I'd argue auditing needs to be in the database when it affects data or legal requirements. App logging certainly should always be included.