A content management system can detect file events that are suspected to be in error, and notify users having access to files affected by the detected file events of the detected events. The content management system can maintain a log of file events including a plurality of file identifiers. The file identifiers identify files that are associated with a namespace, a file event, and a user account responsible for the file event. An analytics module can analyze the log of file events and notify the user of a suspected error when it may be that the file events were inadvertent. A notification can include a link to restore (undo) the file events if the user confirms that the file events were in error.