@david_chisnall@infosec.exchange @winterschon@bsd.cafe I might be thinking wrong but I'm fairly sure if you took a bunch of snapshots at regular intervals you can use zfs diff between them to track file level changes?
It tells you a file has changed, then you did the files that have changed to see the actual changes?
@david_chisnall@infosec.exchange @winterschon@bsd.cafe I might be thinking wrong but I'm fairly sure if you took a bunch of snapshots at regular intervals you can use
zfs diffbetween them to track file level changes?It tells you a file has changed, then you did the files that have changed to see the actual changes?