution very clean so far just not giving me everything for some reason – user577732 Jun 20 '12 at 08:09
  • even did sudo before to make the command look like sudo find /sys/class -type f -exec ls -lt {} + >before.txt – user577732 Jun 20 '12 at 08:11
  • it's not going into the subdirectories which is what i need as well that's what i just realized – user577732 Jun 20 '12 at 08:18
0

If your file list size is small enough that you can do it all in memory, you might consider sorting before.txt by the hash. If you do the same for after.txt you'd be able to go line by line on each of the files and identify matches even if the filename has changed. You'd also be able to skip over deleted or added files with less problems than if you had to interpret a diff before.txt after.txt

If using file modification date is an option, what you can do is use ls -lt | head to filter out the newest file and keep that. Then when you want to check for changes, ls -lt again and go through anything that's newer than the date you stored. This should work nicely regardless of file list size, but will be vulnerable to someone modifying last modification date (which would require root privileges)

Miquel
  • 15,405
  • 8
  • 54
  • 87
  • well the file list is definately pretty long which is why i'm definately thinking md5 isn't the best way to go but memory probably isn't a good way to go since the list is so long – user577732 Jun 20 '12 at 07:50
  • Ok, I've amended my solution to clarify the modification date, in case you can use that – Miquel Jun 20 '12 at 07:53
  • well the idea is this my laptop has a backlit keyboard which the software is for windows i however run linux. The keyboard lights when i boot up however going to sleep and then waking it the keyboard stays off. So i'm looking to see what's changing in /sys/class (where i'm looking first) i assume some where a file is being changed telling the leds to turn off – user577732 Jun 20 '12 at 07:55
  • So, no security involved. Use `ls -lt`, and see what files have changed, that would be my advise. It doesn't even look like you'll have to script if for this particular scenario – Miquel Jun 20 '12 at 07:56
  • yea none at all so i'll make an edit to my original post just to clarify for future users and myself and give it a run to see what happens – user577732 Jun 20 '12 at 07:58
  • Good luck! And for the record, your question's still a very good one and worthy of solving. It's just _you_ can get away with less trouble if you want :) Speaking of that, I just saw @DavidSchwartz answer in the top question comments. Looks like that'd also help you! – Miquel Jun 20 '12 at 07:59
  • Just added an edit to my original question it's not working for some reason – user577732 Jun 20 '12 at 08:06
  • it's not going into the subdirectories which is what i need – user577732 Jun 20 '12 at 08:18