[Libguestfs] Inspect running disk image

Greetings, I'd like to monitor the FS activities (read/write) at runtime on several virtual disk images running on Qemu KVM. The aim is to periodically inspect these images to identify possible Windows registry modification, file creation and so on.. What should be the optimal procedure? Shall I launch a new handler each time? It is a quite expensive procedure and it takes a lot of time on loaded systems. Would be enough to mount/unmount the disk at each read? noxdafox