auditing a journal is not like a trigger at all. A trigger is like an
interrupt. When the action happens, you perform an action.
What's the difference between periodically reading a journal and
periodically checking for the existence of an entry in a stream file
directory? Maybe the benefit of the journal are that the entry only
occurs after the stream file activity is done. While if you read for the
directory entry it may still be in use, being written?