
    PARTITION DIFFERENCES QUERY


    Since many changes can occur to a partition over time, you may only
    want to look for specific types of changes. This window allows one
    to search for specific changes.

    General Fields

    Find Filenames like

    Use this field to specify file names to use in the search pattern.
    The file names can contain the standard UNIX wild card matching
    characters `*', `?' and `[ ]'. This field will accept more than one
    entry. Leave a blank space between each unique filename for multiple
    entries. This is a good mechanism to use if you only want to check
    for changes in a certain area of a partition.

    Skip Filenames like

    This is the opposite of Find Filenames like. The filenames entered
    here create an exclusion list. Any filename entered here will NOT be
    matched by the search. This field uses the same format as the
    previous field. This is a good way to ignore files that change on a
    regular basis and omit unnecessary entries in the report.

    Owner Names

    Use this field to find only those files whose owners match the names
    of the users entered. This field will accept more than one entry.
    Leave a blank space between each unique owner for multiple
    entries.To exclude any files owned by certain users, place a !
    before those usernames. For example:

        root bin uucp Only files belonging to users root, bin, or

        uucp

        !root !bin All files except those belonging to users

        root and bin

    Group Names

    This field is similar to the Owner Names field, except you can
    specify user group names to use (or exclude) instead of user names.

    Min. File Size

    Use this field to limit the search to files larger than a certain
    size. The default unit is bytes, but by appending one of the letters
    k, m, or g, the corresponding unit size of kilobytes (KB), megabytes
    (MB) or gigabytes (GB) will be used. This can be useful when you are
    looking for log files growing out of control.

    Max. File Size

    This field is similar to the Min. File Size field, except you can
    specify the maximum file size allowed in the search.

    New Files

    Click on the Yes button (the default) to search for new files which
    did not exist in the previously saved snapshot.

    Include contents of new/lost dirs

    When Enlighten searches for new or lost files and it comes across a
    new/lost directory, this selection determines if the contents of the
    new/lost directory should be included in the search. Click on the
    Yes button (the default) if you want Enlighten to look at the
    complete contents of the new/lost directory in this case. Otherwise,
    click on the No button to just put the name of the new/lost
    directory into any report results.

    Lost Files

    Click on the Yes button (the default) to search for files which did
    exist in the previously saved snapshot and now no longer exist.

    Attempt to determine renamed files

    Sometimes, files are renamed. Normally this is considered to be a
    creation of a new file and the loss of the old one. Click on the Yes
    button (the default) if you want Enlighten to attempt to determine
    if the file has been renamed or not.

    This check is not fool proof; it will only find a file being renamed
    (moved) within the same directory in which it was originally found.

    Altered Files

    Click on the Yes button (the default) to search for files which have
    changed since the previously saved snapshot. There are many
    different ways a file can change. These can be selected and/or
    limited by using the following fields. The default value for all of
    these fields is also set to Yes.

    Size

    Use this filed to search for files that have either increased or
    decreased in size and/or to search for changes within certain
    ranges. In the second case, you may enter the range of size changes
    that should be searched for in the corresponding Ranges field.

    Each size range should be separated by a blank space. The range can
    be prefixed by a minus (-) sign to denote a decrease in the size or
    a plus (+) sign to denote an increase in size. If no sign is given,
    then an increase in size is assumed. A range has the following
    format:

        [+/-]<minsize>[<unit>]-[<maxsize>[<unit>]]

    The square brackets ([]) denote that the field is optional. The
    fields are:

        +            Search for files that have increased in size

        -            Search for files that have decreased in size

        <minsize>    The minimum size that file has changed in size

        <maxsize>    The maximum size that file has changed in size

        <unit>       The unit of size, with the possible units being:

            b    Bytes

            k    Kilo bytes

            m    Mega bytes

            g    Giga bytes

            %    Relative increase in size in terms of per cent

    The following are all valid range examples:

        1000         File which increased in size by 1000 bytes

        -2k          File which decreased in size by 2 Kb (2048 bytes)

        10%          File which increased in size by 10 percent

        100-10k      File which increased by 100 bytes but not more than 10 Kb

        -10k-2m      File which decreased in size by 10Kb but not more than 2Mb

    User Ownership

    Click on the Yes button to search for files that have changed user
    ownership. Sometimes you may want to focus on changes in ownership
    for just a few users or a specific group of users (e.g., chown to
    root). In this case, you can specify those entries in the
    corresponding Ranges field. Leave a blank space between each unique
    username or user ID (UID) for multiple entries.

    Group Ownership

    This field is similar to the User Ownership field, except you can
    specify user group names or group IDs (GIDs) to use instead of user
    names or user IDs (UIDs).

    Mode

    Click on the Yes button to search for file permission changes. If
    you only want to look for specific mode changes (e.g., new setuid
    programs), you can specify those entries in the corresponding Ranges
    field. Leave a blank space between each set of mode changes for
    multiple entries.

    You can use two formats to search for specific mode changes:

        [+/-]<numeric mode>

        [+/-]<who><modes>

    Use the first format to search for added or lost permissions
    followed by UNIX style octal <numeric mode>. Enlighten will search
    for files that have had one of the specified bits changed in the
    file permissions, e.g., use +007 to look for any gaining of
    permissions for the other user type. Only experienced UNIX
    administrators should use this format.

    Use the second format to search for where a type of user (<who>)
    and/or a type of mode (<modes>) permissions were added or lost.

    The <who> permission values are:

        u      Look for changes to the user's permissions

        g      Look for changes to the group's permissions

        o      Look for changes to the others' permissions

        a      Look for changes to any of these permissions (user, group,
               and other). This is the default value.

    The <modes> permission values are:

        r      Look for changes to the read permissions

        w      Look for changes to the write permissions

        x      Look for changes to the execute permissions

        s      Look for changes to the setuid permissions

        t      Look for changes to the sticky bit permissions

    The following are examples of the second format:

        +orwx  Look for any gaining of permissions for other user types

        +s     Look for any files gaining setuid/setgid privileges

        -ax    Look for any loss of executable permissions for all user types


    Updated

    Updated files are files that have been modified without having the
    size of the file increase or decrease. This often happens to
    database files where data in the middle of the file is replaced with
    new data. Click on the Yes button if updated files should be part of
    the search.

    Accessed (read)

    Every time a file/program is read or executed, the access date is
    updated. Since many files are typically read or executed between
    snapshots, the list of read files may become quite long. Click on
    the No button if read files should not be included in the search.

    Buttons

    Execute Search

    The search criteria may use one or any combination of the above
    fields. Once you've entered your search criteria, click on the
    Execute Search button. The List of Changed Files window will appear
    with a list of the files which met the criteria, as shown in the
    example below.


    As mentioned previously, disk snapshot comparisons are time
    intensive operations and this may take a while.

    From here, you can execute more commands such as edit, backup, and
    chown to manipulate the displayed files' characteristics. See "File
    List" on page 5-31 for more details on using this window and "View
    Files" on page 5-9 to use its buttons.

    Clear Fields

    Click on this button to clear the existing choices in all fields.

    Close

    Click on this button to discard any changes and close the window.
