Intelligent file system scan

A method, comprising:

• parsing, by a processor, during a current filesystem check, a sparse file stream comprising a plurality of Update Sequence Numbers (USNs), each USN having a respective byte offset from a beginning of the sparse file stream and identifying a file in the filesystem associated with a file event, wherein each time the file is added or modified, the USN for the file is incremented to indicate that a change has occurred;
• access a checkpoint USN that is locally stored apart from the sparse file stream and serves as a checkpoint of a prior USN that was accessed during a prior filesystem check;
• identifying, by the processor, a next byte offset for a next USN of a file in the sparse file stream after the checkpoint USN based on the byte offset of the checkpoint USN;
• update the checkpoint USN with the next USN;
• identifying, by the processor, a file event from the sparse file stream based on the next USN without polling files or directories on the filesystem;
• and
• pass the file event to a downstream system.

A non-transitory computer readable medium storing instructions that, when executed by a processor, programs the processor to:

• access a journaling filesystem log storing a plurality of Log Sequence Numbers (“LSNs”), wherein each LSN is a unique, sequential number that identifies the order in which changes are made to filesystem metadata;
• access a checkpoint LSN locally stored separate from the journaling filesystem log;
• determine that the checkpoint LSN exists in the journaling filesystem log;
• determine that a logfile scanning module is in a consistent state based on the determination that the checkpoint LSN exists in the journaling filesystem log;
• parse the journaling filesystem log to identify one or more file events;
• and
• pass the one or more file events to a downstream system.