Different ways to monitor activities on your Web server.

I can't answer questions about web sites like the academic "one size fits all" model. What needs to be monitored depends on what information is on the site that would cause problems if security breached or what problems would it produce if there is a malfunction on the server. For example, a stock trading web site should log failed login attempts and data transfers on customer's accounts so errors can be corrected if the server goes down. A bakery wouldn't require that but should log changes in customer comments in case a competitor gets on there saying that their brownies taste like sawdust.

In order to successfully make a commercial web server work, you have to let the products and skeletal structure of the site dictate what needs to be monitored.