Content of RPM ossec-hids-commons-2.8.3-20.1.noarch.rpm :
/etc/logrotate.d/ossec-hids
/etc/ossec
/var/adm/fillup-templates/sysconfig.ossec-hids
/var/lib/ossec
/var/lib/ossec/active-response
/var/lib/ossec/active-response/bin
/var/lib/ossec/active-response/bin/disable-account.sh
/var/lib/ossec/active-response/bin/firewall-drop.sh
/var/lib/ossec/active-response/bin/host-deny.sh
/var/lib/ossec/active-response/bin/ip-customblock.sh
/var/lib/ossec/active-response/bin/ossec-tweeter.sh
/var/lib/ossec/active-response/bin/restart-ossec.sh
/var/lib/ossec/active-response/bin/route-null.sh
/var/lib/ossec/agentless
/var/lib/ossec/agentless/main.exp
/var/lib/ossec/agentless/register_host.sh
/var/lib/ossec/agentless/ssh.exp
/var/lib/ossec/agentless/ssh_asa-fwsmconfig_diff
/var/lib/ossec/agentless/ssh_foundry_diff
/var/lib/ossec/agentless/ssh_generic_diff
/var/lib/ossec/agentless/ssh_integrity_check_bsd
/var/lib/ossec/agentless/ssh_integrity_check_linux
/var/lib/ossec/agentless/ssh_nopass.exp
/var/lib/ossec/agentless/ssh_pixconfig_diff
/var/lib/ossec/agentless/sshlogin.exp
/var/lib/ossec/agentless/su.exp
/var/lib/ossec/bin
/var/lib/ossec/etc
/var/lib/ossec/etc/shared
/var/lib/ossec/etc/sql
/var/lib/ossec/etc/templates
/var/lib/ossec/etc/templates/active-response.template
/var/lib/ossec/etc/templates/apache-logs.template
/var/lib/ossec/etc/templates/ar-disable-account.template
/var/lib/ossec/etc/templates/ar-firewall-drop.template
/var/lib/ossec/etc/templates/ar-host-deny.template
/var/lib/ossec/etc/templates/ar-routenull.template
/var/lib/ossec/etc/templates/pgsql-logs.template
/var/lib/ossec/etc/templates/rootcheck.template
/var/lib/ossec/etc/templates/rules.template
/var/lib/ossec/etc/templates/snort-logs.template
/var/lib/ossec/etc/templates/syscheck.template
/var/lib/ossec/etc/templates/syslog-logs.template
/var/lib/ossec/logs
/var/lib/ossec/queue
/var/lib/ossec/queue/diff
/var/lib/ossec/queue/ossec
/var/lib/ossec/queue/syscheck
/var/lib/ossec/tmp
/var/lib/ossec/var
/var/lib/ossec/var/run
/var/log/ossec