2.1.1.9 Per NotifyEventEntry
Action: A 32-bit unsigned integer composed of flags indicating the type of change events that occurred, as specified in the Action member of the FILE_NOTIFY_INFORMATION structure defined in [MS-FSCC] section 2.7.1.
FileName: For DirectoryFile notifications, a non-null-terminated Unicode string containing the relative path and name of the file that changed. For ViewIndexFile notifications, a binary data structure containing information specific to the ViewIndexFile being monitored.
FileNameLength: The length, in bytes, of FileName.