I always vote to put jar files in the web-inf\lib directory, as opposed to the servers app directory. I wrote an article on application packaging and classloaders that you might find interesting:
How to package J2EE applications: Classloaders and lib directories
Here's the thing - say you've got xerces1.1.jar in your shared\app folder. Then, one of your 1000 apps wants to use xerces2.0? You've got to update and
test ALL 1000 apps before this one app can move.
Alternatively, if each app puts it's xerces jar in its local WEB-INF\lib directory, the app can be upgraded to a newer version without bothering all of the other 1000 apps on the server.
Of course, if all the apps hit the same db2, then the db2 driver should be on the shared\apps folder. For that matter, when you upgrage to a newer version of db2, all apps will have to update at the same time, so there it makes sense.
Indeed, putting things int he web-inf\lib directory will require a re-deploy of the app. Hopefully, though, updating a jar file is a very controlled, and regression-tested process that doesn't happen all that often.
As with most J2EE things, there are no right answers, there are only wrong answers. If you can manage not to get a wrong answer, you're doing good.
-Cameron McKenzie