microsoft / adfsLogTools

Tools for parsing AD FS logs (admin events, audits, and debug logs)
MIT License
22 stars 13 forks source link

Validate all events have the correlation ID #11

Open bongiovimatthew-microsoft opened 6 years ago

bongiovimatthew-microsoft commented 6 years ago

The following TODO item exists in the code:

function: Process-EventsForAnalysis

TODO: Validate that all events have the same correlation ID, or no correlation ID

When we do the first pass through the events to build the hashtable of instance IDs, we should validate the correlation IDs

Put up a warning if we ever see an event with a different correlation ID (it's okay for it to have no correlation ID)