diff --git a/use-cases/incus-troubleshooting-summary.md b/use-cases/incus-troubleshooting-summary.md
new file mode 100644
index 0000000..db36c0b
--- /dev/null
+++ b/use-cases/incus-troubleshooting-summary.md
@@ -0,0 +1,30 @@
+# Incus Troubleshooting Session Summary
+
+## User Requests
+
+1. **Check all Incus containers in all projects on remote server**
+2. **Check the logs of all containers from `gta` and `default` projects, and identify which ones must be taken care of**
+3. **Check Incus configuration to find where container filesystems are mounted, then look directly at logs from the root host filesystem**
+
+## My Responses
+
+1. **Container Discovery**  
+   - Listed all projects and containers:
+       - `default`: dns, gitea, jitsi, mail, matrix, radicale, seedreco, vaultwarden, web
+       - `gta`: wireguard
+       - `test-project`, `vins`: no containers
+
+2. **Attempted Container Log Retrieval (via Incus tooling)**  
+   - Encountered limitations: direct log retrieval per project via `incus query` not supported as expected.
+   - Explained alternative approaches (using `incus exec` or fetching from files inside containers).
+   - Asked for your preferred log-checking method: journal inside the container, or files from the host.
+
+3. **Logs Inspected Directly from Host Filesystem**  
+   - Used information about Incus container mountpoints to inspect `/var/log/syslog` and `/var/log/messages` for each container:
+       - Most containers lack system logs at these paths.
+       - `jitsi`: Found many repeated TURN server TLS/TCP socket errors (recommend investigation)
+       - `mail`: ClamAV warning for outdated signatures (recommend update)
+   - Recommended focusing on `jitsi` (TURN server errors) and `mail` (ClamAV out-of-date) for attention.
+
+---
+If you need further details on specific containers, deeper log analysis, or recommendations on fixes, just ask!