## TL;DR
SSO logs are the largest input in this vertical. Stream them through a script into per-user and per-app aggregates, keep the model on the aggregates, and drill into filtered slices on demand.

```text
agent hit context overflow parsing SSO logs, run failed
```

## Use this when
- An agent fails with context overflow on SSO logs.
- The log volume is far beyond prompt scale.
- The agent tried to read the logs directly.

## Not for this skill when
- The log sample is small. Just read it.
- The overflow comes from another input. Find the real large one.
- Only one user's trail is needed. Filter first, then read.

## Steps
1. Stream the logs through a script, never loading them whole. Verify: memory stays flat.
2. Aggregate into logins per user and failures per app. Verify: the aggregates answer the audit question.
3. Bring only the aggregates into context. Verify: the prompt stays small.
4. Drill into filtered slices for specifics. Verify: slices are small.
5. Confirm the run completes. Verify: no overflow.

## Variant phrasings
### context overflow logs
The cause-first phrasing.
### SSO log too large
The plain-English search.
### parsing logs failed
The symptom-first phrasing.

Compatibility: Any agent runtime with code execution parsing SSO logs.

## Why it happens
Raw SSO logs dwarf every other input here. No prompt fits them, and the model directing a streaming aggregation is the only workable shape.

## Edge cases / pitfalls
- Needing one user's full trail: filter to that user first, then the volume is manageable.
- Aggregates hiding a targeted attack in the noise; keep failure outliers listed.
- The script needing the log format first; sample lines to learn it.
- Timezone handling in the aggregation; normalize timestamps.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hEdTgbg-VjbpMLluhu_eEg