Preface

Several tools in the BS2000 operating system produce various types of logs, including SATCP, ACCOUNTING, CONSLOG, SERSLOG, and more. SATCP, for example, creates binary files with all logs, which are later parsed by the separate SATUT tool. However, if multiple machines generate different types of logs, additional considerations are necessary. Reviewing logs may cause overhead and be time-consuming.

CLIP is a product that gathers logs directly from SATCP and sends them via a network to an external machine with an rsyslog server. This server can store, filter and process events from many BS2000 systems, which could be later used in an SIEM system.

CLIP comprises two main components:

• CLIP subsystem which:
  • Gather data from other subsystems and event generators in TPR (currently only SATCP)
  • Communicate with TU program to send data
• CLIP TU program running in the background.
  
  • Communicate with the rsyslog server over the network.
  • Interface with the CLIP subsystem.
  • Convert SATCP format to syslog format, following RFC 5424.