Great article Geoff!

I have used a trace-based approach in previous jobs to accomplish several monitoring tasks. It is basically as follows:

1.- Create a trace to capture whatever information you want to 'audit'

2.- After 5 minutes (or whatever amount of time you like), close the running trace and open a new one

3.- Inspect the previously closed trace and if it's not empty send an email notification, you might want to attach the .trc file

4.- Repeat from step 2

One of the disadvantages is that one is not notified right after the event occurred, but some minutes later. In the case of deadlocks I'd rather read the graphical version of the deadlock graph instead of the info that is dumped in the error log, but it's just a matter of personal preferences.