How to find out what were the changes after installing the linux program?

Question

linux

Hello, please tell me if there is any software or the ability to check what has been changed, installed, edited, which configs have been corrected after installing some program?

For example, I want to install a deb package and see where it climbed after installation, what files I changed and where I wrote what

Answer 1

The deb package itself contains the script and the installation config.

Answer 2

I made myself a simple script (not very selenium in bash scripting):

find $1 -mmin $2 \
  -not -path "/dev/*" \
  -not -path "/sys/*" \
  -not -path "/proc/*" \
  -not -path "/home/sergey/.cache/*" \
  -not -path "/run/*" \
  -not -path "/media/*" \
  -not -path "/home/sergey/.config/google-chrome/*" \
  2>/dev/null

saved it as 'find_last.sh' and placed it in the folder "/home/user/.local/bin/", giving it permission to execute. Next, I run the script like this "find_last.sh / 1". And the files that have been modified or created in the last minute are displayed in the console. Most likely the script can be improved. Here is an installation example

midnight commander

/etc
/etc/mailcap
/etc/alternatives
/etc/alternatives/view
/etc/alternatives/view.1.gz
/etc/mc
/home/sergey/.local/share/gvfs-metadata/root-9fff4441.log
/home/sergey/.local/share/tracker/data
/home/sergey/.local/share/tracker/data/.meta.isrunning
/home/sergey/.local/share/tracker/data/tracker-store.journal
/home/sergey/.config/google-chrome
/var/cache/apt
/var/cache/apt/pkgcache.bin
/var/cache/apt/archives
/var/cache/apt/archives/partial
/var/lib/apt
/var/lib/apt/extended_states
/var/lib/update-notifier
/var/lib/update-notifier/updates-available
/var/lib/update-notifier/dpkg-run-stamp
/var/lib/NetworkManager
/var/lib/dpkg
/var/lib/dpkg/updates
/var/lib/dpkg/lock
/var/lib/dpkg/status-old
/var/lib/dpkg/triggers/Lock
/var/lib/dpkg/status
/var/lib/dpkg/alternatives
/var/lib/dpkg/alternatives/view
/var/lib/dpkg/alternatives/editor
/var/lib/dpkg/info
/var/lib/dpkg/info/mc.list
/var/log/syslog
/var/log/journal/325da5c54c154cbebd9d80038deaffbe/system.journal
/var/log/journal/325da5c54c154cbebd9d80038deaffbe/user-1000.journal
/var/log/alternatives.log
/var/log/apt
/var/log/apt/history.log
/var/log/apt/term.log
/var/log/apt/eipp.log.xz
/var/log/dpkg.log
/var/log/auth.log
/usr/bin
/usr/lib
/usr/lib/mc
/usr/lib/mc/fish
/usr/lib/mc/ext.d
/usr/lib/mc/extfs.d
/usr/share/lintian/overrides
/usr/share/applications
/usr/share/applications/bamf-2.index
/usr/share/applications/mimeinfo.cache
/usr/share/pixmaps
/usr/share/mc
/usr/share/mc/bin
/usr/share/man/fr/man1
/usr/share/man/pl/man1
/usr/share/man/ja/man1
/usr/share/man/ru/man1
/usr/share/man/da/man1
/usr/share/man/it/man1
/usr/share/man/de/man1
/usr/share/doc/mc
/tmp
/tmp/tracker-extract-files.1000

Answer 3

You make two backups (for example, snapshots) - before the changes and after the changes, then you compare them using the usual diff. To reduce headaches, you update the OS in backups by making a simple chroot into each one in turn.
You can find out the package name from the file name using apt-file or vice versa dpkg -L package_name
All other options are not reliable and incomplete, as they use text logs that do not contain all the information and can be tweaked / cleaned. For example /var/log/apt/history.log contains information about packages being installed

Answer 4

You can take tree. tree -a > 1 then tree -a > 2 and then diff see the difference. Everything is ingenious and simple.

Answer 5

dpkg -L util-linux
equery f util-linux
rpm -ql util-linux
These commands (depending on the distribution) list files belonging to the specified package (util-linux in the example).

Answer 6

There is an inotify mechanism in Linux for tracking changes in files and a bunch of utilities. I can't give you specifics, you have to google.
Google it linux file monitoring process audit.