Report question

Question: What's the best approach in auditing a big java/j2ee web application