网络日志分析

Local LLM via Docker Model Runner

```bash docker model pull ai/qwen3 # 8B, ~5GB, recommended

Quick start

```bash git clone https://github.com/gesh75/netlog-ai.git cd netlog-ai python3 -m venv .venv && source .venv/bin/activate pip install -e ".[dev]" cp .env.example .env

Bundled demo sites

Four fully synthetic site bundles ship in sites/ so you can exercise every feature out of the box. These are not derived from any real network — they're hand-built configs designed to demonstrate the analyzer's full feature set.

Each bundle includes intentional configuration gaps (missing BFD, no LLDP on some access switches, IoT VLAN without an L3 interface) so the analyzer's deep-analysis pipeline produces concrete, actionable findings.

List running FRR-lab containers (optional)

ai-log-analyzer containers

Configure the LLM

Three providers, switchable at runtime from the UI dropdown — or via env / API:

```bash LLM_PROVIDER=claude ANTHROPIC_API_KEY=sk-ant-... ai-log-analyzer serve

Auto-detection fallback parser (optional)

For arbitrary show output where the platform isn't known up-front, install the parse extra to enable tfsm_fire — it scores every TextFSM template in a 700-template DB and returns the best match:

pip install -e ".[parse]"

from ai_log_analyzer.adapters.tfsm_auto import auto_parse
result = auto_parse(raw_cli_output, filter_hint="bgp_summary", min_score=40.0)

<p align="center"> <img src="demo/tfsm_demo.gif" alt="tfsm_fire auto-detect demo — paste Cisco LLDP, IOS show version, FRR BGP summary; each picks the right template and scores 78–89/100" width="100%"> </p>

See docs/TFSM_AUTO_PARSER.md for the API, scoring guide, and filter-hint reference. The full WebM video is demo/tfsm_demo.webm (19s, 311 KB) and the recording is reproducible via demo/record_tfsm_demo.sh.

API

`/api/analyze` request

{
  "source": "frr",
  "containers": ["r1", "r2"],
  "tail": 500,
  "use_llm": true
}

{
  "source": "raw",
  "hostname": "test-router",
  "text": "Mar  3 12:00:01 r1 rpd[1234]: bgp peer 10.0.0.1 down\n..."
}

LOGS pipeline hardening (2026-05-27)

Three follow-up fixes to the LOGS tab: (1) the Executive Summary LLM call now receives an ALLOWED_HOSTNAMES anchor and a post-validation scrubber so it can no longer emit textbook placeholders like R1-R3 or SW1-SW2, (2) classifier.strip_ansi removes ANSI/VT100 escape codes from every event at the LogEvent → ClassifiedEvent boundary (no more [0;32m OK [0m garbage in the UI), and (3) containerlab-multivendor/topologies/clos-evpn.clab.yml now caps cEOS / SRL / linux containers via the kinds: block so a runaway control plane can't OOM-cascade the host. Full details and live validation data in docs/LOGS_PIPELINE_HARDENING.md.

Module layout

src/ai_log_analyzer/
  classifier.py        50+ regex patterns + severity/category lookup
  kb.py                Rule-based deep-analysis KB (fallback when LLM is off)
  llm.py               Docker Model Runner (TCP + UDS) + Anthropic Claude
  analyzer.py          End-to-end pipeline: classify → actions → score → summary
  copilot.py           Site-context Q&A with secret-sanitized prompts
  diff.py              Config-diff explainer
  sanitize.py          Pre-LLM redaction (passwords, public IPs, SSH keys)
  site_optimize.py     Site-wide cross-device gap finder + maturity score
  site_diagram.py      Mermaid + Graphviz DOT topology renderer
  topology.py          Build topology graph from device list
  topology_infer.py    Multi-signal edge inference (BGP, MLAG, descriptions, subnets)
  reports.py           MD / HTML / CSV / PDF report exporters
  adapters/
    frr.py             docker logs <container> → LogEvent stream
    file.py            RFC3164 / RFC5424 / Junos / freeform parser
  web/
    app.py             Flask routes + create_app()
    static/            index.html + app.js (no build step)
  cli.py               `ai-log-analyzer serve | analyze | containers`