log-tail_skill

Overview

This skill streams recent logs from the systemd journal so you can inspect service activity quickly. It supports filtering by service unit, controlling the number of lines returned, and optionally following logs in real time. It relies on journalctl available on systemd-based systems. Use it to get fast, focused visibility into service behavior and recent events.

How this skill works

The skill runs journalctl queries to fetch recent journal entries. You can specify a service unit to limit output to that unit, set the number of lines to return, or enable follow mode to stream new entries as they arrive. Output is plain text from the journalctl command, unchanged except for the requested filters.

When to use it

• Quickly inspect recent logs for a specific systemd service after a restart or failure.
• Monitor a service in real time during debugging or deployment with follow mode.
• Gather a compact snapshot of recent system activity for triage or reporting.
• Verify that a configuration change or update produced the expected log entries.
• Automate periodic log checks in scripts or lightweight diagnostics.

Best practices

• Specify the service unit to reduce noise and focus on relevant entries.
• Limit line count when searching broad system logs to keep output manageable.
• Use follow mode only when you need real-time streaming to avoid long-running processes.
• Combine with grep or other text tools for targeted searches, but prefer unit filtering first.
• Run with appropriate privileges (journal access) or use sudo if entries are restricted.

Example use cases

• Show the last 50 lines for nginx.service to inspect recent errors after a crash.
• Follow sshd.service in real time while testing remote login behavior.
• Fetch 200 lines across the journal to capture recent system-wide events for a support ticket.
• Run a scheduled script that pulls 100 lines from a service to include in daily health reports.