Is this of interest? 

If you want this in a different format let me know e.g. standard patch. 
You can just copy the files in the repo to their respective locations in SO.

Hi Jon,

I like the idea!  Thanks for the patch.

Some feedback on nsm_sensor_clean:

- looks like the --skip-both option is setting SKIP_REMOVAL=ARGUS.  Should that 
be SKIP_REMOVAL=BOTH?

- instead of having folks edit the sensor-clean cronjob, what if it were a 
config option in /etc/nsm/securityonion.conf?  See WARN_DISK_USAGE and 
CRIT_DISK_USAGE near the end of the file, right above the sensor_cleandisk call.

Some feedback on lib-nsm-sensor-utils:

- Should the following line be checking for "BRO" instead of "$BRO"?

            if [ "$SKIP_REMOVAL" == "NONE" ] || [ "$SKIP_REMOVAL" == "$BRO" ]

Thanks!

Applied fixes [1] and suggestion [1][2]. Thanks.


 -          if [ "$SKIP_REMOVAL" == "NONE" ] || [ "$SKIP_REMOVAL" == "$BRO" ]
 +          if [ "$SKIP_REMOVAL" == "NONE" ] || [ "$SKIP_REMOVAL" == "BRO" ]

-           SKIP_REMOVAL=ARGUS
+           SKIP_REMOVAL=BOTH

+SKIP_REMOVAL=NONE
  CONF="/etc/nsm/securityonion.conf"

  if [ -f $CONF ]; then
 @@ -190,6 +191,7 @@ if [ -f $CONF ]; then
    # If $CONF doesn't have these variables, add them
    grep WARN_DISK_USAGE $CONF >/dev/null || echo "WARN_DISK_USAGE=80" >> $CONF
    grep CRIT_DISK_USAGE $CONF >/dev/null || echo "CRIT_DISK_USAGE=90" >> $CONF
 +  grep SKIP_REMOVAL    $CONF >/dev/null || echo "SKIP_REMOVAL=NONE"  >> $CONF
  fi

Add SKIP_REMOVAL to so setup [2]


[1]https://github.com/jonschipp/securityonion/commit/cca7969f2cea24ff8bc5c9088dc
50a44924f5495#diff-58c73f792d9d1289600ba4567f56ec40R194/#196
[2] 
https://github.com/jonschipp/security-onion/commit/27c4f25b97605bb82319709513165
0976aa70122

Thanks, added to Roadmap!