Skip to main content

Investigate with Logs

This guide shows how to use the Logs page to answer the questions that come up when something goes wrong: Why couldn't this user connect? What did a guard block? Why is this tool slow? Who called this tool?

For a full reference of every column and filter, see Logs.

Prerequisites​

  • Admin access to the Willow dashboard
  • At least one MCP server receiving traffic
  • Familiarity with the Advanced Filters panel on the Logs page

Investigate a failed authentication​

A user reports they can't connect a client, or a connector keeps re-prompting for auth.

  1. Go to Monitor > Logs.
  2. Set Action Type to Connect (client can't reach a server) or Connector Auth (the connector's own auth is failing).
  3. Open Advanced Filters and set User to the affected user.
  4. Set Status to Failed.
  5. Open a failing row's Details and read the JSON viewer for the error message and the resolved identity.

If Connector Auth rows fail with a token error, the user usually needs to reconnect the connector. If Connect rows never appear at all, the client isn't reaching the gateway, so check the connection URL.

Investigate a blocked guard action​

You want to confirm a guard is firing, or explain to a user why a call was stopped.

  1. Go to Monitor > Logs.
  2. Open Advanced Filters and set Guard Action to Blocked (or Warned / Transformed to see softer actions).
  3. Optionally set Guard to the specific guard you're validating.
  4. Open a row's Details to see which check matched and the payload that triggered it.

To see a guard block an action end to end, follow Enable a Guard and See It Fire.

Investigate a slow tool call​

A user reports a tool feels slow, or you're chasing latency.

  1. Go to Monitor > Logs.
  2. Set Action Type to Tool Call.
  3. Sort the table by Duration (descending) to bring the slowest calls to the top.
  4. Narrow with Advanced Filters by MCP Server or AI Agent to isolate the source.
  5. Open a slow row's Details to see the request and response payloads.

For aggregate latency trends rather than individual calls, use Analytics.

Investigate an unauthorized tool call​

You need to know who invoked a specific tool, and from which client.

  1. Go to Monitor > Logs.
  2. Set Action Type to Tool Call.
  3. Open Advanced Filters and filter by MCP Server and the specific Tool.
  4. Read the User and AI Agent columns to attribute each call.
  5. Open Details for the full request context, including the resolved user identity.

Export logs for a compliance review​

  1. Apply the date range and Advanced Filters that define the scope of your review.
  2. Open the Options menu (⋮) at the top right.
  3. Select Export CSV to download the filtered logs.

The export reflects the current filters, so scope the table before exporting.

On this page