Project Sauron; the all seeing eye! Here's some documentation on doing windows event forwarding and storage
Introducing Project Sauron - Centralised Storage of Windows Events - Domain Controller Edition
Introducing Project Sauron: Centralised Storage of Windows Events