Best practice configuration

Hi guys,

Sorry for the lack of knowledge but i am a new syslog and kiwi world. I purchased kiwi server with the inter to monitor three areas of my network,

1 - failed login attempts on servers and workstations

2 - bandwidth spikes on the firewalls if all possible by service e.g. smtp (all sonicwalls)

3 - bandwidth spikes on workstation

Can someone guide me to where i can find any documentations to configure the server to alert on the above, or am i asking for too much out of the kiwi server.

Thanks

Rudy