The invention relates to a method of file backup in a computer system and a system thereof. The method comprises the following steps: step 1, a monitoring device captures a file operation event in the computer system, generates a file operation log for the file operation event which is within the monitoring range, matched with filter rules and successfully executed, and stores the file operation log into a memory device; step 2, a backup control device schedules the execution of a backup task, and transmits the backup task to a backup device when the backup task needs to be executed; step 3, the backup device judges whether the backup task is full backup or incremental backup, if the backup task is the full backup, then the full backup is carried out, otherwise, the next step is executed; and step 4, the backup device acquires the file operation log from the memory device and carries out the incremental backup according to the file operation log. The method can carry out online data warm backup, provides an incremental backup method for file logical blocks, reduces backup data volume and improves the backup efficiency.