effect	path state
write	/tmp/demo captured
read	/etc/hosts observed
delete	/tmp/old blocked
