To determine the differences between ZFS snapshots, you can use the zfs diff command. The output of this command provides a high-level description of the differences between a snapshot and a descendant dataset. The descendant can be either a snapshot of the data set or the current data set. For each file that has undergone a change between the original snapshot and the descendant, the type of change is described along with the name of the file. In the case of a rename, both the old and new names are shown. The type of change follows any time stamp displayed and is described as a single character.
Let’s see an example to get more idea about how the ‘zfs diff’ command works.
1. In the example, a before snapshot of the rpool/export/home ZFS file system was taken.
# zfs snapshot rpool/export/home@before
2. A new file (newfile) was then created in /export/home/geek directory.
# touch /export/home/file1
3. Then another snapshot (after) of the same ZFS file system was taken.
# zfs snapshot rpool/export/home@after
4. The zfs list command is used to list the snapshots based on name and creation date.
# zfs list -r -t snapshot -o name,creation rpool/export/home NAME CREATION rpool/export/home@before Sun Jan 14 8:07 2018 rpool/export/home@after Sun Jan 14 8:13 2018
5. The “zfs diff” command is then run to determine the differences between the before and after snapshots.
# zfs diff rpool/export/home@before rpool/export/home@after M /export/home/ + /export/home/file1
The M in the zfs diff command output indicates that the /export/home/ directory has been modified, and the + indicates that a file /export/home/file1 exists in the later snapshot. The table in below summarizes the file or directory changes that are identified by the zfs diff command.
|File or Directory Change||Identifier|
|File or directory is modified, or file or directory link has changed.||M|
|File or directory is present in the older snapshot but not in the newer snapshot.||–|
|File or directory is present in the newer snapshot but not in the older snapshot.||+|
|File or directory is renamed.||R|