List events to monitor
Authentication/authorization decisions (including logoff)
System and data access
System and application changes (especially privileged changes)
Data changes, such as adding, editing, or deleting data
Invalid input (possible malicious injection, threats, etc.)
Resources (RAM, disk, CPU, bandwidth, or any other resource that has hard or soft limits)
Health and availability
Startups and shutdowns
Faults and errors
Circuit breaker trips
Delays
Backup success/failure
etc.