We're running 4.0.003214 on our FS8600 clusters and have successfully configured SACL logging. However, it isn't proving to be very useful because there are limited capabilities in Enterprise Manager and I can only export 1,000 audit entries manually at a time through the "control-S" reporting feature.  I have a few questions in hopes to make this feature more useful:

1. How many SACL entries are kept?  
2. Are there any third party tools (ex: a SIEM) that can get the SACL audit entries out of the FS8600 so they can be searched / stored in a better manner?  We have SolarWinds LEM but there doesn't seem to be a way to integrate it.
3. Are there any suggestions on how to use this more effectively?  It seems like the feature was implemented without any use cases, or maybe it's something that will be expanded on in future releases?

FYI we have a requirement to log access to certain file systems.  I want to be able to audit what staff has access to periodically so I can clean up security rights.  At times people have overwritten or deleted files and having this functionality work would make life a lot easier in figuring out what happened.

Thanks,

Adam