I am fine tuning a Tripwire installation and want to see if anyone out there has any recommendations on what files, logs, etc, you might monitor for tampering?  At present I have a combination of files, logs, etc, that are monitored, however, I'd like to know if anyone has other recommendations