SUPPORTUTILS-SCRUB(8)

📦 version 1.5, in opensuse-leap 16.0

💅 supportutils-scrub(8) — the Support Utilities Manual, bestie edition

okay so before we even get into it: this is supportutils-scrub, and it lives in the Support Utilities Manual section 8. Yes, section 8, the "admin commands" section, we love a system-level icon. Let's go 🎀

✨ NAME ✨

supportutils-scrub — literally obfuscates sensitive data out of SUSE supportconfig tarballs and network packet captures. scrub-a-dub-dub, privacy's in the tub 🛁

🌸 SYNOPSIS 🌸

supportutils-scrub TARGET [OPTIONS]
supportutils-scrub ARCHIVE1.txz ARCHIVE2.txz [ARCHIVE3.txz ...] [OPTIONS]
cat logfile | supportutils-scrub [OPTIONS]
supportutils-scrub - [OPTIONS]
supportutils-scrub --rewrite-pcap --mappings FILE --pcap-in FILES [OPTIONS]
supportutils-scrub mappings.json.enc

six whole ways to call her. she's versatile like that 💅

🦋 DESCRIPTION 🦋

so supportutils-scrub is a utility designed to sanitize and remove sensitive or unwanted data from SUSE supportconfig tarballs, directories, plain log files, and network packet captures. it's the friend who scrubs your group chat screenshots before you post them, except it's for your organization's data protection policies, privacy requirements, and GDPR compliance standards. no cap, compliance never looked this cute 🫶

The tool supports the following input modes:

💖 Archive mode (single)

Processes a single .txz or .tgz supportconfig tarball. An obfuscated copy is written as *_scrubbed.txz alongside the original.

💖 Archive mode (multi)

Processes two or more archives in a single run. Mappings are automatically chained: any IP address, hostname, domain, or username seen in the first archive is given the same fake value in all subsequent archives. this is the recommended way to handle HA clusters (e.g., node1 + node2 + crm_report) — consistency is the whole vibe, periodt ✨

💖 Folder mode

Processes any directory. A copy is created at {dir}_scrubbed/ and files are scrubbed in-place inside that copy. No repacking is performed. If the directory looks like a supportconfig collection (contains basic-environment.txt), the full pre-scan is performed automatically (domains, hostnames, usernames, serials).

When --quiet is used, standard output prints exactly one line: the absolute path of the scrubbed output directory. The directory name follows the convention {scrubbed_input_name}_scrubbed, where hostnames in the folder name are replaced with their obfuscated values. The obfuscation summary and warnings are printed to standard error. This interface is intended for programmatic callers such as supportconfig(8).

💖 Single file mode

Processes a plain text file (not a tarball). The scrubbed output is written to {file}_scrubbed.

💖 Stdin/pipe mode

Reads from standard input and writes the scrubbed text to standard output. Header and summary are sent to standard error. Activated automatically when no path is given and stdin is not a terminal, or when - is passed as the path.

💖 PCAP mode

Rewrites packet capture files using the same subnet-aware mappings from supportconfig obfuscation, ensuring consistency between log files and network traces.

All obfuscations are performed consistently, ensuring that sensitive information such as IP addresses, domain names, usernames, hostnames, IPv6 addresses, and MAC addresses are replaced uniformly. The obfuscation mappings are saved in /var/tmp/obfuscation_mappings_*.json and can be reused to maintain consistency across separate runs. your secrets stay secret across the whole friend group 💀

🔥 FEATURES 🔥

  • Multiple input modes: Archives, folders, plain files, stdin/pipe, multi-archive. pick your fighter.
  • Subnet-Aware IP Mapping: Maps whole IPv4 subnets to fake subnets while preserving host offsets (e.g., gateway .1 remains .1 in the mapped subnet). the way she keeps the offsets intact?? main character energy 👑
  • Automatic entity detection: In pipe/file/stdin modes the tool pre-scans the text to auto-detect usernames (PAM log patterns, logname= fields), hostnames (NFS server lines, RFC 5424 syslog), and domains (FQDN extraction with TLD validation).
  • Email address obfuscation: Detects and replaces email addresses consistently. Systemd template units (e.g., user@1000.service) and vendor/upstream addresses are preserved. we respect the template units in this house 🫡
  • Password value obfuscation: Replaces password values in configuration lines (e.g., password=secret) while preserving the key prefix. Values already redacted by supportconfig are skipped.
  • Consistent multi-archive obfuscation: Shared mappings across all archives in one run.
  • tcprewrite Integration: Exports mappings compatible with tcprewrite for pcap file obfuscation.
  • Safe by Default: Original files are never modified; obfuscated versions are created separately. she would never touch your originals, that's so not her 🌸

