audit_tail
Retrieve the most recent audit log entries in ascending timestamp order for real-time monitoring or quick post-action verification.
Instructions
Return the N most recent audit log entries in ascending timestamp order (oldest-first within the tail window). Read-only — no side effects. Returns {ok:true, entries:[{timestamp, agentId, eventType, outcome, details}], count}. Returns {ok:false, error:"..."} if the log file cannot be read. n defaults to 20 and is capped at 500 — use a larger value only when debugging a busy system. Prefer audit_query for filtered searches by agent, event type, outcome, or time range; use this tool for real-time monitoring or quick post-action verification.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| n | No | Number of recent entries to return (default: 20, max: 500) |