OK think I've figured this one out. The person has mapped the directory /PTC/twc to a Windows Network drive using Samba (Grrrr), it is showing the process.cwd as /PTC/twc so in the case of Samba (smbd) processes, it would be a case of adding the process.cwd to item 0 name.
The good news is that I'm not interested in smdb calls, which is an event action of checked-metadata-of, I'm interested in the event actions of (i think) is open file.
I've been searching the net and I cannot find an obvious list of event actions. Do you know if there is one?
Thanks, N
PS. As much as I have been challenged in getting this going, I'm glad I've stuck with it as I believe that it is going to get me there in the end and I will definitely have you to thank! Just need to get rid of all the noise!