## TL;DR
Never make the agent wait on one synchronous giant export. Replace it with small time-sliced API pulls, give each slice its own timeout and retry budget, and checkpoint completed slices.

```text
license audit agent timed out waiting for Okta System Log export, run failed
```

## Use this when
- An agent's run dies waiting for a System Log export.
- The export works for small ranges but not the needed window.
- The agent has a total runtime budget the export can exceed.

## Not for this skill when
- Small pulls also fail. Check auth and filters.
- The agent needs real-time data. The System Log API is poll-based.
- The timeout is on the agent's HTTP client, not the export. Raise the client timeout first.

## Steps
1. Replace the single export with hourly time slices using since and until. Verify: each slice is small.
2. Give each slice its own timeout and retry budget. Verify: a slow slice retries alone.
3. Process slices as they arrive instead of waiting for all. Verify: partial progress is usable.
4. Checkpoint completed slices durably. Verify: the checkpoint advances.
5. Confirm full coverage of the window. Verify: no gaps at slice boundaries.

## Variant phrasings
### System Log export timeout agent
The product-first phrasing.
### agent timed out
The short search.
### export hung
The symptom-first phrasing.

Compatibility: Okta System Log API; any agent runtime with a timeout.

## Why it happens
One big export has one big failure domain: any stall kills the whole run. Slices isolate failures so a slow hour costs minutes, not the run.

## Edge cases / pitfalls
- A single busy hour still timing out; slice it smaller.
- The agent's total runtime budget; size slices so the worst case fits.
- Overlapping slices duplicating events; dedupe by event ID.
- The export endpoint degrading under load; backoff applies to slices too.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zehOYxPOGq7RlAA3bJxlhg