Excelent question. osquery addresses this at least in part, with its eventing framework: https://osquery.readthedocs.io/en/stable/development/pubsub-framework/#example-inotify