1. The jBPM web app has some monitoring pages that give the global perspective of the deployed process and each specific instance. By default you need no role to see them, i.e. everyone can see them. Assuming access to your database is protected, you can limit access to those pages using the security mechanisms defined in the servlet spec.
2. Obtain the LoggingSession from the JbpmSession in v3.0.x or JbpmContext in v3.1. Use the methods there to obtain the log entries for a whole process instance or a specific token. The log entries are instances of ProcessLog, which is an abstract class. Its concrete subclasses (TokenCreateLog, NodeLog, TaskLog...) give you all the information captured by jBPM about the process executions.
Alternatively, you can use Hibernate to query the database directly and extract useful information, such as the average time spent in a task.
Thank you very much! I'm worried about the changes in the objects in the different versions, JbpmSession and JbpmContext in 3.1. I assume the best will be to follow v3.1, as developer, what would you suggest? I'm currently developing an appl that should be working in 2-3 weeks and i wonder if my development will be able to work in future versions of jBPM. Thanks for your advice and support!