## Type (ignore/directory/global/notify), 
# <watch>,<directory>,realtime <yes/no>,check_all <yes/no>,check_sum <yes/no>,check_sha1sum <yes/no>,check_md5sum <yes/no>, check_size <yes/no>, check_owner <yes/no>, check_group <yes/no>, check_perm <yes/no>, report_changes <yes/no>, restrict <sregex> 
watch,/etc,yes,yes,,,,,,,,yes,
watch,/var/ossec,yes,yes,,,,,,,,yes,
watch,/bin,yes,yes,,,,,,,,no,
watch,/lib,yes,yes,,,,,,,,no,
watch,/lib64,yes,yes,,,,,,,,no,
watch,/opt,yes,yes,,,,,,,,no,
watch,/sbin,yes,yes,,,,,,,,no,
watch,/usr/bin,yes,yes,,,,,,,,no,
watch,/usr/lib,yes,yes,,,,,,,,no,
watch,/usr/lib64,yes,yes,,,,,,,,no,
watch,/usr/local/bin,yes,yes,,,,,,,,no,
watch,/usr/local/lib,yes,yes,,,,,,,,no,
watch,/usr/local/sbin,yes,yes,,,,,,,,no,
#watch,/var/www/vhosts,yes,yes,,,,,,,,yes,.php|.js|.html

# <ignore>,<directory/type>, <sregex>
ignore,/etc/asl/VERSION,
ignore,/etc/mtab,
ignore,/var/ossec/queue,
ignore,/var/ossec/logs,
ignore,/var/ossec/stats,
ignore,/var/ossec/var,
ignore,/var/ossec/etc/rules.d,
ignore,/etc/mnttab,
ignore,/etc/grsec/learning.logs,
ignore,/etc/hosts.deny,
ignore,/etc/mail/statistics,
ignore,/etc/random-seed,
ignore,/etc/adjtime,
ignore,/etc/httpd/logs,
ignore,/etc/utmpx,
ignore,/etc/wtmpx,
ignore,/etc/cups/certs,
ignore,/etc/httpd/modsecurity.d/,
ignore,/etc/httpd/logs/,
ignore,/etc/httpd/domlogs/,
ignore,/var/ossec/bin/.process_list,
ignore,/usr/local/psa/handlers.default/,
ignore,/usr/local/psa/admin/logs/,
ignore,/etc/mail/spamassassin/bayes/,
ignore,/etc/webmin/virtual-server/,
ignore,/usr/local/atmail/calendarserver/server/logs/,
ignore,/etc/mail/spamassassin/.razor,
ignore,/etc/relayhostusers,
ignore,/etc/relayhosts,
ignore,/etc/eximpopbeforesmtpwarning,
ignore,/etc/prelink.cache,
ignore,/etc/csf/stats/,
ignore,/etc/webmin,
ignore,/etc/dcc/log,
ignore,/etc/dcc/map,
ignore,/etc/prelink.cache,
ignore,/usr/local/psa/var/cgitory,
ignore,/usr/libexec/aqueduct,
ignore,/etc/portsentry/portsentry.history,
ignore,/etc/asl/aslw_aum.log,
ignore,/var/ossec/active-response/ossec-hids-responses.log,
ignore,/etc/snmp/error_log,
ignore,/var/ossec/etc/,
#ignore,type,.foo$|.bar

# Global options

# <global>,frequency <0-9999999>, scan_time <time>, scan_day <day>, auto_ignore <yes/no>, alert_new_files <yes/no>, scan_on_start <yes/no>
global,86400,,,,,,

# <notify>,<directory>,<level>,<email>
