Q) In this situation, what is the correct way to monitor the file share ?
A) A file server failover cluster can be built in different ways, listing some of them:
1. using file server role, the target item can be specified as UNC path using network name of the file server role (e.g. \\network name of file server role\share) or like computer object (e.g. FQDN, netbios, IPv4 of of file server role)
2. without file server role, here you can specify the target item using the cluster name the same way as described in first point, like UNC path or computer object.
Following the above mentioned settings, Netwrix Auditor automatically checks for active cluster node and collect the data accordingly.
If anything does not make sense, please feel free to ask.