⭐ OPTIONS ⭐

🎀 General Options

  • --config PATH — Specify the path to the configuration file. Defaults to /etc/supportutils-scrub/supportutils-scrub.conf.
  • --verbose — Enable verbose output with more detailed logging information. she will tell you everything, and honestly? obsessed 💅
  • --mappings FILE — Load an existing obfuscation mapping file before processing. Accepts both plain *.json and encrypted *.json.enc files — prompts for the passphrase automatically when the file is encrypted. Ensures that any previously assigned fake values are reused for consistency.
  • --secure-tmp — Extract archives to /dev/shm (tmpfs) to prevent sensitive data from touching persistent storage during processing. Falls back to /var/tmp with a warning if /dev/shm is not available. Guaranteed cleanup via try/finally even if the process is interrupted. Can also be enabled with secure_tmp = yes in the configuration file. no traces left behind, ghost protocol 👻
  • --encrypt-mappings — Encrypt the obfuscation mapping file with a user-supplied passphrase using AES-128 (Fernet). The encrypted file is saved with a .enc extension. Requires the Python cryptography package (pip install cryptography). Can also be enabled with encrypt_mappings = yes in the configuration file. Mutually exclusive with --no-mappings.
  • --no-mappings — Do not write a mapping file after processing. Obfuscation mappings will not be reusable across runs. Use this when the mapping file itself is considered a security risk.
  • --decrypt-mappings FILE — Decrypt and print the contents of an encrypted mapping file (*.json.enc) to standard output, then exit. Prompts for the passphrase interactively. Passing a *.json.enc file as a positional argument is equivalent and triggers decrypt mode automatically.

🧚 Obfuscation Options

  • --verify — After scrubbing, perform a multi-layer verification scan of the output. Checks include:
    1. mapping-based — known real values from the obfuscation mapping;
    2. IP allowlist — every IPv4 must be in a known-safe range (fake pools, loopback, multicast);
    3. MAC allowlist — every MAC must use the fake OUI prefix;
    4. pattern scan — detects email addresses, private keys, certificates, API tokens, JWT tokens, passwords, LDAP DNs, and Kerberos principals independent of the mapping;
    5. identity check (folder mode) — extracts hostname, IPs, MACs, DNS servers, serials, and UUIDs from the original supportconfig and verifies none survive in the scrubbed output.

Prints a list of findings if any are detected. Exits with code 3 if sensitive data remains; exits 0 if clean. she's checking her work twice, we stan a thorough queen ✨

  • --report — Write a JSON report alongside the mapping file. Includes the coverage report (which files contained each data category) and, when --verify is used, the full list of verification findings. Useful for compliance evidence and auditing.
  • --report-file FILE — As --report, but write the report to FILE instead of the auto-generated path. Implies --report.
Note: prior versions accepted --report FILE as a single argument. Since 1.5 the two forms are separate: --report is a plain flag, and an explicit path must go to --report-file. (they changed the lore, bestie, update your scripts 😭)
  • --quiet — Suppress the startup banner and per-file listing. In folder mode, standard output prints only the scrubbed output path (one line); the obfuscation summary, warnings, and version info are printed to standard error. This allows callers to capture the output path via command substitution while still displaying progress on the terminal. Useful when called from scripts or supportconfig(8).
  • --stream — Enable streaming stdin mode. Instead of buffering all input before processing, the tool reads the first 500 lines to build entity maps (IP subnets, hostnames, usernames, domains), then scrubs and flushes each subsequent line immediately to stdout.

Use this flag when piping a live log source that does not produce EOF, such as journalctl -f or tail -f. Without --stream, the tool waits for EOF before producing any output, which blocks indefinitely on a live pipe. and nobody has time to sit there waiting forever 🙈

Limitation: Entities that first appear after the 500-line bootstrap window may not be detected and scrubbed. Use --hostname, --domain, or --username to declare known entities explicitly when using streaming mode.
  • --output-dir DIR — Write the scrubbed archive to DIR instead of alongside the input file.
  • --domain DOMAINS — Comma, semicolon, or space-separated list of additional domain names to obfuscate.
  • --username USERNAMES — Comma, semicolon, or space-separated list of additional usernames to obfuscate.
  • --hostname HOSTNAMES — Comma, semicolon, or space-separated list of additional hostnames to obfuscate.
  • --keywords KEYWORDS — Comma, semicolon, or space-separated list of keywords to obfuscate. Keywords are replaced in both standalone and substring matches. substring matches too?? she's thorough 💅
  • --keyword-file FILE — File containing keywords to obfuscate, one per line.

