Users can choose between:
- no special handling, users have to deal with overflow
- over approximation without huge memory costs: in case of overflow we generate events for all files&path present. Only thing you'll miss is deletes
- we keep track of all files and first in memory and compare in case of overflow. This option has the best fidelity, but incurs both memory and perf overhead.