Do we have a tool that can track file level changes at a user level for a directory?

Yes -

inotifywait - wait for changes to files using inotify

Example:

while inotifywait -e modify /var/log/my_log; do
  if tail -n1 /var/log/my_log | grep error; then
    write_email_to_support
  fi
done

For your specific use case you can use -m (monitor) or -d (daemon, same as monitor, but run in background) and output (-o) to some log file:

#!/bin/bash
inotifywait -e create,modify -m /var/lib/docker/volumes/shared/_data -o /var/log/shared_data_log

Add -r to make inotfiywait watch changes recursively
You can use --format ... to specify an output format.
It is not possible to see who create or changed a file. That is a limitation of the file system.

See man inotifywait for more options.

Related