poc monitor file operation inside directory