Great! Thanks, but how do I know what files to scan??

That really depends upon your level of paranoia and the amount of log reading you want to do. I've got mine set up to scan the entire system except for a few directories that change constantly. I've excluded /sys, /dev, /proc and /tmp for pretty much that reason. Now be aware that many crackers will work in /tmp precisely for the same reason: it changes so much that people rarely really monitor it. I'm going on the assumption that if I do get cracked, the bad guys will have to first modify files in directories that I do monitor before they can really set up shop in /tmp. I also exclude several directories in /var like /var/logs and /var/lib/mysql where I've got my databases stored and I also exclude my /home directory. They just created too much noise in the reports.

It ends up being a little bit of give and take to find the number of directories to monitor versus the size of the report Aide will generate. I would start by monitoring a bit much and then pare back as you learn what directories just generate noise. But like I said, where that line is drawn is pretty much dependent on your own level of paranoia.