1. A computer-implemented method, comprising: identifying, in real time and at a block level, a change made to a user-selected set of directories or files of a volume of a file system as a result of an I/O request having been processed; writing to a log file, in real time, block change information indicating one or more blocks from a particular directory or file of a particular volume that have changed as a result of the I/O request having been processed, wherein the log file is structured to store the block change information non-sequentially and grouped by the particular directory or file to which the change relates; reading block change information from the log file to identify blocks of data to be included in a block-level incremental backup; responsive to a snapshot event, generating a new log file; and subsequent to the snapshot event, writing to the new log file, in real time, block change information indicating one or more blocks from the particular directory or file of the particular volume that have changed as a result of an I/O request having been processed after the snapshot event.