I've been banging my head against this problem all day, with no solution found.
You can turn up the debugging of the NFS server, but that doesn't provide much detail (if that exmaple is accurate) and will probably dominate a busy NFS server's disk with useless baggage logged in addition to the bare filenames.
Another solution is adding rules to auditd/auditctl to log all reads or writes to the NFS directories, but that doesn't work for our Centos 6.X machines, for reasons I can't quite figure out yet. In /etc/audit/audit.rules on a client machine:
# First rule - delete all
# Increase the buffers to survive stress events.
# Make this bigger for busy systems
# Feel free to add below this line. See auditctl man page
-w /auto/ -p r -k read -k home
-w /auto/ -p w -k write -k home
-w /auto/ -p xa -k other -k home
...where I've given separate keys to reading, writing, and executing/changing attributes. My clients are autofs'd to mount a few different NFS directories, including their home directory, to
/auto/ with soft links pointing the client machine's
/home/users/ back to
/auto/. I get logging of lots of stuff, but none of the files the users themselves seem to be modifying.
Troll the audit logs with
ausearch -k read | aureport -f, for instance. grepping for .ODT or .PDF comes up with nothing, the only results are for metacity's configs, Chrome's crap, etc., etc.
Naturally, enabling audit on the server pointing at the real
/home/users/XYZ only shows accesses from things interfacing with the server directly (mail clients) or users SSH'd into the server.
If you can figure out the right recipe for audit, or a dedicated solution all together, please, please, please share it! You'd think this would have been solved in 1993.