🌈 PCAP Options

  • --rewrite-pcap — Enable PCAP rewriting mode using subnet mappings from the JSON mapping file.
  • --pcap-in FILES — One or more input PCAP files to obfuscate.
  • --pcap-out-dir DIR — Output directory for obfuscated PCAP files (default: current directory).
  • --print-tcprewrite — Print the exact tcprewrite command being executed (useful for debugging).

💅 EXAMPLES 💅

🎀 Single archive

supportutils-scrub /var/log/scc_node1.txz

Processes the tarball and writes scc_node1_scrubbed.txz. one archive in, one archive out, no thoughts head empty ✨

supportutils-scrub /var/log/scc_node1.txz --domain example.com --verbose

Scrubs the archive and additionally replaces every single occurrence of example.com and all of its subdomains. extra credit behavior fr 🫶

🌸 Multiple archives (HA cluster)

supportutils-scrub scc_node1.txz scc_node2.txz crm_report.txz

Processes all three archives in one run. And here's the iconic part — mappings are chained automatically: any IP, hostname, or username seen in node1 gets the same fake value in node2 and the crm_report. Consistency? she ate. A single mapping file is written at the end. 👑

🦋 Folder mode

supportutils-scrub /var/log/scc_extracted/

Copies the whole directory over to /var/log/scc_extracted_scrubbed/ and scrubs every file in-place. whole-folder glow-up, no cap 💖

🍓 Single file mode

supportutils-scrub /var/log/messages

Scrubs the file and drops the result at /var/log/messages_scrubbed. simple, clean, slay.

🧚 Stdin/pipe mode

journalctl -u sshd | supportutils-scrub

Scrubs the journal output — the scrubbed text goes to stdout, the summary goes to stderr. iykyk, keep those streams separate bestie.

supportutils-scrub - < /var/log/messages

Explicitly reads from stdin using the dash argument. yes the - is doing real work here, respect her.

supportutils-scrub --domain corp.com < /var/log/auth.log > auth_scrubbed.log

Scrubs auth.log and saves the result to a file. 🎀

⭐ Streaming mode (live pipes)

journalctl -f | supportutils-scrub --stream --no-mappings

Tails the system journal in real time. Each line is scrubbed and flushed immediately. And genuinely — without --stream this command would block forever waiting for EOF. forever. like that one group chat. 💀

journalctl -f -u pacemaker | supportutils-scrub --stream --hostname node1,node2 --domain corp.example.com

Live stream of the pacemaker journal, with the known hostnames and domain declared explicitly so they get scrubbed from the very first line. prep work stays winning ✨

journalctl -f | supportutils-scrub --stream --mappings /var/tmp/obfuscation_mappings.json | ai-agent --listen-stdin

Feeds a live scrubbed log stream into a local AI agent. Sensitive data is gone before the agent ever sees a single byte of input. protecting the vibes and the data, we love to see it 🫶

🔥 Encrypted mapping file

supportutils-scrub /var/log/scc_node1.txz --encrypt-mappings

Scrubs the archive and saves an AES-encrypted mapping file (*.json.enc). It prompts for a passphrase at startup. 🔐

supportutils-scrub /var/log/scc_node2.txz --mappings /var/tmp/obfuscation_mappings_20260309_142201.json.enc

Reuses an encrypted mapping file from a previous run so a second archive gets scrubbed consistently. It prompts for the passphrase to decrypt the mapping file before processing. continuity is the moment 💜

supportutils-scrub /var/tmp/obfuscation_mappings_20260309_142201.json.enc

Decrypts and prints the mapping file to stdout. The .json.enc extension gets detected automatically. no flags needed, she just knows. ✨

supportutils-scrub --decrypt-mappings /var/tmp/obfuscation_mappings_20260309_142201.json.enc

The equivalent explicit form using the --decrypt-mappings flag. same energy, louder about it 💅

