You have a working Raspberry Pi based computer. You boot up the Pi OS until the desktop shows then you shutdown. What happens in that simple cycle?
Anyone working with the Raspberry Pi with an aim to have machines boot automatically for 24 hours a day, 356 days a year activity. People looking at automated configuration scripts. You because you want to know how the Pi OS works.
There are two partitions on your Raspberry Pi system microSD card named boot and rootfs. boot does not change during a normal boot process or at shutdown. rootfs has lots of changes to logs and similar files.
Directory /etc contains a lot of configuration files.
/etc/cups contains subscription files that change. CUPS is the Common UNIX Printing System. If you are not using a printer, you can ignore changes in the cups directory.
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf contains IP address changes when the IP address for the computer is dynamically allocated. Static IP addresses will not change. The addresses are repeated in /etc/resolv.conf.
Assume you log in as user pi. Your home directory is /home/pi. There are changes in /home/pi.
/home/pi/.cache, .config, and some other "hidden" files contain display related files including a log for LXDE, for Openbox, for GTK, and for Xsession. You can ignore these unless you have display problems after you log in.
root is the administration or system user. There may be trivial log changes here from the part of the boot process before you log in.
/usr/share/x11 may have log changes from starting the X windows component.
/var contains heaps of variable settings and logs. You get changes for CUPS, the ALSA sound system, Bluetooth, DHCP, the lightdm display manager, the package management, and the important syslog.
Look closer at the /var/log/syslog change. syslog is renamed to syslog.1 then the system starts a new syslog. When you investigate errors that force a reboot, check syslog.1.
If your system is working perfectly, you can ignore these change. When you have system related problems or problems around your login or problems during shutdown, look at these files. Start with syslog. You can get a quick view of recent error messages in syslog by entering the dmesg command in Terminal.
For intermittent errors, look in the logs after both an error and a successful boot or login. Compare both. Look for differences between working and failing logs.
You look in the system directory. In File Manager, you select the directories outside of you home directory. You may have to use administration privileges to see everything.
If you have multiple disks or partitions, look for the partition named rootfs.
Make the occasional image copy of your microSD card. You can mount an image in Linux then compare your current system to a previous system using a comparison program like Meld. I usually start Meld with the sudo option to let Meld look at all system files.
You look when you have errors. A careful administrator will also look at working systems to see if something strange is happening that has not yet produced symptoms of a problem.
Prevention is worth your time. Looking at a working system will help you fix a failed system faster. Looking at a working system can highlight systems running downhill toward a crash.