Linux MCP Server

Get journal logs

get_journal_logs

Read-only

Retrieve systemd journal logs from local or remote Linux hosts, filter by unit, time, priority, or transport to troubleshoot services and system events.

Instructions

Get systemd journal logs.

Input Schema

TableJSON Schema

Name	Required	Description
`host`	Yes	System to run on: 'localhost' for the system the MCP server runs on, or a remote host to connect to via SSH
`unit`	No	Filter by systemd unit name or pattern
`since`	No	Filter entries since specified time (absolute or relative)
`priority`	No	Filter by syslog priority level (0-7), name, or range
`transport`	No	Filter by journal transport (e.g., 'audit' for audit logs, 'kernel' for kernel messages, 'syslog' for syslog messages)
`last_lines`	No	Number of last log lines to retrieve after applying filters (journalctl -n N). Default: 100. Mutually exclusive with first_lines.
`first_lines`	No	Number of first log lines to retrieve after applying filters (journalctl -n +N). Mutually exclusive with last_lines.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`path`	No
`unit`	No
`entries`	Yes
`lines_count`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedv1.7.0Oct 3, 2026

removedInput schema / properties / host / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedInput schema / properties / host / default
```
Removed value: -null
```

changedInput schema / properties / host / description

Previous value: -"Remote host to connect to via SSH"New value: +"System to run on: 'localhost' for the system the MCP server runs on, or a remote host to connect to via SSH"

addedInput schema / properties / host / examples

Added value: +[
+  "localhost",
+  "web1.example.com"
+]

addedInput schema / properties / host / type
```
Added value: +"string"
```
addedInput schema / required
```
Added value: +[
+  "host"
+]
```

Changed8 schema fields changedv1.6.0Sep 4, 2026

removedInput schema / $defs

Removed value: -{
-  "Transport": {
-    "description": "Valid journalctl transport types for filtering journal entries.\n\nTransports identify the source/mechanism that submitted log messages to the journal.\n\nAUDIT - Linux audit subsystem messages (security events, syscall auditing)\nDRIVER - Kernel driver messages logged via dev_printk().\nJOURNAL - Messages logged directly to the journal via sd_journal_* APIs.\nKERNEL - Kernel ring buffer messages (dmesg/printk).\nSTDOUT - stdout/stderr from services with StandardOutput/StandardError=journal.\nSYSLOG - Messages received via the syslog socket (/dev/log).",
-    "enum": [
-      "audit",
-      "driver",
-      "journal",
-      "kernel",
-      "stdout",
-      "syslog"
-    ],
-    "type": "string"
-  }
-}

addedInput schema / additionalProperties
```
Added value: +false
```

addedInput schema / properties / first_lines

Added value: +{
+  "anyOf": [
+    {
+      "maximum": 10000,
+      "minimum": 1,
+      "type": "integer"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Number of first log lines to retrieve after applying filters (journalctl -n +N). Mutually exclusive with last_lines."
+}

addedInput schema / properties / last_lines

Added value: +{
+  "anyOf": [
+    {
+      "maximum": 10000,
+      "minimum": 1,
+      "type": "integer"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Number of last log lines to retrieve after applying filters (journalctl -n N). Default: 100. Mutually exclusive with first_lines."
+}

removedInput schema / properties / lines

Removed value: -{
-  "default": 100,
-  "description": "Number of log lines to retrieve. Default: 100",
-  "maximum": 10000,
-  "minimum": 1,
-  "type": "integer"
-}

changedInput schema / properties / transport / anyOf

Previous value: -[
-  {
-    "$ref": "#/$defs/Transport"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "description": "Valid journalctl transport types for filtering journal entries.\n\nTransports identify the source/mechanism that submitted log messages to the journal.\n\nAUDIT - Linux audit subsystem messages (security events, syscall auditing)\nDRIVER - Kernel driver messages logged via dev_printk().\nJOURNAL - Messages logged directly to the journal via sd_journal_* APIs.\nKERNEL - Kernel ring buffer messages (dmesg/printk).\nSTDOUT - stdout/stderr from services with StandardOutput/StandardError=journal.\nSYSLOG - Messages received via the syslog socket (/dev/log).",
+    "enum": [
+      "audit",
+      "driver",
+      "journal",
+      "kernel",
+      "stdout",
+      "syslog"
+    ],
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

changedOutput schema / properties / path / anyOf

Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "format": "path",
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

changedOutput schema / properties / unit / anyOf

Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "format": "path",
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

First observedv0.1.0Mar 11, 2026

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already declares this a safe read, so the safety profile is covered. The description adds nothing beyond it: no note that 'host' may trigger SSH to a remote system, no mention of permissions, and no behavioral context. It simply restates the resource.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with zero filler, front-loaded and readable. It is efficient, though arguably under-specified rather than optimally concise given the tool's 7-parameter complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the schema is fully documented. But for a filtering-heavy tool with a remote-SSH host parameter and multiple overlapping log siblings, the description leaves routing and context gaps that a richer definition should fill.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 7 parameters including examples, defaults, and the mutual exclusivity of last_lines/first_lines. The description contributes no additional parameter meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Get systemd journal logs.' This is clearer than a tautology and identifies the data source precisely. However, it offers no differentiation from siblings like get_service_logs or read_log_file, which also retrieve logs, so an agent cannot tell them apart from the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no conditions, and no mention of alternatives. With siblings get_service_logs and read_log_file present, some routing hint would be valuable but is entirely absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.