/etc
/etc/logrotate.d
/etc/logrotate.d/ossec-hids
/var
/var/ossec
/var/ossec/active-response
/var/ossec/etc
/var/ossec/etc/shared
/var/ossec/queue
/var/ossec/queue/ossec
/var/ossec/var