Hi There,
File activity monitoring is a very interesting subject. As soon as something goes missing everyone wants to know where did it go and who accessed it. As aLTeReGo mentions there is a route to the answer with log files. As a former network admin who looked at this I would suggest you test the logging of events first. My experience was that the auditing for file activity is problematic as you have to nominate folders to monitor and when you do you get loads of events. The LEM product may be able to do the filtering so you end up with readable data, I do not claim to be an expert on LEM so I am not sure of the capabilities.
There is another option too. I now work for a company called NetFort and we develop a software based forensics tool called LANGuardian. It uses network traffic as a data source (SPAN or mirror port off a managed switch) and from this you can get an audit trail of file activity. The advantages of this approach is that you don't go near the file servers and you get you audit trail directly from network traffic. We also developed an integration pack for SolarWinds Orion and you can see an example of it in action at this link http://demo2.netfort.com/Orion/SummaryView.aspx?viewid=35
So in summary, if you host your file shares on Windows servers and auditing does not cause any performance problems then a log analysis tool like LEM may be your answer. If you want a more passive approach and want to get the file and user activity from network traffic then our LANGuardian may be the best solution. If you use something like NetApp servers then auditing won't be an option so a traffic analysis based approach may be your only answer.
Darragh