Skip to main content
Glama
rhel-lightspeed

Linux MCP Server

by rhel-lightspeed
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

Get journal logs

get_journal_logs
Read-only

Access systemd journal logs on Linux hosts to troubleshoot service issues, filtering by time, unit, priority, or transport for targeted diagnostics.

Instructions

Get systemd journal logs.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hostNoRemote host to connect to via SSH
unitNoFilter by systemd unit name or pattern
sinceNoFilter entries since specified time (absolute or relative)
priorityNoFilter by syslog priority level (0-7), name, or range
transportNoFilter by journal transport (e.g., 'audit' for audit logs, 'kernel' for kernel messages, 'syslog' for syslog messages)
last_linesNoNumber of last log lines to retrieve after applying filters (journalctl -n N). Default: 100. Mutually exclusive with first_lines.
first_linesNoNumber of first log lines to retrieve after applying filters (journalctl -n +N). Mutually exclusive with last_lines.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathNo
unitNo
entriesYes
lines_countNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed8 schema fields changedv1.6.0
    • removedInput schema / $defs
      Removed value: -{
-  "Transport": {
-    "description": "Valid journalctl transport types for filtering journal entries.\n\nTransports identify the source/mechanism that submitted log messages to the journal.\n\nAUDIT - Linux audit subsystem messages (security events, syscall auditing)\nDRIVER - Kernel driver messages logged via dev_printk().\nJOURNAL - Messages logged directly to the journal via sd_journal_* APIs.\nKERNEL - Kernel ring buffer messages (dmesg/printk).\nSTDOUT - stdout/stderr from services with StandardOutput/StandardError=journal.\nSYSLOG - Messages received via the syslog socket (/dev/log).",
-    "enum": [
-      "audit",
-      "driver",
-      "journal",
-      "kernel",
-      "stdout",
-      "syslog"
-    ],
-    "type": "string"
-  }
-}
    • addedInput schema / additionalProperties
      Added value: +false
    • addedInput schema / properties / first_lines
      Added value: +{
+  "anyOf": [
+    {
+      "maximum": 10000,
+      "minimum": 1,
+      "type": "integer"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Number of first log lines to retrieve after applying filters (journalctl -n +N). Mutually exclusive with last_lines."
+}
    • addedInput schema / properties / last_lines
      Added value: +{
+  "anyOf": [
+    {
+      "maximum": 10000,
+      "minimum": 1,
+      "type": "integer"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Number of last log lines to retrieve after applying filters (journalctl -n N). Default: 100. Mutually exclusive with first_lines."
+}
    • removedInput schema / properties / lines
      Removed value: -{
-  "default": 100,
-  "description": "Number of log lines to retrieve. Default: 100",
-  "maximum": 10000,
-  "minimum": 1,
-  "type": "integer"
-}
    • changedInput schema / properties / transport / anyOf
      Previous value: -[
-  {
-    "$ref": "#/$defs/Transport"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "description": "Valid journalctl transport types for filtering journal entries.\n\nTransports identify the source/mechanism that submitted log messages to the journal.\n\nAUDIT - Linux audit subsystem messages (security events, syscall auditing)\nDRIVER - Kernel driver messages logged via dev_printk().\nJOURNAL - Messages logged directly to the journal via sd_journal_* APIs.\nKERNEL - Kernel ring buffer messages (dmesg/printk).\nSTDOUT - stdout/stderr from services with StandardOutput/StandardError=journal.\nSYSLOG - Messages received via the syslog socket (/dev/log).",
+    "enum": [
+      "audit",
+      "driver",
+      "journal",
+      "kernel",
+      "stdout",
+      "syslog"
+    ],
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]
    • changedOutput schema / properties / path / anyOf
      Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "format": "path",
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]
    • changedOutput schema / properties / unit / anyOf
      Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "format": "path",
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]
  2. First observedv0.1.0

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers the safety profile, but the description itself discloses no additional behavioral context such as default line limits, remote SSH behavior, or potential output volume. It neither contradicts the annotations nor adds meaningful behavioral detail beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that is immediately readable and front-loaded. It is not bloated, though it is so minimal that it omits useful context an agent might need for proper routing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The rich input schema, output schema, and readOnlyHint annotation cover most of the invocation contract, so the brief description is mostly adequate. However, it lacks sibling differentiation and usage guidance, making the definition incomplete for confident tool selection in a larger toolset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema documents all seven parameters with descriptions, defaults, examples, and constraints, so the schema carries the full parameter-semantics burden. The description adds no parameter information, but per the baseline for high schema coverage, a score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Get') and the resource ('systemd journal logs'), so an agent can understand the basic action and target. However, it does not differentiate this tool from siblings like get_service_logs or read_log_file, which may also return log content.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool instead of alternatives such as get_service_logs or read_log_file. There is no mention of typical use cases, prerequisites, or exclusions, leaving the agent to infer selection from the name and siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rhel-lightspeed/linux-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server