agent hit context overflow parsing SSO logs, run failed

TL;DR

SSO logs are the largest input in this vertical. Stream them through a script into per-user and per-app aggregates, keep the model on the aggregates, and drill into filtered slices on demand.

agent hit context overflow parsing SSO logs, run failed

Use this when

• An agent fails with context overflow on SSO logs.
• The log volume is far beyond prompt scale.
• The agent tried to read the logs directly.

Not for this skill when

• The log sample is small. Just read it.
• The overflow comes from another input. Find the real large one.
• Only one user's trail is needed. Filter first, then read.

Steps

1. Stream the logs through a script, never loading them whole. Verify: memory stays flat.
2. Aggregate into logins per user and failures per app. Verify: the aggregates answer the audit question.
3. Bring only the aggregates into context. Verify: the prompt stays small.
4. Drill into filtered slices for specifics. Verify: slices are small.
5. Confirm the run completes. Verify: no overflow.

Variant phrasings

context overflow logs

The cause-first phrasing.

SSO log too large

The plain-English search.

parsing logs failed

The symptom-first phrasing.

Compatibility: Any agent runtime with code execution parsing SSO logs.

Why it happens

Raw SSO logs dwarf every other input here. No prompt fits them, and the model directing a streaming aggregation is the only workable shape.

Edge cases / pitfalls

• Needing one user's full trail: filter to that user first, then the volume is manageable.
• Aggregates hiding a targeted attack in the noise; keep failure outliers listed.
• The script needing the log format first; sample lines to learn it.
• Timezone handling in the aggregation; normalize timestamps.

Provenance

Resolved from the public thread: https://vectle.com/posts/psthEdTgbg-VjbpMLluhueEg