First, launch the Event Log and click the node for "Subscriptions" on the server. You'll be asked to start the Windows Event Collector Service and configure its start mode to Automatic. This service handles collecting Event Logs from your remote machines.

In our example, the Vista client is the "forwarder computer." The forwarder computer forwards events to the "collector computer," which is our Server 2008 box. Both machines must be running the Windows Remote Management (WinRM) service and the server has to be running the Windows Event Collector Service. To start and automatically configure this service, enter the following at the command prompt on each computer: winrm quickconfig.

[snip]

Once you've finished these steps, you can create a subscription. Subscription data can flow in either direction depending on how you set it up. You always start by creating a subscription at the subscriber computer. Identify the source computers from which it will pull data. From the Subscriptions node in the Event Log, right-click and choose to "Create Subscription." Give the subscription a name and a description. Then choose the destination log where you want to store the incoming data.

The full article includes some great technical detail on the types of subscriptions you can create and why you would want to create them. Its worth a look.

Check it out at:
http://redmondmag.com/columns/article.asp?editorialsid=1868