Running loganalysis.py against a V3 audit log

[Kevin Foote]

> On Nov 4, 2015, at 1:26 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 11/4/15, 4:11 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
> 
>> As we prepare to roll out V3, I've noticed that there are some subtle differences in the audit log formats between V2 and V3.
> 
> Shouldn't be. The format it's defaulting to is only used to match V2.
> 
>> Seems, for one, that the number of fields in the audit log have changed as have the message profile names enough that loganalysis.py no longer works on V3 audit logs.
> 
> The number of fields shouldn't be different. The profile names I'm sure changed, but that's not format, that's the content.
> 
> What fields are not matching (positionally speaking I mean)?


Yea I know what changed.. line 47

-        if msgProfile.lower().endswith(":sso"):
+        if "sso" in msgProfile.lower():

Scott is right (of course) it is the profile names that is tripping the original script up. 

My loganalysis.py script is pretty customized but here is the line(s) that need to be changed.. 

I can make a patch if that works better.. for those who care. 

--------
thanks
 kevin.foote