Show which TPM logs are available, and whether they can be read and parsed.

Run this first. For every source it reports the devices found (server / client / setup logs), the time span each device's logs cover, whether the deployment looks like SaaS or on-prem (with the evidence), TPM versions seen in service start lines, version advisories, and any files whose line format was not recognised. It also says where to get missing logs (for example the Admin Portal zip for SaaS server logs).

Returns: A dict with ok, a message, per-source details, guidance for missing logs, and the active configuration.

Register TPM logs to analyse; remembered between sessions.

Nothing at path is modified. Bundles are extracted once into the server's data folder.

Args: name: Short label, e.g. "acme-saas-server" or "clients-0917" (letters, digits, '.', '_', '-'). path: A folder (local or UNC, e.g. \tpm01\c$\Program Files\Tenable\PatchServer\logs), a single log file (e.g. 13_adaptiva.log requested from a client), or a .zip / .tar.gz bundle such as the Admin Portal "Download All Server Logs" zip. deployment: "saas", "onprem" or "auto" (infer from the logs).

Returns: The registered source, the devices and log counts found, and the next step.

Unregister a source added with add_log_source.

The original folder or bundle is never touched; only the extracted copy of a bundle kept by this server is deleted. Sources from TPM_LOG_SOURCES or auto-discovery are configured outside the server and cannot be removed here.

Args: name: The source name.

Returns: What was removed.

List log files with device, role, purpose, size and the time span they cover.

Args: source: Source name; omit for all sources. device: Device name (e.g. "server", "client-13", "WS-BAD07"). role: "server", "client", "setup" or "unknown". name: Log name or glob, e.g. "adaptiva.log", "_SDMErrors.log", "content*.log". Rotated files (adaptiva.2.log) match their base name. limit: Maximum rows (1-1000).

Returns: files (one row per file) plus counts by device, role and log name.

Group every warning and error into distinct issues, ranked, with known fixes.

The best first call for "what is wrong?". Repeats are collapsed into signatures (IDs, GUIDs, IPs, numbers and paths normalised); the same event written to several logs is counted once. Each issue has counts, first/last seen, devices, decoded error codes, root causes from stack traces, the latest example with file and line, and - when recognised - a known-issue explanation and remediation. INFO lines that carry stack traces are raised to ERROR (flagged). Known platform noise is counted under noise instead of cluttering issues.

Args: since: Window start: ISO time (2026-09-17T08:00) or relative (90m, 24h, 7d, 2w) counted back from the newest log entry. Default 7d. until: Window end (same formats). Default: newest entry. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs, e.g. ["VulnerabilityManagement.log"]. min_severity: WARN (default), ERROR or FATAL. include_noise: Include known platform noise in issues. top: Issues to return (1-100).

Returns: totals, ranked issues, noise, top components/logs and coverage.

Search every log, including multi-line messages and stack traces.

Matches are whole entries (not single lines), de-duplicated across logs that repeat the same event, sorted by time, and redacted.

Args: pattern: Text to find (literal unless regex=true), e.g. a KB number, patch ID, client ID, content ID ("Policy_104117") or error text. regex: Treat pattern as a regular expression. case_sensitive: Default false. since: Window start (ISO or relative like 24h); default all history. until: Window end. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs to search. component: Exact component name, e.g. "TenableClient". min_severity: Only entries at or above INFO/WARN/ERROR. context: Entries of context before and after each match from the same file (0-5). limit: Matches to return (1-200). offset: Skip this many matches (paging; see next_offset). order: "newest" (default) or "oldest" first.

Returns: total_matches, matches (with file, line, component, thread, codes) and paging.

Merge all logs into one chronological sequence - what happened before and after.

Useful for "what led up to this failure": server and client logs are interleaved by timestamp, duplicates across logs removed, and consecutive repeats collapsed (repeats). When there are more rows than limit, WARN and above are always kept and the rest are sampled evenly (sampled).

Args: around: Centre the window on this time (ISO, or relative like 2h). minutes_before: Minutes before around (default 15). minutes_after: Minutes after around (default 15). since: Window start when not using around. Default: the last 60 minutes of logs. until: Window end when not using around. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs. min_severity: INFO (default), WARN, ERROR; DEBUG to include debug lines. keyword: Only entries containing this text. include_noise: Include known platform noise. collapse_repeats: Merge consecutive identical rows (default true). limit: Rows to return (10-1000).

Returns: rows in time order, each with time, device, severity, log, component, message and at (file:line).

Run a symptom playbook: read the right logs and return a verdict with evidence.

Symptoms:

• patch_install_failed - deployment results, installer exit codes (decoded), MSI failures

• content_download - content / peer-to-peer / CDN download problems on clients

• client_connectivity - client transport errors, server retries per client ID, registrations rejected for missing install authentication

• vm_integration - Tenable VM / Security Center access settings, API key failures, vulnerability import runs

• feeds - periodic feed checks, last success, failure root causes

• content_publication - content uploads to the CDN that failed

• service_health - service starts with versions, restart loops, crashes, out-of-memory

• database - SQL errors, SQL Server authentication, deadlocks

• client_upgrade - upgrade problems and versions seen over time

• feature_update_readiness - free disk space vs the 50 GB requirement, NOT INSTALLED scans

Args: symptom: One of the symptom ids above. since: Window start (ISO or relative like 24h). Default 7d. until: Window end. source: Source name; omit for all sources. device: Only this device.

Returns: verdict, findings (known issues with remediation), other related errors, playbook-specific details, missing_logs with how to get them, and advice.

Show warnings and errors on a problem device that a healthy device does not have.

Args: healthy_device: A device that patches correctly. problem_device: The device with the problem. since: Window start (ISO or relative). Default 7d. until: Window end. source: Source name; omit for all sources. min_severity: WARN (default) or ERROR. include_noise: Include known platform noise. top: Issues per list (1-100).

Returns: only_on_problem_device and more_frequent_on_problem_device, with counts.

Compare a recent window with the days before it, in the same logs.

Flags error signatures never seen in the baseline, errors whose rate jumped above the spike threshold, services that started repeatedly, and logs that stopped writing. Each finding has evidence, the threshold crossed and a reasoning sentence. Findings are marked low confidence when the logs do not reach far enough back.

Args: since: Window start (ISO or relative like 24h, counted back from the newest entry). until: Window end. Default: newest entry. baseline_days: Days before the window to compare against (1-90, default 7). source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup".

Returns: Severity-ordered findings, counts by type and severity, baseline coverage and the active thresholds.

Explain a TPM log file, an error code, a symptom or a known issue.

Args: topic: A log name ("_SDMErrors.log", "13_adaptiva.log"), an error code ("0x80070643", "-2147467259", "1603", "http 407"), a symptom id ("patch_install_failed") or a known issue id. Omit for the index.

Returns: What the topic is, where it comes from, and related symptoms or fixes.