1. A system, comprising: a storage device configured to store file system content including a plurality of files; a host device configured to implement a file system, wherein the file system is configured to manage access to said storage device and to store file system content on said storage device, wherein said file system is further configured to perform in-band detection of file system content access events and to responsively generate respective metadata records indicative of said file system content access events; and a query system configured to evaluate a query specifying one or more conditions for selecting one or more of said respective metadata records, wherein said query is formulated in a query language.