5 ms·

What ZFS does here is not enough for me. I need to be alerted to changes done also above the file system layer, like by malware or accidental deletion etc. Only

What ZFS does here is not enough for me. I need to be alerted to changes done also above the file system layer, like by malware or accidental deletion etc. Only way I have found to solve that is to have checksum tool above the file system. If something is wrong, I restore from backup, so zfs does not give me anything...

tsuraan 6y ago
I don't personally do this, but if you're taking scheduled snapshots of your ZFS filesystems, you could also have a scheduled job (say, nightly) that emails you a "zfs diff" [0] between the current snapshot and the one from 24 hours ago. It won't tell you that you've been hit by malware, but an unexpected spike in changes could be something worth investigating. [0] - https://docs.oracle.com/cd/E36784_01/html/E36835/gkkqz.html https://docs.oracle.com/cd/E36784_01/html/E36835/gkkqz.html
rainbowzootsuit 6y ago
You can do a zfs diff command on two snapshots or a snapshot and current dataset as zfs takes a just-in-time snapshot of the live dataset.
throw0101a 6y ago
> I need to be alerted to changes done also above the file system layer [...] As others have mentioned, would "zfs diff ..." be useful? * https://www.thegeekdiary.com/how-to-identify-zfs-snapshot-differences-using-zfs-diff/ https://www.thegeekdiary.com/how-to-identify-zfs-snapshot-di... As the name suggests, "snapshots" are read-only and so cannot be altered. You could either copy/rsync the modified file/s to the live location, or do a rollback to a particular snapshot: * https://www.thegeekdiary.com/solaris-zfs-how-to-create-rename-rollback-destroy-a-zfs-snapshot/ https://www.thegeekdiary.com/solaris-zfs-how-to-create-renam... If the machine is compromised in some way, you could reinstall and do a "zfs send-recv" of a pool from a remote system.
- vanerka 6y ago
  You can clone the snapshot (so its clone become writable, not the snapshot itself!) and you even can promote a snapshot to a "parent" filesystem (reverse parent-child).

tsuraan 6y ago

I don't personally do this, but if you're taking scheduled snapshots of your ZFS filesystems, you could also have a scheduled job (say, nightly) that emails you a "zfs diff" [0] between the current snapshot and the one from 24 hours ago. It won't tell you that you've been hit by malware, but an unexpected spike in changes could be something worth investigating. [0] - https://docs.oracle.com/cd/E36784_01/html/E36835/gkkqz.html https://docs.oracle.com/cd/E36784_01/html/E36835/gkkqz.html

rainbowzootsuit 6y ago

You can do a zfs diff command on two snapshots or a snapshot and current dataset as zfs takes a just-in-time snapshot of the live dataset.

throw0101a 6y ago

> I need to be alerted to changes done also above the file system layer [...] As others have mentioned, would "zfs diff ..." be useful? * https://www.thegeekdiary.com/how-to-identify-zfs-snapshot-differences-using-zfs-diff/ https://www.thegeekdiary.com/how-to-identify-zfs-snapshot-di... As the name suggests, "snapshots" are read-only and so cannot be altered. You could either copy/rsync the modified file/s to the live location, or do a rollback to a particular snapshot: * https://www.thegeekdiary.com/solaris-zfs-how-to-create-rename-rollback-destroy-a-zfs-snapshot/ https://www.thegeekdiary.com/solaris-zfs-how-to-create-renam... If the machine is compromised in some way, you could reinstall and do a "zfs send-recv" of a pool from a remote system.

vanerka 6y ago
You can clone the snapshot (so its clone become writable, not the snapshot itself!) and you even can promote a snapshot to a "parent" filesystem (reverse parent-child).