#!/bin/sh

test -e /usr/sbin/aris-extractor || exit 0
test -e /etc/aris-extractor/config || exit 0

if test -e /var/log/snort/portscan.log; then
    SNORT_PORTSCAN="-f /var/log/snort/portscan.log"
fi

. /etc/aris-extractor/config

if test -n "$LOCALNETS" -a -n "$ANONYMIZE"; then
    ANONYMIZE="-c $LOCALNETS"
fi

HOME=/var/lib/aris-extractor \
aris-extractor -a /etc/aris-extractor/auth \
    -q \
    $SNORT_PORTSCAN \
    $ANONYMIZE \
    /var/log/auth.log
