How to Identify ZFS Snapshot Differences using “zfs diff”

To determine the differences between ZFS snapshots, you can use the zfs diff command. The output of this command provides a high-level description of the differences between a snapshot and a descendant dataset. The descendant can be either a snapshot of the data set or the current data set. For each file that has undergone a change between the original snapshot and the descendant, the type of change is described along with the name of the file. In the case of a rename, both the old and new names are shown. The type of change follows any time stamp displayed and is described as a single character.

Let’s see an example to get more idea about how the ‘zfs diff’ command works.

1. In the example, a before snapshot of the rpool/export/home ZFS file system was taken.

# zfs snapshot rpool/export/home@before

2. A new file (newfile) was then created in /export/home/geek directory.

# touch /export/home/file1

3. Then another snapshot (after) of the same ZFS file system was taken.

# zfs snapshot rpool/export/home@after

4. The zfs list command is used to list the snapshots based on name and creation date.

# zfs list -r -t snapshot -o name,creation rpool/export/home
NAME                      CREATION
rpool/export/home@before  Sun Jan 14  8:07 2018
rpool/export/home@after   Sun Jan 14  8:13 2018

5. The “zfs diff” command is then run to determine the differences between the before and after snapshots.

# zfs diff rpool/export/home@before rpool/export/home@after
M       /export/home/
+       /export/home/file1

The M in the zfs diff command output indicates that the /export/home/ directory has been modified, and the + indicates that a file /export/home/file1 exists in the later snapshot. The table in below summarizes the file or directory changes that are identified by the zfs diff command.