There is a simple way on how to scoop /dev/rpl data directly to another host without logging it on the one where it was captured. This is commonly referred to as "network logging".

Note right at the start: It is not very useful to transfer between different operating systems, because each has completely different major numbers for different ttys, so running rpld on Linux and feeding it input from a FreeBSD capturer will yield wrong terminal names.

Beginning with ttyrpld 2.00, the timestamp is added in kernelspace, so that you can directly cat /dev/rpl to a file and process it later. The "later" was not possible before ttyrpld 2.00. Therefore, the remote capture process has become extremely simple. Run this on the capture host:

You might want to use a different account name for ssh'ing (because daemon is a system account and remote logins for this "user" would look like an intrusion). I also suggest using SSH keys so that you do not need to enter the password all the time you connect.