get_journal_logs
Read systemd journal entries with filters for unit, priority, and time range (since/until). Query user journals or recent lines to diagnose service and system issues.
Instructions
Reads systemd journal entries with optional filtering by unit, priority, and time range (since/until). Set user=true for the user journal. Read-only via journalctl. Fatal only if journalctl fails or an invalid unit is given. Returns structured entries with timestamp, message, priority, unit, and PID. For auditd AVC/syscall events use get_audit_logs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| unit | No | optional systemd unit name (e.g. 'nginx.service') | |
| user | No | query user-level journal (default: false) | |
| lines | No | number of recent lines (default: 50) | |
| since | No | optional start time (e.g. '1 hour ago', '2024-07-03') | |
| until | No | optional end time | |
| priority | No | optional log priority: emerg,alert,crit,err,warning,notice,info,debug |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| errors | No | ||
| entries | Yes |