There is a simple way on how to scoop /dev/rpl data directly to another host without logging it on the one where it was captured. This is commonly referred to as "network logging".

On the storage host, create a FIFO which will serve as a routing point, and start rpld on it:

You can `chown` transrpl, put it somewhere else, and start rpld. On the capture host, load the module at a known minor number, and create a device node. Set up an SSH public key so you do not need to enter a password. Exploit the fact that SSH can be like telnet, i.e. disabling any (interactive) tty control (-T) and let it be "just a socket file descriptor" (i.e. no escape codes allowed -e):

Note: rpld will start once the FIFO has been successfully opened. This is due to opening FIFOs blocks when there is no reader/writer.

Note: The SSH program will terminate when rpld does, since once rpld closes the FIFO and SSH tries to write to it, SSH gets a SIGPIPE and does not catch it. That's ok, though.

Note: You technically can, but in practice can not, copy /dev/rpl to a regular file, since no timestamps will be recorded in that operation. Only rpld will do so, and as such, rpld is dependant on something that blocks when there is no data, such as a FIFO, as outlined above.