|
There is no definitive answer. That depends on what is installed and run on your particular system.
Genrally, you should monitor all directories except those that are subject to frequent changes by design. i.e., exclude /tmp, /var/tmp and probably most of /var, user's home directories, application data directories.
|
