log-analysis

Use when investigating, correlating, or diagnosing problems on Linux from log data — system, application, and container logs (journald, syslog, /var/log, dmesg, kernel, auth, nginx/apache, Docker/Podman, Kubernetes) — or when the user reports an incident, outage, crash, OOM, restart loop, auth failure, or performance degradation and wants root-cause analysis from logs. Also use for querying centralized logs with lnav or logcli/Loki. Read-only and non-destructive.