Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place?
I was thinking about the following:
- Date and time of access for every user
- User IP
- Number of consequent login attempts
- Session length
- Data entered in form fields (to see if anybody is trying an SQL injection)
What other data should be logged, especially as far as security is concerned?
Also, do you think that the last point of the list can make some sense? Of course, only non-sensitive data would be collected, for example search queries.