In /usr/local/sbin/nsm_sensor_add, changed this:

for DIR in "/nsm/sensor_data/$SENSOR_NAME/dailylogs" 
"/nsm/sensor_data/$SENSOR_NAME/portscans" "/nsm/sensor_data/$SENSOR_NAME/sancp" 
"/etc/nsm/$SENSOR_NAME/rules"

to this:


for DIR in "/nsm/sensor_data/$SENSOR_NAME/dailylogs" 
"/nsm/sensor_data/$SENSOR_NAME/portscans" "/nsm/sensor_data/$SENSOR_NAME/sancp" 
"/etc/nsm/$SENSOR_NAME/"

In /usr/local/sbin/nsm_sensor_add, changed this:


# copy the templates
cp -a /usr/share/nsmnow/templates/snort/* /etc/nsm/$SENSOR_NAME


to this:


# copy the templates
# the only thing that exists in /usr/share/nsmnow/templates/snort/ now is an 
old rules directory which we don't need
#cp -a /usr/share/nsmnow/templates/snort/* /etc/nsm/$SENSOR_NAME

Packaged:
/usr/local/lib/ruby/gems/1.9.1/gems/fpm-0.3.11/bin/fpm -s dir -t deb -n 
securityonion-nsmnow-admin-scripts -v 20120202 /etc/init.d/nsm* 
/usr/share/nsmnow/ /usr/local/sbin/nsm* /usr/local/lib/nsmnow/ 
/etc/cron.d/sensor-* /etc/cron.d/nsm* /etc/cron.d/bro* 
/etc/init/securityonion.conf

Added the following to security-onion-upgrade.sh:

sed -i 's| |=|g' $CONF
source $CONF
if [ "$VERSION" = "20120125" ]; then
        NEW="20120202"
        echo "**********************************************"   | $LOGGER
        echo "* Upgrading from $VERSION to $NEW."               | $LOGGER
        echo "**********************************************"   | $LOGGER
        DIR="/nsm/backup/$NEW"
        mkdir -p $DIR                                           | $LOGGER
        cd $DIR

    echo "* Installing new NSM scripts"         | $LOGGER
    FILE=securityonion-nsmnow-admin-scripts_"$NEW"_i386.deb
    wget -q http://sourceforge.net/projects/security-onion/files/$NEW/$FILE -O $FILE | $LOGGER
    dpkg -i $FILE                       | $LOGGER

        sed -i "s|VERSION=$VERSION|VERSION=$NEW|g" $CONF        | $LOGGER
        echo "* Upgrade to $NEW complete."                      | $LOGGER
        echo 
fi

Published:
http://securityonion.blogspot.com/2012/02/security-onion-20120202-now-available.
html