I'm writing to this forum, as a sec analyst who is responsible for analyzing logs for security related issues.

I'm tasked to see / observe using "websphere application server" what possible security issues can be identified using syslogs.

At the very basic I'm looking for following:-

1.    What activity was performed?
2.    Who or what performed the activity, including where or on what system the activity was performed from (subject)?
3.    What the activity was performed on (object)?
4.    When was the activity performed?
5.    What tool(s) was the activity was performed with?
6.    What was the status (such as success vs. failure), outcome, or result of the activity

But without being too involved under the context of each application , its use and environment what the best identify "data" related to above generic requirements.

As far is "auditing" is concerned I have already gone to this doc

ftp.software.ibm.com/software/iea/conten...

I'm more concerned from web-request, http traffic , session, access to important servlets and perhaps more important If a form on page has received a malformed request e.g sql injection,xss how will that info be logged. Considering, this info has escaped from other parameter controls .

Thanks.