Tail Logs
ubuntu_tail_logTroubleshoot Ubuntu server issues by reading recent journal or file logs, optionally filtered by unit, time, or keyword.
Instructions
Read recent log lines from an Ubuntu server — either from the systemd journal (journalctl) or from a log file — optionally filtered to lines containing a search string.
Args:
server (string): server name from the inventory (see ubuntu_list_servers)
source ('journal' | 'file'): where to read from (default 'journal')
unit (string, journal only): systemd unit, e.g. 'nginx' — omit for the whole journal
path (string, file only, required): absolute file path, e.g. '/var/log/syslog'
lines (number): how many recent lines, 1-1000 (default 100)
since (string, journal only): time filter like '1 hour ago' or 'today'
grep (string): only lines containing this text (case-insensitive fixed string)
use_sudo (boolean): read as root for protected logs (default false)
Returns: the matching log lines as plain text.
Error handling: permission errors suggest use_sudo=true or adding the user to the 'adm'/'systemd-journal' groups.
Examples:
"errors in nginx logs in the last hour" -> source='journal', unit='nginx', since='1 hour ago', grep='error'
"last 50 lines of /var/log/auth.log" -> source='file', path='/var/log/auth.log', lines=50
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| grep | No | Only return lines containing this text (fixed string, case-insensitive) | |
| path | No | file only: absolute path of the log file, e.g. '/var/log/nginx/error.log' | |
| unit | No | journal only: limit to one systemd unit, e.g. 'nginx' (omit for the full journal) | |
| lines | No | Number of lines to return | |
| since | No | journal only: e.g. '1 hour ago', 'today', '2026-08-08 10:00' | |
| server | Yes | Server name from the inventory (see ubuntu_list_servers) | |
| source | No | 'journal' reads systemd's journal (journalctl); 'file' tails a log file | journal |
| use_sudo | No | Read via sudo -n, for logs your user cannot read (requires passwordless sudo) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | ||
| source | Yes | ||
| filtered | Yes | ||
| truncated | No | ||
| line_count | Yes |