Event notification management

1. A method comprising:

determining that a threshold associated with a number of pending event notifications in a queue has been exceeded by an incoming event notification, where each event notification identifies a change to one or more data element entries within a computer system and where each event notification is associated with one or more parent levels of a hierarchical file system;

identifying, using one or more processors, a plurality of pending event notifications that can be combined including determining that two or more event notifications have a common parent level; and

combining two or more event notifications such that the number of pending event notifications, including the combined two or more event notifications, in the queue no longer exceeds the threshold number of event notifications, including replacing two or more event notifications with a single event notification identifying a change to the common parent level.

2. The method of claim 1 , further comprising:

scanning the common parent level to identify the combined event notifications; and

performing a backup operation including backup data associated with the combined event notifications.

3. The method of claim 2 , where scanning the common parent level includes comparing the parent data with data from a previous backup to identify changed data.

4. The method of claim 1 , where receiving an incoming event notification includes receiving an event notification identifying a change to a file system at an event notification queue.

5. The method of claim 1 , further comprising:

identifying one or more event notifications as protected, where protected event notifications cannot be combined.

6. The method of claim 1 , further comprising:

determining a number of event notifications to combine according to one or more criteria.

7. The method of claim 6 , where the criteria include minimizing a number of combined event notifications.

8. The method of claim 7 , where minimizing the number of combined event notifications includes combining a minimum number of event notifications such that the incoming event notification does not exceed the threshold.

9. A computer program product encoded on a computer-readable storage medium, operable to cause data processing apparatus to perform operations comprising:

receiving an incoming event notification, where the event notification corresponds to file system activity related to one or more data elements within a computer system;

determining that a threshold associated with pending event notifications in a queue has been exceeded by the incoming event notification, where each event notification identifies a change to one or more data element entries within a computer system and where each event notification is associated with one or more parent levels of a hierarchical file system;

identifying a plurality of pending event notifications that can be combined including determining that two or more event notifications have a common parent level; and

combining two or more event notifications such that the number of pending event notifications, including the combined two or more event notifications, in the queue no longer exceeds the threshold number of event notifications, including replacing two or more event notifications with a single event notification identifying a change to the common parent level.

10. The computer program product of claim 9 , further operable to cause data processing apparatus to perform operations comprising:

scanning the common parent level to identify the combined event notifications; and

performing a backup operation including backup data associated with the combined event notifications.

11. The computer program product of claim 10 , where scanning the common parent level includes comparing the parent data with data from a previous backup to identify changed data.

12. The computer program product of claim 9 , where receiving an incoming event notification includes receiving an event notification identifying a change to a file system at an event notification queue.

13. The computer program product of claim 9 , further operable to cause data processing apparatus to perform operations comprising:

identifying one or more event notifications as protected, where protected event notifications cannot be combined.

14. The computer program product of claim 9 , further operable to cause data processing apparatus to perform operations comprising:

determining a number of event notifications to combine according to one or more criteria.

15. The computer program product of claim 14 , where the criteria include minimizing a number of combined event notifications.

16. The computer program product of claim 15 , where minimizing the number of combined event notifications includes combining a minimum number of event notifications such that the incoming event notification does not exceed the threshold.

17. A system comprising:

one or more processors configured to perform operations including:

receiving an incoming event notification, where the event notification identifies particular file system activity; and

determining that a threshold associated with pending event notifications in a queue has been exceeded by the incoming event notification, where each event notification identifies a change to one or more data element entries within a computer system and where each event notification is associated with one or more parent levels of a hierarchical file system;

means for identifying a plurality of pending event notifications that can be combined including determining that two or more event notifications have a common parent level; and

means for combining two or more event notifications such that the number of pending event notifications, including the combined two or more event notifications, in the queue no longer exceeds the threshold number of event notifications, including replacing two or more event notifications with a single event notification identifying a change to the common parent level.