How to Identify ZFS Snapshot Differences using “zfs diff” By Devan

How to Identify ZFS Snapshot Differences using “zfs diff”

To determine the differences between ZFS snapshots, you can use the zfs diff command. The output of this command provides a high-level description of the differences between a snapshot and a descendant dataset. The descendant can be either a snapshot of the data set or the current data set. For each file that has undergone a change between the original snapshot and the descendant, the type of change is described along with the name of the file. In the case of a rename, both the old and new names are shown. The type of change follows any time stamp displayed and is described as a single character.

Let’s see an example to get more idea about how the ‘zfs diff’ command works.

1. In the example, a before snapshot of the rpool/export/home ZFS file system was taken.

# zfs snapshot rpool/export/home@before

2. A new file (newfile) was then created in /export/home/geek directory.

# touch /export/home/file1

3. Then another snapshot (after) of the same ZFS file system was taken.

# zfs snapshot rpool/export/home@after

4. The zfs list command is used to list the snapshots based on name and creation date.

# zfs list -r -t snapshot -o name,creation rpool/export/home
NAME                      CREATION
rpool/export/home@before  Sun Jan 14  8:07 2018
rpool/export/home@after   Sun Jan 14  8:13 2018

5. The “zfs diff” command is then run to determine the differences between the before and after snapshots.

# zfs diff rpool/export/home@before rpool/export/home@after
M       /export/home/
+       /export/home/file1

The M in the zfs diff command output indicates that the /export/home/ directory has been modified, and the + indicates that a file /export/home/file1 exists in the later snapshot. The table in below summarizes the file or directory changes that are identified by the zfs diff command.

File or Directory Change	Identifier
File or directory is modified, or file or directory link has changed.	M
File or directory is present in the older snapshot but not in the newer snapshot.	–
File or directory is present in the newer snapshot but not in the older snapshot.	+
File or directory is renamed.	R