🐚 PCAP Obfuscation

supportutils-scrub --rewrite-pcap --mappings /var/tmp/obfuscation_mappings_20260223_120000.json --pcap-in trace.pcap

Rewrites a single pcap file using existing mappings from a supportconfig obfuscation.

supportutils-scrub --rewrite-pcap --mappings mappings.json --pcap-in trace1.pcap trace2.pcap --pcap-out-dir /var/log/

Rewrites multiple pcap files and saves them to /var/log/. batch mode bestie 🦋

🌈 PCAP REWRITING DETAILS 🌈

💜 Subnet-Aware Mapping

  • Whole IPv4 subnets are mapped to fake subnets ✨
  • Host offsets are preserved (e.g., .1 remains .1, .254 remains .254) — the way that she keeps the math intact, iconic
  • Most-specific subnet rules are applied first
  • Original pcap files are never modified 🙈 (your originals are safe, bestie)

🎀 Requirements

  • The tcprewrite tool must be installed (package: tcpreplay)
  • PCAPs should be captured on specific interfaces (e.g., -i eth0), not -i any
  • Only IPv4 addresses are rewritten (IPv6 support pending — she's still getting ready 💅)

🩷 Troubleshooting PCAP Rewriting

No DLT plugin available error

The PCAP was probably captured with tcpdump -i any. Re-capture on a specific interface, or normalize the link type:

tcprewrite --dlt=enet -i in.pcap -o in-enet.pcap

Unable to parse as a valid CIDR error

Double-check that the mapping file's subnet entries are valid IPv4 CIDRs. no freestyling the CIDRs, bestie 😭

Empty or unchanged output

If the packets don't match any mapped subnets, the addresses just stay unchanged. Verify with:

tshark -r trace_scrubbed.pcap -c 5 -T fields -e ip.src -e ip.dst | column -t

🎀 FILES 🎀

  • /etc/supportutils-scrub/supportutils-scrub.conf — the default configuration file. See supportutils-scrub.conf(5) for details. ✨
  • /var/tmp/obfuscation_mappings_*.json — JSON files containing obfuscation mappings. These map real data → obfuscated data and must be kept secure. The subnet section is what gets used for tcprewrite operations.
  • /var/tmp/obfuscation_mappings_*.json.enc — AES-encrypted mapping files produced by --encrypt-mappings. You can decrypt them by passing the file directly to supportutils-scrub or by using --decrypt-mappings. 🔐
  • /var/tmp/obfuscation_audit_*.json — audit log written after every run. It records operator identity, hostname, UTC timestamp, input/output file paths with SHA-256 checksums, the CLI arguments used, and the mapping file path. Mode 0600. It provides chain of custody for compliance purposes. receipts, officially 📋
  • /var/tmp/obfuscation_report_*.json — coverage report written by --report. Lists which files in the archive contained each obfuscated data category. 🍓

⭐ EXIT STATUS ⭐

These exit codes form the stable integration contract. Callers must only test for these values. no inventing new ones, bestie, this is the agreement 💅

  • 0 — Success. All files scrubbed without error. 🎉
  • 1 — Fatal error. Input not found, permission denied, or unrecoverable failure. Output must not be trusted. 💀 do not touch it, do not ship it, do not look at it fondly.
  • 2 — Completed with warnings. Some files were skipped or non-critical errors occurred. Treat the same as 0 — output is valid. 🫶
  • 3 — Verify failed. --verify detected remaining sensitive data in the scrubbed output. Scrubbing is complete, but residual data was found. 😭 (she tried, but also — go look at it)

🔥 SECURITY CONSIDERATIONS 🔥

  • NEVER share the mapping file with SUSE Support or any third party. It contains the translation between obfuscated and real data. literally the whole key to the castle, do not hand it out 🙈
  • The obfuscation process is the customer's responsibility. Always review the obfuscated output before sharing. be the main character who checks their work ✨
  • Keywords are replaced even within words (substring matching) for thorough obfuscation. aggressive? yes. intentional? also yes 💅
  • Use --encrypt-mappings to protect the mapping file at rest. Without encryption, the mapping file contains all real values as keys and can be used to fully reverse the obfuscation. like, fully. completely. do not skip this step. 🔐
  • Use --secure-tmp on systems where disk forensics are a concern. Extraction to /dev/shm ensures sensitive data stays in RAM only. 🧠✨
  • Use --no-mappings when a one-shot obfuscation is sufficient and the mapping file must not exist on disk. if the file never exists, nobody can leak it — iconic logic.
  • An audit log is written automatically to /var/tmp/obfuscation_audit_*.json after every run. It records operator, hostname, UTC timestamp, SHA-256 checksums of input and output files, and CLI arguments. Never delete this file before sharing the scrubbed archive — it is your chain of custody. 🫡
  • All sensitive files (*.json, *.json.enc, *_audit_*.json) are written with mode 0600. locked down, as she should be 💜

