Mav - If you only want to forward change events (and not the file), the UF will not work. Apparently it needs to send the whole file in order to send the change events. Saw this in a thread recently.
In order to make a UF to forward fschange events, please configure "signedaudit = false" and "index =
Here is an example
signedaudit = false
At the indexer, you can search these fschange events with sourcetype="fs_notification" or source="fschangemonitor"
As long as I understand, this is a bug. So, we're going to document this as a workaround in our doc.