TrackFS

Trackfs is a compact software application that tracks any changes made to the file system by another program or group of programs. It is similar to 'installwatch,' but operates differently. Instead of intercepting library functions like open() and unlink() through LD_PRELOAD, it runs child programs with tracing enabled and tracks their system calls.

This method does impact performance since programs run several times slower with trackfs. However, since trackfs is intended for installation tasks, speed may not be as crucial as it initially appears. On the other hand, trackfs has a significant advantage over LD_PRELOAD because it works with statically linked binaries. With ptrace( ), you can track all transactions, which LD_PRELOAD may miss.

Trackfs has two operating modes. The '-l ' option lets the software log any file system changes made by the tracked program(s) to the specified file. Every entry has a (printf-style) format that consists of a single character denoting the type of change (c for create, d for delete, u for update, and t for temporary) and a string that reports the path of the impacted object. Log files get "compressed," meaning that multiple transactions related to the same object are grouped together and reported as a single "resulting" transaction. For example, if a file is deleted and later re-created, an update will be reported.

The '-b ' option copies every file that is likely to be modified, acting as a backup. In some situations, the backup may not be necessary if the modification fails due to insufficient permissions. In such cases, consult the log file to identify the files that will need to be restored.

If the command the user wishes to execute under trackfs's control includes options, they will need to prefix the '--' pseudo-option in front of it. This is necessary because getopt( ) may reorder options and arguments on some systems (such as the GNU version).