[ActiveDir] security event log audits

[Creamer, Mark]

Has anyone had success putting together something home-grown to centralize security event logs into a sql database? If so, I wanted to get some tips on how the tables should be set up – can all events that are captured in the security log be placed in the same table, or do different events have their own structure and would have to go into separate tables?   Also, I’m familiar with EventCombMT and eldump – are there any other tools I should be considering to pull the data? I’m assuming I’ll need to use something like one of those to act as the middleware between the logs and the database.   Thanks…   Mark Creamer Systems Engineer Cintas Corporation Honesty and Integrity in Everything We Do