Hello
Logs are being collected through fschange.
Do you know the field description of the fschange log?
Particularly curious are isdir, gid, and uid.
