You have the option of archiving Windows NT event logs in their native format (.evt), text format or comma-delimited format. Which is best? There is no simple answer. It really depends on why you are archiving these logs.

.evt format has the advantage that all possible data including binary data is preserved. One disadvantage is that the data can only be viewed one log file at a time and only by the event viewer. If old .evt logs are viewed at a later date, it is possible that the descriptions displayed will not match what would have been seen if the .evt log had been viewed at the point in time where the .evt file was archived. Descriptions are stored in .dll files of the operating system, not in the .evt data. Depending on when the archives are viewed, the "true-to-at-point-of-archiving" is questionable. If you backup the server and the event logs and use the restored server to view the restored event logs, the accuracy of what you are viewing is guaranteed. Keep lots of tapes. Verify that you can restore the server archived. This will satisfy the most rigourous legal and forensics requirements IF the chain of control is maintained. If the tapes are dumped and stored under lose control, forget it.

Q165959 - Reading a File Saved with the Event Viewer of Another Computer
Q157399 - Inconsistent Descriptions When Using Event Viewer

Text and comma-delimited formats discard binary data which may be inappropriate for forensic or legal requirements. Comma-delimited data can be easily moved to databases such as SQL for centralized processing. It is possible to manually or programmatically to process such centralized data for patterns of activity (intrusions) that are difficult or impossible in isolation. More and more commercial products use this approach. Text format has the advantage of simplicity. It can also be a starting point for processing using mature unix-oriented data manipulation utilities. A mixed situation is the use of tools like dumpel.exe which can dump event log file data. It dumps the text data and translates the much of the hex data to readable text formats.

My final point is that this is not an either-or situation. Save your checkpoint full backups and use extracted text or comma-delimited copies for programmatic processing. From a pure security perspective, extracting event logs to sql databases for security analysis is a best practice.

Check out these commercial products which support centralizing event log data to sql databases:
Aelita's EventAdmin

Event Log Tips:

Archiving Event Logs
Event Log explained
How to Delete Corrupt Event Viewer Log Files
Forensics: CrashOnAuditFail
Restrict access to Application and System event logs
Security Event Descriptions
Security Events Logon Type Definitions
Security Log Location
Suppress Browser Event Log Messages
Suppress Prevent logging of print jobs
System events in NT4 SP4
User Authentication with Windows NT
User Rights, Definition and List

Frank Heyne has made available a Windows NT Eventlog FAQ .

Book Recommendation: