Running loganalysis.py against a V3 audit log

[Wessel, Keith]

Thanks, Kevin, yeah, got that one already, and even put slashes around the sso to make sure, though that's probably overkill. But what about the 13 fields vs. 14? Did you not have that issue?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin Foote
Sent: Wednesday, November 04, 2015 3:57 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Running loganalysis.py against a V3 audit log


> On Nov 4, 2015, at 1:26 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 11/4/15, 4:11 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
> 
>> As we prepare to roll out V3, I've noticed that there are some subtle differences in the audit log formats between V2 and V3.
> 
> Shouldn't be. The format it's defaulting to is only used to match V2.
> 
>> Seems, for one, that the number of fields in the audit log have changed as have the message profile names enough that loganalysis.py no longer works on V3 audit logs.
> 
> The number of fields shouldn't be different. The profile names I'm sure changed, but that's not format, that's the content.
> 
> What fields are not matching (positionally speaking I mean)?


Yea I know what changed.. line 47

-        if msgProfile.lower().endswith(":sso"):
+        if "sso" in msgProfile.lower():

Scott is right (of course) it is the profile names that is tripping the original script up. 

My loganalysis.py script is pretty customized but here is the line(s) that need to be changed.. 

I can make a patch if that works better.. for those who care. 

--------
thanks
 kevin.foote
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net