Connect Syslog and journald Logs to Claude with MCP

System LogsFree planQuery StreamsClaude

System Logs → Claude · with Query Streams

With Query Streams, ask Claude about your System Logs file in plain English: the Agent already inside your network runs the SQL read-only, and no database password ever reaches the AI. About ten minutes, and the Free plan covers it.

Start free

What you’ll end up with

A Claude that can answer questions about your Linux and Unix system logs with live, read-only queries over the tables the Agent builds from your files, and tell you which file each answer came from — without ever seeing a login or a file path, and without a firewall change: the Agent already inside your network reads the folder and sends back only the rows. Once the Agent is in place, connecting Claude takes about 90 seconds if you are comfortable with a settings screen. Like this:

Claude · connected to Query Streams Read-only

Which hosts saw failed SSH logins in the last hour?

qs_get_table_schema qs_run_query schema_intelligence

Claude reads the columns of fileset.events. Then it runs one query for rows where program is sshd and message mentions a failed password or an invalid user, in the last hour of event_time:

host	program	message
web-01	sshd	Failed password for invalid user admin from 203.0.113.45 port 51122 ssh2
web-01	sshd	Failed password for root from 198.51.100.7 port 40418 ssh2
db-02	sshd	Invalid user oracle from 203.0.113.45 port 33890

The same address, 203.0.113.45, tried two hosts. Ask Claude to count attempts per source address across every host. The answer covers what the Agent had read at its last scan.

Are the failed SSH logins a spray across hosts or aimed at one? Give me the top sources.

qs_run_query qs_run_query

I pulled the source address out of the sshd messages in fileset.events and counted attempts and distinct hosts per address:

Source IP	Hosts hit	Attempts	First seen
203.0.113.45	3 of 3	8,412	02:10
198.51.100.7	1	940	05:30
192.0.2.19	1	61	11:02

One address is doing almost all of it, against every host, since 02:10, cycling through usernames. No Accepted password line matches any of the three, so nothing got in. Block 203.0.113.45 at the firewall and the noise stops.

SELECT only, checked by the Agent logged on the MCP Activity tab 6 rows returned across 3 queries

Rather not wire up an AI client at all? On the Business plan, Nova is the assistant built into Query Streams itself. It uses the same Agent toolset your AI client gets here, plus what an outside client does not: it drafts and validates the SQL against your Semantic Intelligence model, turns the answer into a chart, and saves the result as a query your team can run from Excel, Google Sheets or the REST API — no key, no connector, nothing to install. Use MCP when your people already live in Claude, Cursor or ChatGPT; use Nova when you want the answers inside the Portal.

System Logs reads Linux syslog files, such as syslog, messages and auth.log, plus journald export files. It turns every line into a SQL row with host, program, PID and message, so Claude can answer the questions you would otherwise put to grep or journalctl. The Agent tails each file as it grows, recognises rotated files so nothing is read twice, reads each .gz archive once, and backfills the last 30 days on first read.

What you’ll need

A Query Streams account

MCP is on every plan, including Free. Free allows one key or one connected app, which is all this guide needs. Sign up at my.querystreams.com.

The Agent on a computer that can open the folder

Version 2.6.0 or later. The folder can be on that computer or on a file share it can reach. The Agent runs as a service, so type shares as \\server\share\folder, not as a mapped drive letter. On Windows it can sign in to a share with a login you store; on Linux or a Mac, mount the share first (Linux under /mnt or /media, a Mac under /Volumes). New to the Agent? Install it on Windows, macOS or Linux.

MCP switched on for you

Creators, owners and admins have it from the start. Everyone else needs an admin to flip the MCP switch beside their name under Account → Access Control. Until then the MCP page says “MCP is disabled for your account”.

An AI client

Claude on the web, Claude Desktop or the Claude mobile apps connect with no key. Claude Code, Cursor, ChatGPT and about ten other tools work too; the Portal has a ready-made recipe for each.

Set it up in four steps

1. Point the Agent at the folder

   In the portal open Data → Data Agents, find the Agent that can open the folder and click its Add connector button. Under the Files & Folders pill click the System Logs card. The wizard then walks you through Folders, Check, Settings, Realm and Review:

   Folders

   Type the Root folders, one per line, as paths on the Agent’s computer. Scan subfolders is on, Max depth is 8. Include patterns starts with the right glob for this file type; add Exclude patterns if the folder holds files you do not want. A mapped drive letter shows an amber advisory: the Agent cannot see it, so use the \\server\share path instead.

   Check

   The Agent reads a sample of up to 64 files and shows what it will build. Nothing is created yet. Ready to create means every sampled file fits. An amber banner, “{n} of {m} file(s) will be set aside”, lists files that do not fit with Show which files and why; you can create the connector anyway and fix them later. If the folder mixes layouts, a blue panel offers Switch to one table per layout.

   Settings

   Scan interval (every hour by default, from every 5 minutes to daily) is how often the Agent looks for new, changed and vanished files. Watch folder for changes reacts within seconds on local disks. When a file vanishes is Drop its rows by default.

