So ... I have this thing fairly stable. 14 /etc items seem to change daily due to their chron or daemon execution. Can live with this. (Results with alternatives such as aide should be similar--the ideal monitoring package would track upgrades and logrotations et al and not squawk at these.) RIght now, I have /var and /proc excluded because of their volativity. I assume there are specific items/directories in these which SHOULD be monitored. Can anyone tell me which ones?