Are you trying to develop an ap to check on employee time-useage/conduct/productivity by recording ALL uses of those workstations?

In other words, do you care more about how long Excel is open than about whether the user cranked up sol.exe?

and if yes to the above, do you have some sort schema for determining the utility of whatever product the user creates with Excel (and, for example, whether Excel's "save" events occur because of user input or mere scheduled_backup_saves)?

I guess it's your use of "all the events" that troubles me; if you can't evaluate employee performance by means more effective than event_logging, your question needs answers from an MBA, not a japh.

FWIW, I don't assume the above is your intent, but suggest you update your post with a clear explanation of what you are trying to do.