How to keep track of changes in /etc/

It sounds like you want etckeeper from Joey Hess of Debian, which manages files under /etc using version control. It supports git, mercurial, darcs and bazaar.

git is the VCS best supported by etckeeper and the VCS users are most likely to know. It's possible that your distribution has chosen to modify etckeeper so its default VCS is not git. You should only be using etckeeper with a VCS other than git if you're in love with the other VCS.


I can't give you a final recommendation, but I can share a few thoughts on the subject. Given that /etc is usually rather small, you might just go for a simple compressed tar-ball solution. If you hardly need to go through the history, it might be the easiest solution to set up.

For me it would be to tedious to manage logical volumes just to do keep track of /etc and especially as I don't think that LVM snapshots were designed to be created regularly as means for backup of a relatively small amount of data.

btrfs seems to me to be far better equip for this, but it is still not as stable as, for example, ext{2,3,4} and the fsck tool is also not done yet. But it continuously gets better.

Personally I actually use git to track /etc but you should keep in mind that git doesn't store file metainformation like ownership or permission! And also check that the .git directory has the right permission. There are a few tools that help with these problems though. You might want to take a look at etc-keeper, which was developed exactly for the keeping track of /etc or use at least use something like gitperms or metastore to track the metainformation.


To keep track of "unwanted" changes we use a HIDS - in our case samhain others are tripwire or aide. All these systems will warn you when something unwanted happened.

A yum update should not change anything without leaving a .rpmnew or .rpmold, if the config-file is flagged as such in the corresponding rpm.

Myselv I found it a good practice to make a security copy of the file I am going to modify with cp -p origfile origfileYYYY-MM-DD with the date of the day before.

If everything else fails - I call the backups guys and ask for a restore from the last known "good" backup.