Log Aggregator

VerifiedSafe

Aggregates logs from systemd services, Docker containers, and application files in known projects. Supports filtering by error/warn levels, tailing, searching, and time ranges. Useful for debugging, monitoring service health, and investigating errors.

Sby Skills Guide Bot
DevelopmentIntermediate
1206/2/2026
Claude Code
#logs#debugging#monitoring#systemd#docker

Recommended for

Our review

Views and aggregates logs from multiple sources (systemd, Docker, application files) to aid debugging and monitoring.

Strengths

  • Centralizes log viewing across different services
  • Supports filtering by level (error, warn) and pattern search
  • Works with multiple sources (systemd, Docker, files) using appropriate commands

Limitations

  • Requires pre-configuration of log sources in the SKILL
  • Depends on access to Bash, Read, Glob, and Grep tools
  • No real-time streaming (uses tail)
When to use it

When you need to troubleshoot issues by examining logs from one or more services in your project.

When not to use it

If you need advanced centralized logging with indexing and full-text search, or if the services are not accessible via the listed sources.

Security analysis

Safe
Quality score95/100

Commands are read-only log viewing (journalctl, docker logs, tail, grep). No destructive operations or exfiltration risks.

No concerns found

Examples

View recent systemd logs
Show me the last 100 log entries for the erudition service, including any errors.
Search Docker logs for errors
Search the docker logs of agila-backend for any error or exception messages.
Aggregate logs from all services
Get the logs from all services (systemd and Docker) for the last hour and show a summary of errors and warnings.

name: logs description: View and aggregate logs from various sources (systemd, docker, application files). Use when debugging, monitoring services, or investigating errors. argument-hint: [service] [options] allowed-tools: Bash, Read, Glob, Grep

Log Aggregator

View and search logs from multiple sources across your projects.

Arguments

  • $0: Service name or project (optional - shows all if not specified)
  • $1: Options - error, warn, tail, search:pattern (optional)

Log Sources by Project

| Project | Source | Location/Command | |---------|--------|------------------| | eruditiontx-services-mvp | systemd | journalctl -u erudition-service | | eruditiontx-services-mvp | app | ~/Projects/eruditiontx-services-mvp/logs/ | | mathmatterstx-services | systemd | journalctl -u mathmatters-service | | agila-tax-management | docker | docker logs agila-backend | | notaryo.ph | Next.js | .next/ logs, terminal output | | bocs-turbo | Vercel | vercel logs |

Commands

View Recent Logs

Systemd Services:

journalctl -u $SERVICE -n 100 --no-pager
# Follow mode
journalctl -u $SERVICE -f

Docker Containers:

docker logs $CONTAINER --tail 100
# Follow mode
docker logs $CONTAINER -f

Application Log Files:

tail -n 100 ~/Projects/$PROJECT/logs/app.log
# Follow mode
tail -f ~/Projects/$PROJECT/logs/app.log

Filter by Level

Errors Only:

# Systemd
journalctl -u $SERVICE -p err -n 100 --no-pager

# Docker/Files
docker logs $CONTAINER 2>&1 | grep -i "error\|exception\|traceback"

# Log files
grep -i "error\|exception\|traceback" ~/Projects/$PROJECT/logs/app.log

Warnings:

grep -i "warn\|warning" $LOG_SOURCE

Search Logs

# Search for pattern
journalctl -u $SERVICE | grep -i "$PATTERN"
docker logs $CONTAINER 2>&1 | grep -i "$PATTERN"
grep -i "$PATTERN" ~/Projects/$PROJECT/logs/*.log

Time-Based Filtering

# Last hour
journalctl -u $SERVICE --since "1 hour ago"

# Today
journalctl -u $SERVICE --since today

# Specific time range
journalctl -u $SERVICE --since "2024-01-01 00:00:00" --until "2024-01-01 23:59:59"

Log Aggregation Mode

View logs from multiple services at once:

# All Erudition services
journalctl -u erudition-service -u mathmatters-service -f

# All Docker containers
docker-compose logs -f

Log Analysis

Count Errors by Type

grep -i "error" $LOG_FILE | sort | uniq -c | sort -rn | head -20

Find Slow Requests

grep -E "took [0-9]+ms" $LOG_FILE | awk '{print $NF}' | sort -rn | head -10

Track Request IDs

grep "$REQUEST_ID" $LOG_FILE

Output Format

Logs: [service-name]
Source: [systemd/docker/file]
Filter: [all/error/warn]
Time: [range]

---
[Formatted log entries with timestamps]
---

Summary:
- Total entries: X
- Errors: Y
- Warnings: Z
- Time span: [start] to [end]

Common Log Patterns

FastAPI (Python)

INFO:     127.0.0.1:52847 - "GET /health HTTP/1.1" 200 OK
ERROR:    Exception in route handler: [error message]

Next.js

ready - started server on 0.0.0.0:3000
error - Error: [error message]
warn - [warning message]

Docker

[timestamp] [level] [message]

Troubleshooting

If logs are empty:

  1. Check if service is running: systemctl status $SERVICE
  2. Check log rotation: ls -la /var/log/
  3. Check Docker container status: docker ps -a
  4. Verify log file permissions
Related skills