ssh_log_search
Read-only
Search remote log files with regex, filter by time window or root access, and return matching lines or just file paths over SSH.
Instructions
Greps log files on the server and returns the matching lines with their paths, or the paths alone when line bodies are not wanted. An empty answer means no match, never a failed search: files that could not be read are listed apart. A time window first skips files untouched in it and then keeps only lines dated inside it, which is what lets a year of logs finish. For the tail of a file, ssh_log_tail is cheaper.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Which end maxMatches keeps: "end" newest (scans the whole file), "start" oldest (stops reading at the cap). Default: end | end |
| path | Yes | One path, a list, or a glob in the file name: "/var/log/*.log". Expanded by the server's find, not a shell — a name with a space or a newline stays one name. A glob in the directory part is refused. | |
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false | |
| query | Yes | Regex, grep -E dialect. | |
| since | No | Window: "today" | "2026-08-19" | "2h" | "3d", the day taken from the server. Skips files untouched in it (count reported), then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026. Undated file: searched whole and named. Under a day filters files, not lines. | |
| context | No | Lines around each match, as grep -C. Excluded by namesOnly. Default: 0 | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds per file, default 30000. Raise for multi-gigabyte files with from: "end". | |
| namesOnly | No | Answer = matching paths, no line bodies. One command for the whole list; maxMatches and context do not apply. Default: false | |
| recursive | No | Walk the whole tree, not one level. With a glob: "/etc/nginx/*.conf" reaches those at any depth. Symlinked files are searched, symlinked dirs not descended. Default: false | |
| maxMatches | No | Cap per file; reaching it is reported. Default: 200 | |
| caseSensitive | No | false = case ignored. Default: false |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Matching file names, for namesOnly. | |
| lines | No | The matching lines. context:true marks a neighbour shown alongside, not a match. | |
| limited | No | maxMatches was reached — more exist than are shown. | |
| matches | No | Lines in the answer — matches plus any context lines; with namesOnly, matching files. | |
| truncated | No | Output was cut mid-answer: incomplete, not empty. | |
| files_skipped | No | Left unread by the since window. | |
| files_undated | No | No recognisable timestamp: searched whole, the window was not applied. | |
| files_searched | No | ||
| files_unreadable | No | Opened with an error — not proof the text is absent. |