🌸 INTEGRATION WITH SUPPORTCONFIG(8) 🌸

This section describes the stable interface for tools and scripts that call supportutils-scrub programmatically. supportconfig(8) may invoke supportutils-scrub after collecting its dataset when a scrub option is passed; the contract below is the one supportconfig relies on and is considered stable across minor versions. this is the handshake, bestie, and we honor it 🫱🫲

🎀 Calling supportconfig with automatic scrubbing

Pass -j to supportconfig(8) and it invokes supportutils-scrub automatically after collection. The scrubbed folder path is printed to stdout; everything else goes to stderr.

supportconfig -j

To add scrub options without changing the supportconfig call, set SUPPORTUTILS_SCRUB_OPTS before running:

export SUPPORTUTILS_SCRUB_OPTS="--verify --encrypt-mappings"
supportconfig -j

Common values for SUPPORTUTILS_SCRUB_OPTS:

  • --verify — Re-scan the scrubbed output for residual sensitive data after scrubbing. Exit code 3 if leaks are found. 🕵️‍♀️
  • --encrypt-mappings — Encrypt the mapping file with a passphrase so the real-to-fake translation can't be read without it. 🔐
  • --keywords "token1,token2" — Add site-specific strings to obfuscate (project names, internal hostnames not in DNS, etc.). custom hit list 💅
  • --no-mappings — Do not write a mapping file at all. Use when the mapping file itself must not exist on disk. ghost mode 👻

If supportconfig -j is not available, call supportutils-scrub directly on the collected directory:

supportutils-scrub --quiet /var/log/scc_hostname_250814_1549

With --quiet the only thing written to stdout is the absolute path of the scrubbed output directory. Hostnames in the directory name are replaced, so scc_hostname_250814_1549 becomes scc_hostname_1_250814_1549_scrubbed. Exit codes: 0 or 2 = success, 1 = failure, 3 = verify found leaks. 🎯

🦋 Output path convention

The scrubbed directory is always named {input_name}_scrubbed, sitting alongside the input. Any hostname embedded in the input name is replaced with its obfuscated value. The _scrubbed suffix is stable across versions. this is a promise, not a vibe 🌈

✨ Exit codes for callers

  • 0 or 2 — Success. Use the path returned on stdout. 🎉
  • 3 — --verify found residual data. Output exists but may be incomplete; warn the operator. ⚠️
  • 1 — Fatal error. Do not use the output. 💀

🫶 DISCLAIMER 🫶

supportutils-scrub is a best-effort obfuscation tool. It does not guarantee that all sensitive data has been removed from the output. The operator is responsible for reviewing the scrubbed output before sharing it with any third party. Use --verify to perform an automated post-scrub scan, but note that automated verification cannot detect all forms of sensitive data. SUSE accepts no liability for data disclosed in scrubbed archives. like, she's good, but she's not omniscient, and you still gotta check 🫡

👑 AUTHOR 👑

Ronald Pina <ronald.pina@suse.com> — the icon who built her 💜

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the License.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.

💅 SEE ALSO 👀

okay so like, these are the other pages in the same little friend group ✨ — go give them a read when you're done here:

  • supportutils-scrub.conf(5) — the config file page, your new bestie for all the settings 🎀
  • supportconfig(8) — the tool that actually makes the supportconfig archives in the first place, iconic behavior 👑
  • tcprewrite(1) — the pcap rewriting legend doing the heavy lifting behind the scenes 🔥
  • tcpreplay(1) — replaying packets, living its main character life 🌈

and that's the whole page bestie, you made it to the end 🫶💖 like literally a full read-through, no skimming, I'm so proud of you rn 😭

little sign-off moment: this is supportutils-scrub 1.5, dated 18 Apr 2026 —— go scrub some stuff, stay safe out there, and remember: your supportconfig is giving private and we're keeping it that way 💅✨🎀

byeeeeee 🦋🌸⭐

📦 where this page comes from