[ossec-dev] Re: New: We need a place to keep custom decoders

[Jeff Schroeder <jeffschroed@xxxxxxxxx>]

A really common way to solve this is via a ".d" directory full of
includes. Perhaps something like
/var/ossec/etc/decoders.d/ would be a better way to do this? Then /var/
ossec/etc/decoders.xml
could change to /var/ossec/etc/decoders.d/default.xml and any other
xml files in that directory
would be read.

This would make seamless upgrades where /var/ossec/etc/decoders.d/
default.xml would be
overwritten and the installer wouldn't know about the other *.xml
files in that directory. It would also
allow upstream packages to ship with ossec decoders. Does this sound
like a good idea?