Running loganalysis.py against a V3 audit log

[Wessel, Keith]

Scott,

The difference is in the last few fields after the released attributes. The code in the script claims to be looking for the NaeID, the asserted IDs, then the end of the line. In my V3 audit log after the attributes released, I see a long string starting with AA and ending with == that I take to be the encrypted SAML response. I then see one more field, a shorter string starting with an underscore followed by 32 hex digits which I assume is the transientID being used as the nameID. I could be wrong about both of these assumptions. There is, however, no trailing pipe character, and the script expects 14 fields each separated by a pipe, the last of which it just calls EOL. So, the whole problem could be the lack of a terminating pipe.

As for the profile names, that is actually significant when counting logins. The script looks for message profiles ending in :sso, and that's obviously not going to be found in a V3 audit log with URL-style profile names.

I changed the script to only look for 13 fields not including EOL and to look for message profiles containing /sso/, and all seems to be working, but I'm wondering if there's more that I haven't found yet.

But if the intention was for the audit log format to be identical, there are issues.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, November 04, 2015 3:26 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Running loganalysis.py against a V3 audit log

On 11/4/15, 4:11 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>As we prepare to roll out V3, I've noticed that there are some subtle differences in the audit log formats between V2 and V3.

Shouldn't be. The format it's defaulting to is only used to match V2.

> Seems, for one, that the number of fields in the audit log have changed as have the message profile names enough that loganalysis.py no longer works on V3 audit logs.

The number of fields shouldn't be different. The profile names I'm sure changed, but that's not format, that's the content.

What fields are not matching (positionally speaking I mean)?

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net