It's not enabled by default. You need to even event logging for syslog servers. This can be sent to a syslog server or written to a file.
Configure Event Logging for Syslog Servers
