Our current NetApp auditing support is based on remotely accessing the .evt formatted audit trail info (once CIFS auditing is enabled on the OnTAP side). You configure the NetApp connector (under "Operating Systems") on an agent that can remotely access the NetApp system by UNC path.
(There are some service messages that I believe are logged via syslog, but it likely does not include the audit trails...)