Added the following to /usr/local/lib/nsmnow/lib-nsm-sensor-utils:


# Initialize REMOVED to "no".
        # We recursively run this job until one of the following conditions exist:
        # - there are no more files/dirs to delete (REMOVED=no even at the end)
        # - disk is under $CRIT_DISK_USAGE
        REMOVED="no"

        # find the oldest Bro logs directory and exclude today
                OLDEST_DIR=$(ls /nsm/bro/logs/ | grep -v "current" | grep -v "stats" | sort | grep -v $TODAY | head -n 1)
                if [ -z "$OLDEST_DIR" -o "$OLDEST_DIR" == ".." -o "$OLDEST_DIR" == "." ]
                then
                        echo_msg 1 "${RED}no old Bro logs available to clean up in /nsm/bro/logs/"
                else
                        echo_msg 1 "removing directory: /nsm/bro/logs/$OLDEST_DIR"
                        rm -rf /nsm/bro/logs/"$OLDEST_DIR"
                        REMOVED="yes"
                fi

Packaged:
/usr/local/lib/ruby/gems/1.9.1/gems/fpm-0.3.11/bin/fpm -s dir -t deb -n 
securityonion-nsmnow-admin-scripts -v 20120125 /etc/init.d/nsm* 
/usr/share/nsmnow/ /usr/local/sbin/nsm* /usr/local/lib/nsmnow/ 
/etc/cron.d/sensor-* /etc/cron.d/nsm* /etc/cron.d/bro* 
/etc/init/securityonion.conf

Published:
http://securityonion.blogspot.com/2012/01/security-onion-20120125-now-available.
html