Three of my servers are using the Check File System
event notification as a mini-IDS to their hosted sites.
What I see is that HealthMonitor sends notification that
an event that you are monitoring (Attributes, Creation
Time, Folder Name, File Name, Last Access, etc.)
occurred over a monitored file or folder, but doesn't
specify wich attribute and how.
My suggestion is that the notification be in a per-object
model (when a file or folder changes). When a monitored
file changes attributes and creation time (for example),
only one notification should be issued telling that file
xpto.asp (in my case =P) changes attributes from X to
Y, and creation time is now Z.
This way, massive changes in the file system can be
better tracked, not only informing the administrator with
better information, but also tracing a route to recovering