Responding to this part of your update:
a guy ask me if a file content with different content but same name, same date/time, same size, what will happen
To clarify: the question here is: "what if the content of a particular file happens to change, while its name, its size and its modification date all remain unchanged?"

If that is a correct restatement of the question, I think the answer would be that this could only arise from two possible things happening:

  1. There has been some damage or corruption to the hard disk, altering the data content of the blocks allocated to this file, or
  2. Someone alters the file contents in some normal way (which changes the modification time in its directory entry), and then deliberately uses the unix "touch" command to reset the modification date to its previous value.
Apart from those two things, I don't know of any way for file contents to change without altering the modification time/date field in the file's directory entry.

Usually, if the first type of problem happens, it has a much wider impact (e.g. the whole disk becomes non-functional). As for the second type of problem, if you really do have to watch out for that sort of trickery, then you certainly do want to maintain checksums on all data files (and take extra steps to protect the checksum list from unauthorized access).

If there isn't a plausible risk of the latter sort of problem, then just checking directory trees with "find", looking for recently modified files, should suffice.

In reply to Re: Monitor directories or files have any change by graff
in thread Monitor directories or files have any change by benlaw

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.