In the process of planning for an upcoming deployment of an AD structure with a single forest, a top level empty root domain and two child domains—which will house two business units. Within each business unit there are 30 remote sites and head-quarters site. In opting to configure auditing in multiple items, the amount of security logs in the network will grow very quickly. Based on the details given, my question is; what tools does Microsoft (and other third-party) vendors have available to make gathering and interpreting of logs easier? If any, is it freeware, paid, or both? All help is greatly appreciated, thanks in advance.
Microsoft gives you squat, for free. You can get SCOM, the current version of MOM. They have a piece of it that is dedicated to log auditing. There are plenty of other commercial products too. You could roll your own with NTSysLog and a syslog server, running commercial or freeware on Linux or Windows. What's your budget?
Second question - What's your actual goal with the auditing? You say "gathering and interpreting", so it sounds like you expect someone to either spend some time with these logs, or react based on alerts. Can you flesh out what the planned usage is going to be?