The present disclosure is related to methods, systems, and machine-readable media for file system event monitoring using metadata snapshots. A traditional snapshot of a virtual computing instance (VCI) can be created in a file system. The snapshot can correspond to an extent. An indication can be made that the extent is owned by a single snapshot. A metadata snapshot, corresponding to the extent, can be created without changing the indication that the extent is owned. The extent can be modified, wherein the indication that the extent is owned causes the extent to be modified without allocating a new extent.