Managing Log Files in Windows Server

Question

I have a web application that runs on Windows Server (some 2003, some 2008).

I want to log system events (e.g. someone from IP address X successfully logged in remotely via remote desktop to this computer, or system user Bob added file abc.exe or changed permissions on file log.txt)

Two questions

1. How do people usually log these system events as I described in Windows Server 2003/2008?

2. Assuming I have several different servers, and I also have application specific logging done at the application layer (and possibly other things like load balancer logs, etc), I am now stuck with several different log files (possibly in different formats) across multiple servers. What tools/methods do people use to manage this data?

Answer 1

1. System events are logged into windows eventlog. To log file access and manipulation, you will probably need to enable auditing.
2. You should probably set up centralized logging using a tool such as snare agent or similar. There is also splunk.