Skip to main content
Glama

sysknife_get_journal_log

Read-onlyIdempotent

Read filtered systemd journal entries as JSON for log analysis and troubleshooting. Filter by unit, priority, boot, kernel, time range, regex, and line count.

Instructions

Read-only SysKnife action GetJournalLog. read filtered systemd journal entries as JSON (journalctl) — all params optional: unit (e.g. 'ssh.service'), priority (0-7 or name like 'err', or a range '0..3'), boot (bool, current boot only), kernel (bool, kernel messages only), since/until (e.g. '2026-07-22 10:00:00', 'yesterday', '-1h'), grep (regex on MESSAGE), lines (default 100, max 10000); read-only

Input Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.27.1

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, and the description merely repeats 'read-only' three times rather than adding new behavioral facts. It does contribute the journalctl backing, the JSON return format, and the 100/10000 line bounds, but omits whether elevated privileges are needed or how output is truncated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The parameter enumeration is front-loaded and efficient, but the string is one long semicolon-chained sentence that repeats 'read-only' at both ends and buries the trailing 'read-only' as redundant noise. Trimming the duplicated safety claim would tighten it with no loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description at least names the return shape (JSON) and gives every argument with formats and defaults, so an agent can call it correctly. It stops short of describing the JSON fields returned or ordering of entries, which leaves a small gap for a log-reading tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is an empty object with additionalProperties, so the description is the sole documentation of the arguments — and it covers unit, priority (numeric, name, and range forms), boot, kernel, since/until with example syntax, grep regex, and lines with default and cap. That is exactly the compensating detail the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — read filtered systemd journal entries as JSON via journalctl — which is far more informative than the name alone. It does not, however, distinguish itself from the sibling sysknife_get_service_logs, which reads logs for a specific unit, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'All params optional' plus a default of 100 lines implies a general-purpose journal reader, but there is no explicit when-to-use or when-not-to-use guidance. The obvious alternative (sysknife_get_service_logs) is never named, so routing between the two is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.