Monitoring User logins and failed logins

I want to know where all this gets logged.
Does it A get logged on PDC and BDC dependent on what server answers the request ??
If you fail to login to a Domain why does the failure get logged at the Workstation not the PDC or BDC ??
Is there anything within NT that will bring all these events together or do I have to use a third party product. (prefer to do it real time if I can )