Identifying ZFS Snapshot Differences (zfs diff)

You can determine ZFS snapshot differences by using the zfs diff command.

For example, assume that the following two snapshots are created:

$ ls /system1/home/kaydo
fileA
$ zfs snapshot system1/home/cpark@snap1
$ ls /system1/home/kaydo
fileA  fileB
$ zfs snapshot system1/home/cpark@snap2

To identify the differences between the two snapshots, you would use syntax similar to the following example:

$ zfs diff system1/home/cpark@snap1 system1/home/cpark@snap2
M       /system1/home/kaydo/
+       /system1/home/kaydo/fileB

In the output, the M indicates that the directory has been modified. The + indicates that fileB exists in the later snapshot.

The R in the following output indicates that a file in a snapshot has been renamed.

$ mv /system1/kaydo/fileB /system1/kaydo/fileC
$ zfs snapshot system1/kaydo@snap2
$ zfs diff system1/kaydo@snap1 system1/kaydo@snap2
M       /system1/kaydo/
R       /system1/kaydo/fileB -> /system1/kaydo/fileC

The following table summarizes the file or directory changes that are identified by the zfs diff command.

File or Directory Change	Identifier
File or directory has been modified or file or directory link has changed	M
File or directory is present in the older snapshot but not in the more recent snapshot	--
File or directory is present in the more recent snapshot but not in the older snapshot	+
File or directory has been renamed	R

For more information, see the zfs(8) man page.

If you compare different snapshots by using thezfs diff command, the high level differences are displayed such as a new file system or directory. For example, the sales file system has 2 descendant file systems, data and logs with files within each descendant file system.

$ zfs list -r sales
NAME         USED  AVAIL  REFER  MOUNTPOINT
sales       1.75M  66.9G    33K  /sales
sales/data   806K  66.9G   806K  /sales/data
sales/logs   806K  66.9G   806K  /sales/logs

The high-level differences can be displayed between sales@snap1 and sales@snap2, where the primary difference is addition of the sales/logs file system.

$ zfs diff sales@snap1 sales@snap2
M       /sales/
+       /sales/logs

You can recursively identify snapshot differences including file names by using syntax similar to the following:

$ zfs diff -r -E sales@snap1
D       /sales/ (sales)
+       /sales/data
D       /sales/data/    (sales/data)
+       /sales/data/dfile.1
+       /sales/data/dfile.2
+       /sales/data/dfile.3
$ zfs diff -r -E sales@snap2
D       /sales/ (sales)
+       /sales/data
+       /sales/logs
D       /sales/logs/    (sales/logs)
+       /sales/logs/lfile.1
+       /sales/logs/lfile.2
+       /sales/logs/lfile.3
D       /sales/data/    (sales/data)
+       /sales/data/dfile.1
+       /sales/data/dfile.2
+       /sales/data/dfile.3

In the output, the lines that begin with D and end with (name) indicate a file system (dataset) and mount point.