Systems and methods are provided to monitor usage of software applications and services. According to some embodiments, it may be determined that an application event has occurred. At least a portion of a file name may be accessed and compared to one or more actual file identifiers. An actual file identifier may then be selected based on the comparison.