Log4J is pretty much the "standard" for logging in the
Java world - so I'd suggest that - but there are a few
special things you have to do to get Log4J working in a
J2EE environment.
Filters and listeners will work for detecting when a user logs in or out, and you can use Log4J inside the filter/listener to actually write to the log. It's not going to work for the case when the user adds or deletes a record - this stuff should be handled at a lower level and a filter/listener shouldn't be able to detect this. (You can still use log4j - but in the code that's doing the add/delete of the record, not in a filter/listener.)
I haven't used Spring/AOP, so I can't really help you there...