{
  "description": "Read system logs.",
  "scope": "read",
  "tier": "cold",
  "variants": [
    {
      "match": {"binary": "journalctl"},
      "description": "Read system logs (journald).",
      "prompt": "## system_logs\n\nRead systemd journal entries.\n\n**Args**: `lines` (default: 30), `unit`, `since`, `grep`\n\n```\nsystem_logs(unit=\"sshd\", since=\"1 hour ago\")\nsystem_logs(lines=\"50\", grep=\"error\")\n```",
      "args": {
        "type": "object",
        "properties": {
          "lines": {"type": "string", "description": "Number of lines (default: 30)"},
          "unit": {"type": "string", "description": "Systemd unit name"},
          "since": {"type": "string", "description": "Time filter (e.g. '1 hour ago', 'today')"},
          "grep": {"type": "string", "description": "Filter output by pattern"}
        }
      },
      "cmd": "system_logs_journald"
    },
    {
      "match": {"binary": "dmesg"},
      "description": "Read system logs (dmesg + log files).",
      "prompt": "## system_logs\n\nRead kernel ring buffer and log files.\n\n**Args**: `lines` (default: 30), `source` (dmesg or a log path), `grep`\n\n```\nsystem_logs(source=\"dmesg\", lines=\"50\")\nsystem_logs(source=\"/var/log/nginx/error.log\", grep=\"500\")\n```",
      "args": {
        "type": "object",
        "properties": {
          "lines": {"type": "string", "description": "Number of lines (default: 30)"},
          "source": {"type": "string", "description": "Log source: 'dmesg' or absolute path (default: dmesg)"},
          "grep": {"type": "string", "description": "Filter output by pattern"}
        }
      },
      "cmd": "system_logs_dmesg"
    }
  ]
}