I am using Lasso to collect Windows logs.  http://sourceforge.net/projects/lassolog
 
The big advantage to Lasso is that you don't have to install it on every server.   One server does all the work for the whole enterprise.   Also, it's is open source and free. 
 
This software seems to be working ok.   It fails to decode a small percentage of events, but I think that's not a show-stopper.
 
-Sam

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Burns Andrew
Sent: Tuesday, August 07, 2007 5:46 PM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng] Compatability with Windows?

Hi, I'm trying out Syslog-NG, and it's been working well with Linux, but I've been asked to start monitoring the eventlog of Windows 2000 Servers and Windows 2003 Servers. Is there a plugin or can Syslog-NG read those eventlog entries natively if they are sent to the Syslog-NG server? Any suggestions or tips are appreciated.

Thanks,
 
Andrew