I think i figured out the problem
A mistake on my part.  I actually added the permissions to the EventLog folder in the registry and it should be to the Security folder under it. 
I added the permissions today and will try to enable the audit during the next outage, but I am sure it will work.