Q:

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.
Is there a list of important OS files (windows/linux) that must be monitored (by best practice)? I am familiar with Linux but not with windows so I can't seem to find what binaries and/or config files to monitor as a best practice.

A:

You should monitor (nearly) all the files.
Assuming that this system is just a hash database, then there are some files you should skip:

everything in /proc (there's a lot of useful stuff in here for root kit hunters though)
log files  (there are tools will will do heuristic analysis of these files)
files which contain filesystems (this would include loop-back filesystems and database files - but you probably want to check the 'files' inside the file).
swap space

(the difficult bit is setting up a process for auditing the changes properly)

