Collect audit logs into one or more central repositories.

By collecting logs from your systems into a central repository (e.g. a syslog server) you can setup a SIEM. Using a security information and event management (SIEM) system you can better analyze logs in your system to identify security incidents.

Setup a syslog server and direct the logs collected by your systems to it. This can be accomplished by installing event log forwarders on your systems or by using existing settings to forward your logs.