   Realm, Review

   Pick the Data Realm the rows count against, check the summary and click Create connector. The first scan starts right away; the connector’s Manifest tab shows what it built and any files it set aside.

   • Add your log folder under Root folders. Include patterns start with **/syslog*, **/messages* and **/auth.log*.
   • Pick a Log type: RFC 3164 (BSD), RFC 5424 or journald export. Binary .journal files are skipped.
   • Table name is optional and defaults to events. Keep events for N days defaults to 60.
   • On Check, the Agent reads a sample and shows the file count, size, a row estimate and the tables it will build. Nothing is created yet. If the files do not look like the type you picked, the headline reads These files are not followed by that type, with the reason.

2. See what tables you get

   Parsed lines land in fileset.events, or in the Table name you chose. The Agent keeps the rows in a local cache on the Agent computer and serves them as SQL. Every row says which file it came from in _source_file. The columns below come from the default RFC 3164 log type. There is no facility or severity column.

   Table	What it holds
   events	One row per line: event_time, host, program, pid and message. RFC 5424 gives pri, app, procid, msgid, sd and message instead.
   events_raw_lines	Lines that did not parse, kept in line with a reason such as no-grammar-match or undecodable. Nothing is dropped.
   files	Every log file in the folder right now, with relative_path, size_bytes and modified_utc.
   files_events	The history of each file: appeared, modified, rotated, truncated and drift rows, timed by event_at.
   log_cursors	Each file’s read position and state. A set-aside file shows state parked with the reason in last_error.

   Every folder connector also gives Claude the same bookkeeping tables, all in the fileset schema:

   Table	What it holds
   files	Every file currently in the folder: path, name, extension, size, created and modified times. Ask “what is in this folder?” and Claude reads this.
   files_events	The change history: one row per file that appeared, was modified, vanished, or was set aside (drift), with the time in event_at and the reason in detail.
   directories, volumes	Folder sizes and counts, and the disks or shares the roots live on.
   _source_file, _row_id	Two columns on every data row: which file the row came from, and a stable row id inside that file. Group by _source_file to compare files.

3. Connect Claude

   Open Streams → Live → MCP. There are two ways in, and they end at the same place:

   Chat apps · no key

   claude.ai, Claude Desktop, ChatGPT

   In claude.ai and Claude Desktop, open the Query Streams listing in Anthropic’s Connectors Directory, click Connect and approve. Adding it by URL, https://mcp.querystreams.com/mcp, is the fallback. In ChatGPT you add Query Streams from the app (developer mode for now) and sign in with Query Streams. Either way a Query Streams page opens: pick the organization and the permissions and click Approve connection. Nothing to copy. The connection appears on the Connections tab and can be revoked there.

   Developer tools · a key

   Claude Code, Cursor, VS Code and friends

   On the MCP page click Connect an AI client. The guide asks How will your AI client connect?: choose Use a key in a config file, pick your tool, then Generate a key for it: a Key name, Read and Run queries ticked, an Expiration (Never, 30 days, 90 days or 1 year). Set it up shows the snippet with the key filled in, and Check the connection waits for the first call.

   Both ways use the same three permissions, which you choose on the consent screen or on the key:

   Read

   List connectors, browse tables and columns, read your saved queries and alert rules. Never returns row data.

   Run queries

   Run read-only SQL and saved queries through your Agent and return the rows. Without it your AI client can describe your data but not answer from it.

   Analyze

   Profile tables, discover relationships and queue a Semantic Intelligence run. Profiling and discovery are free; a Semantic Intelligence run spends Nova AI credits and data allowance, so the consent screen never pre-ticks it.

   Lost the key? It is listed on the Connections tab: Reveal full key shows it again and Copy full key copies it. Revoke it there if a laptop goes missing; every client using it fails on its next call, within about five minutes.

   Then pick the recipe for the Claude you use. The server address is the same everywhere: https://mcp.querystreams.com/mcp.

   Claude on the web, Claude Desktop and mobile no key

   1. Open the Query Streams listing in Anthropic’s Connectors Directory and click Connect. In Desktop it then sits under + → Connectors.
   2. Fallback, if your organization hides directory connectors: Settings → Connectors → Add custom connector, name Query Streams, URL https://mcp.querystreams.com/mcp, OAuth fields empty, Add; then in a chat + → Query Streams → Connect.
   3. A Query Streams tab opens. Sign in if asked, pick the organization, review Read and Run queries, optionally Limit to specific connectors, and click Approve connection.
   4. Back in Claude you see “Connected to Query Streams”. The first time Claude uses a tool it asks; choose Always allow.

   If you do add it by hand in Claude Desktop, use Settings → Connectors → Add, not the in-chat Add marketplace option, which expects a git repository. Connectors sync to your Claude account, so the mobile apps and Desktop pick it up automatically. Menu names are Anthropic’s and can move.

