Anyone has a list of auditable events for web server?

I need to identify events on web server logs (access and errors) in order to audit them and make sure no one does something they shouldn't in my company. I'd need to know how the events look like, like this:



Startup event:

info ( 2021): CORE1116: Sun ONE Web Server 6.1SP6 B05/07/2006 12:33

info ( 2022): CORE3016: daemon is running as super-user

info ( 2022): CORE5076: Using [Java HotSpot(TM) Server VM, Version 1.4.2_04] from [Sun Microsystems Inc.]

info ( 2022): WEB0100: Loading web module in virtual server [vs-admin] at [/admin-app]

info ( 2022): HTTP3072: [LS ls1] https://test.corp.com.mx:2020 ready to accept requests





I'd basically need to know how the configurations like deleting servers, changing super-user settings, cluster creation, etc look like.



Anyone has a list of this kind? or know where to find it? I've been searching online but can't find it.



ThanksAnyone has a list of auditable events for web server?
tripwire

IDP www.snortsam.net

install prelude http://www.prelude-ids.org/

icons for myspace

structuretoptr