How can you ask for differences vs. 10 days ago, and have zfs diff
tell you that the file was deleted at a time BEFORE the snapshot was taken? Something is very wrong here. Delete timestamp should be the time deleted, but how can a snapshot know a file was deleted before the snapshot was taken??
Note: the “earlier than snapshot” timestamp ONLY happens on deleted files.
root@truenas[/mnt/main]# zfs diff -Ft main/user@auto-2024-10-02_22-22
1728715279.949016584 M / /mnt/main/user/stk
1728540162.608227793 M F /mnt/main/user/stk/.bashrc
1727894709.170378262 - F /mnt/main/user/stk/.bash_history
1728367426.256160611 M F /mnt/main/user/stk/.local/share/nano/search_history
1728709857.667504367 M / /mnt/main/user/
1726528739.300845053 - F /mnt/main/user/stk/.ssh/known_hosts.old
1727215650.660890765 - F /mnt/main/user/stk/.ssh/known_hosts
1728541689.829054561 M F /mnt/main/user/stk/.midcli.hist
1728662319.662456350 M / /mnt/main/user/stk/.ssh
1728662319.662456350 + F /mnt/main/user/stk/.ssh/known_hosts.old
1727222115.042852243 - F /mnt/main/user/stk/foo.txt
1728672013.859051882 + F /mnt/main/user/stk/.ssh/known_hosts
1728721395.664506262 + F /mnt/main/user/stk/.bash_history
1728666730.375715910 + F /mnt/main/user/stk/.lesshst
1727811095.910300534 - @ /mnt/main/user/stk/backups
1727294355.901614645 - F /mnt/main/user/stk/bar.txt
1728709860.559494242 + / /mnt/main/user/truenas_admin
1728709859.991496230 + F /mnt/main/user/truenas_admin/.bash_logout
1728709860.267495264 + F /mnt/main/user/truenas_admin/.bashrc
1728709860.555494256 + F /mnt/main/user/truenas_admin/.profile
1728709860.771493499 + / /mnt/main/user/truenas_admin/.ssh
1728709860.771493499 + F /mnt/main/user/truenas_admin/.ssh/authorized_keys
1727324870.293264454 - F /mnt/main/user/stk/trace1.log
1727324870.309264402 - F /mnt/main/user/stk/trace2.log
If you do the conversion for bar.txt which was removed, the date is:
mytime(1727294355.901614645)
PST Time: 2024-09-25 11:59:15.901615-08:00
That time is BEFORE the timestamp of the snapshot.
I thought snapshots cannot know what happened before they are made.
The answer is that the timestamp shown is the time that the file was last modified, not the time it was deleted. So there you go. Mystery solved.
The documentation is a bit ambiguous here from zfs help diff
:
-t Display the path's inode change time as the first column of output.
Technically speaking, when you delete a file, you modify the reference count of the i-node.
So I might claim the documentation should point out for deleted files it is the time the file was last modified. Would I be right?