   Claude Code key

   One command, with your key from the Connections tab:

   Terminal

   claude mcp add --transport http querystreams https://mcp.querystreams.com/mcp \
     --header "X-MCP-Key: qsmcp_PASTE_YOUR_KEY_HERE"

   That writes the current project’s .mcp.json. Add --scope user to have Query Streams in every project. Run /mcp inside Claude Code to see it connected.

   Cursor key

   Open Cursor Settings → MCP → Add New MCP Server, or edit .cursor/mcp.json at the root of your workspace:

   .cursor/mcp.json

   {
     "mcpServers": {
       "querystreams": {
         "url": "https://mcp.querystreams.com/mcp",
         "headers": {
           "X-MCP-Key": "qsmcp_PASTE_YOUR_KEY_HERE"
         }
       }
     }
   }

   Restart Cursor or run MCP: Restart Servers; a querystreams badge appears in the MCP status bar.

   Using something else? The Portal’s Connect an AI client guide has ready-to-paste recipes for ChatGPT, VS Code, Visual Studio, OpenAI Codex CLI, Gemini CLI, Windsurf, Zed, Cline, Continue.dev and JetBrains AI, plus a Paste & merge tool that drops the querystreams entry into a config file you already have. Any client that speaks MCP over HTTP works: server https://mcp.querystreams.com/mcp, header X-MCP-Key (an Authorization: Bearer header with the same key also works).

4. Ask your first question

   Start with something you can check by opening the folder, so you see Claude reach for the right table. Three that work well with your Linux and Unix system logs:

   “Which system log files are you reading, and when did each last change?”

   Claude queries fileset.files for relative_path, size_bytes and modified_utc, newest first.

   “Which programs logged the most lines in the last hour, per host?”

   Claude groups fileset.events by host and program, filtered on event_time.

   “Were any syslog files rotated today, and did any lines fail to parse?”

   Claude reads rotated rows from fileset.files_events by event_at, then counts fileset.events_raw_lines by reason.

   To confirm the wiring, ask “What Query Streams connectors do I have?”. Claude calls qs_list_connectors, the Portal guide’s Check the connection step says Connected, and the key or app on the Connections tab shows its Last used time within a few seconds.

Reaching a file on a network share

The Agent opens files as a background service, not as you, so a file on another computer needs one extra step. Which step depends on the computer the Agent runs on.

If the test cannot get to the share, look for these words in its result: unreachable means the Agent’s computer got no answer from the server. On Linux or a Mac, not mounted means the share still has to be mounted, and that message includes the exact mount command for your server.

How new, changed and deleted files show up

What Claude can do once connected

Your AI client sees the Query Streams tools; it picks the right one for your question. The Portal’s Tools tab lists every tool and mode with what your plan includes. Query Streams asks your AI client to read the columns of each table before it queries, so it writes the real names instead of guessing. On every plan, Free included:

The Analytic toolset. On paid plans the Agent does the groundwork where your System Logs file lives, so your AI client spends its attention on the thinking. Free works as it always has.

The defaults live on the Context tab: text cell limit, schema view, result size, analysis defaults and held results.

Why Semantic Intelligence matters here

Every answer Claude receives is tagged with where the structure came from, and Claude adjusts how much it trusts what it sees.

If a database matters, run Semantic Intelligence on it once from Nova → Intelligence. The Connections tab shows a coverage panel per connector. How Semantic Intelligence works.

What the plans allow

MCP is on every plan, including Free, with no separate fee. What each plan sets is how many keys or connected apps you can hold and how many calls a minute your AI client may make:

A connected app counts as a key. On top of the per-minute figure, any one key may run at most 10 queries a minute. A query runs for up to 60 seconds unless your AI client asks for more, up to five minutes. Your plan also sets how many rows one query returns and, with the Analytic toolset, how long and how large a held result may be; the full MCP guide lists every plan. What your AI client receives counts against your Data Realm allowance, the same pool your Excel and Sheets queries use: AI-agent (MCP) usage counts every byte delivered to your AI client, results, schema reads and held-result pages alike, before any transport compression your client negotiates, where spreadsheet queries count the compressed result your Network Agent delivers. Semantic Intelligence runs started from your AI client spend Nova AI credits, exactly as they do from the Portal. See the pricing page for the allowances.

Keeping it safe

Good next moves

• Turn on Watch folder for changes (near real-time) to pick up new lines within seconds on a local disk. The scheduled scan stays the guarantee.
• Set Keep events for N days to control how much history stays in the cache. System Logs keeps 60 days by default.
• Open the Files dialog on the connector to see every log file the Agent is reading and why any is set aside.

When something doesn’t work

Questions people ask

Related guides

• Connect a Folder of CSV Files to Claude with MCP
• Connect a Folder of Excel Files to Claude with MCP
• Connect a Folder of SQLite Databases to Claude with MCP
• Connect a Folder of Parquet Files to Claude with MCP
• Connect Query Streams to Claude via MCP: setup, permissions and troubleshooting
• All MCP guides