get_manager_logs

Instructions

Implementation Reference

• src/tools/manager.ts:35-72 (handler)

  The handler function that executes the get_manager_logs tool logic. It accepts limit, offset, level, and tag parameters, calls client.getManagerLogs(), then maps and returns the results as JSON.

  async ({ limit, offset, level, tag }) => {
    try {
      const params: Record<string, string | number> = { limit, offset };
      if (level) params.level = level;
      if (tag) params.tag = tag;
  
      const response = await client.getManagerLogs(params);
      const data = response.data;
  
      const result = {
        logs: data.affected_items.map((entry) => ({
          timestamp: entry.timestamp,
          tag: entry.tag,
          level: entry.level,
          description: entry.description,
        })),
        total: data.total_affected_items,
        limit,
        offset,
      };
  
      return {
        content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify({
              error: error instanceof Error ? error.message : String(error),
            }),
          },
        ],
        isError: true,
      };
    }
  }

• src/tools/manager.ts:12-34 (schema)

  Zod input schema for get_manager_logs: limit (1-100, default 25), offset (min 0, default 0), level (enum: info/warning/error/critical/debug, optional), tag (string, optional).

  {
    limit: z
      .number()
      .int()
      .min(1)
      .max(100)
      .default(25)
      .describe("Maximum number of log entries to return (1-100)"),
    offset: z
      .number()
      .int()
      .min(0)
      .default(0)
      .describe("Pagination offset"),
    level: z
      .enum(["info", "warning", "error", "critical", "debug"])
      .optional()
      .describe("Filter by log severity level"),
    tag: z
      .string()
      .optional()
      .describe("Filter by module/tag name (e.g., 'wazuh-modulesd', 'ossec-analysisd')"),
  },

• src/tools/manager.ts:9-73 (registration)

  Tool registration on the McpServer via server.tool('get_manager_logs', ...) inside registerManagerTools().

  server.tool(
    "get_manager_logs",
    "Retrieve Wazuh manager logs with optional filtering by severity level or module tag",
    {
      limit: z
        .number()
        .int()
        .min(1)
        .max(100)
        .default(25)
        .describe("Maximum number of log entries to return (1-100)"),
      offset: z
        .number()
        .int()
        .min(0)
        .default(0)
        .describe("Pagination offset"),
      level: z
        .enum(["info", "warning", "error", "critical", "debug"])
        .optional()
        .describe("Filter by log severity level"),
      tag: z
        .string()
        .optional()
        .describe("Filter by module/tag name (e.g., 'wazuh-modulesd', 'ossec-analysisd')"),
    },
    async ({ limit, offset, level, tag }) => {
      try {
        const params: Record<string, string | number> = { limit, offset };
        if (level) params.level = level;
        if (tag) params.tag = tag;
  
        const response = await client.getManagerLogs(params);
        const data = response.data;
  
        const result = {
          logs: data.affected_items.map((entry) => ({
            timestamp: entry.timestamp,
            tag: entry.tag,
            level: entry.level,
            description: entry.description,
          })),
          total: data.total_affected_items,
          limit,
          offset,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/index.ts:48-48 (registration)

  Registration call site: registerManagerTools(server, client) invoked in the main function.

  registerManagerTools(server, client);

• src/client.ts:364-368 (helper)

  Client helper method getManagerLogs() that performs the HTTP GET request to /manager/logs with the provided params.

  async getManagerLogs(
    params: Record<string, string | number> = {}
  ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhManagerLog>>> {
    return this.get("/manager/logs", params);
  }