From c8b2698754002c8d8b59d6ea60fa4350ca793102 Mon Sep 17 00:00:00 2001
From: Jon Siwek <jsiwek@ncsa.illinois.edu>
Date: Mon, 29 Aug 2011 12:28:38 -0500
Subject: [PATCH] Add a log postprocessing function that can SCP rotated logs
 to remote hosts.

---
 .../frameworks/logging/postprocessors/scp.bro | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 scripts/base/frameworks/logging/postprocessors/scp.bro

diff --git a/scripts/base/frameworks/logging/postprocessors/scp.bro b/scripts/base/frameworks/logging/postprocessors/scp.bro
new file mode 100644
index 0000000000..f27e748ae5
--- /dev/null
+++ b/scripts/base/frameworks/logging/postprocessors/scp.bro
@@ -0,0 +1,42 @@
+##! This script defines a postprocessing function that can be applied
+##! to a logging filter in order to automatically SCP (secure copy)
+##! a log stream (or a subset of it) to a remote host at configurable
+##! rotation time intervals.
+
+module Log;
+
+export {
+	## This postprocessor SCP's the rotated-log to all the remote hosts
+	## defined in :bro:id:`Log::scp_destinations` and then deletes
+	## the local copy of the rotated-log.  It's not active when
+	## reading from trace files.
+	global scp_postprocessor: function(info: Log::RotationInfo): bool;
+
+	## A container that describes the remote destination for the SCP command
+	## argument as ``user@host:path``.
+	type SCPDestination: record {
+		user: string;
+		host: string;
+		path: string;
+	};
+
+	## A table indexed by a particular log writer and filter path, that yields
+	## a set remote destinations.  The :bro:id:`Log::scp_postprocessor`
+	## function queries this table upon log rotation and performs a secure
+	## copy of the rotated-log to each destination in the set.
+	global scp_destinations: table[Writer, string] of set[SCPDestination];
+}
+
+function scp_postprocessor(info: Log::RotationInfo): bool
+	{
+	if ( reading_traces() || [info$writer, info$path] !in scp_destinations )
+		return T;
+
+	local command = "";
+	for ( d in scp_destinations[info$writer, info$path] )
+		command += fmt("scp %s %s@%s:%s;", info$fname, d$user, d$host, d$path);
+
+	command += fmt("/bin/rm %s", info$fname);
+	system(command);
+	return T;
+	}