I understand a little bit where ntfs_journal_events uses process_config for the include and exclude paths, however I am still a little bit confused.