Explanation/Reference:
Explanation:
Chapter 8 Lesson 1 p 302 - 305
A. Configure event subscriptions.
Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers.
Windows 7 includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally.
Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.
B. Configure the Advanced Audit Policy Configuration settings.
http://technet.microsoft.com/en-us/library/dd408940(WS.10).aspx
C. Create a custom view in Event Viewer.
You can create a filter that includes events from multiple event logs that satisfy specified criteria. You can then name and save that filter as a custom view. To apply the filter associated with a saved custom view, you navigate to the custom view in the console tree and click its name.
D. Create a user-defined Data Collector Set.
You can create a custom Data Collector Set containing performance counters and configure alert activities based on the performance counters exceeding or dropping below limits you define.
After creating the Data Collector Set, you must configure the actions the system will take when the alert criteria are met.
Membership in the local Performance Log Users or Administrators group, or equivalent, is the minimum required to complete these procedures.

http://www.youtube.com/watch?v=4xxKPgT5irU
http://www.youtube.com/watch?v=fKelHBve57k