file alteration monitor (fam replacement)