Why not something like /var/ossec/etc/decoders.d/*.xml being included when ossec starts up?
Examples of where this is already used: SysV init: /etc/init.d/, /etc/rc[2345].d/, or /etc/init.d/rc[2345].d on suse Debian's repository listing: /etc/apt/sources.list.d/ vixie-cron: /etc/cron.d/ xinetd: /etc/xinetd.d/ ... This seems like the cleanest solutions for everyone. Daniel, what do you think?
