Systems, methods, and computer-implemented products are provided that collect user file event notifications in real-time and optimizes the collected file event notifications by recognizing file event sets and pruning certain file events from the event sets. The optimized file event notification information is then indexed on an index server. The file's content information (e.g., sensitive information) and the file's metadata are independently collected and indexed and stored on the index server. The information from the optimized file event notifications, the file's content information, and the file's metadata are co-related to each other and presented in a file activity audit report.