# alert_models.py
from datetime import datetime
from typing import Optional
from pydantic import BaseModel

class Alert(BaseModel):
    """Standardized alert event"""
    alert_name: str              # Alert name
    severity: str                # Severity: critical/warning/info
    instance: str                # Target instance
    labels: dict                 # Additional labels
    annotations: dict            # Alert description
    starts_at: datetime          # Alert start time
    ends_at: Optional[datetime]  # Alert end time
    fingerprint: str             # Unique alert identifier
    group_key: str               # Alert grouping key

class AggregatedEvent(BaseModel):
    """Aggregated event"""
    event_id: str
    alerts: list[Alert]          # Associated original alerts
    root_cause_hypothesis: str   # LLM-generated root cause hypothesis
    confidence: float            # Confidence score 0-1
    created_at: datetime

# clustering_engine.py
import numpy as np
from sklearn.cluster import DBSCAN
from sklearn.preprocessing import StandardScaler
from datetime import datetime, timedelta

class AlertClusteringEngine:
    """Alert clustering based on time-series and metric similarity"""

    def __init__(self, time_window_minutes=15, eps=0.5):
        self.time_window = timedelta(minutes=time_window)
        self.eps = eps  # DBSCAN neighborhood radius

    def extract_features(self, alerts: list[Alert]) -> np.ndarray:
        """Extract alert feature vectors"""
        features = []
        for alert in alerts:
            # Time feature: time since event start (normalized)
            time_feat = (alert.starts_at - min(a.starts_at for a in alerts)).total_seconds() / 3600

            # Severity encoding
            severity_map = {'critical': 3, 'warning': 2, 'info': 1}
            sev_feat = severity_map.get(alert.severity, 0) / 3.0

            # Metric dimension features (extracted from labels)
            metric_dims = self._extract_metric_dimensions(alert)

            features.append([time_feat, sev_feat] + metric_dims)

        return np.array(features)

    def _extract_metric_dimensions(self, alert: Alert) -> list[float]:
        """Extract metric dimensions from alert labels"""
        dims = []
        for key in ['cpu', 'memory', 'disk', 'network', 'service']:
            val = alert.labels.get(key, 0)
            if isinstance(val, (int, float)):
                dims.append(float(val) / 100.0)  # Normalize to 0-1
            else:
                dims.append(0.0)
        return dims

    def cluster(self, alerts: list[Alert]) -> list[list[Alert]]:
        """Execute clustering, return alert groupings"""
        if len(alerts) < 2:
            return [alerts] if alerts else []

        features = self.extract_features(alerts)

        # Standardize features
        scaler = StandardScaler()
        features_scaled = scaler.fit_transform(features)

        # DBSCAN clustering
        clustering = DBSCAN(eps=self.eps, min_samples=2).fit(features_scaled)
        labels = clustering.labels_

        # Group by cluster labels
        groups = {}
        for i, label in enumerate(labels):
            if label not in groups:
                groups[label] = []
            groups[label].append(alerts[i])

        return list(groups.values())

# llm_analyzer.py
import json
from typing import Optional
from openai import OpenAI

class LLGRCAAnalyzer:
    """LLM-based alert root cause analysis"""

    SYSTEM_PROMPT = """You are an experienced SRE expert skilled at quickly identifying root causes from massive alert volumes.
Please analyze the following alert cluster and provide:
1. Most likely root cause (brief description)
2. Reasoning basis
3. Recommended investigation steps
4. Confidence score (0-100)

Output format: JSON with root_cause, reasoning, steps, confidence fields."""

    def __init__(self, api_key: str, base_url: str, model: str = "qwen-max"):
        self.client = OpenAI(api_key=api_key, base_url=base_url)
        self.model = model

    def analyze(self, event_alerts: list[dict]) -> dict:
        """Analyze a group of correlated alerts, return root cause analysis"""

        # Build alert summary
        alert_summary = []
        for alert in event_alerts:
            alert_summary.append({
                "name": alert["alert_name"],
                "severity": alert["severity"],
                "instance": alert["instance"],
                "summary": alert.get("annotations", {}).get("summary", ""),
                "labels": alert.get("labels", {})
            })

        # Build analysis context
        context = {
            "alert_count": len(alert_summary),
            "time_range": "last_15_minutes",
            "alerts": alert_summary
        }

        response = self.client.chat.completions.create(
            model=self.model,
            messages=[
                {"role": "system", "content": self.SYSTEM_PROMPT},
                {"role": "user", "content": json.dumps(context, ensure_ascii=False)}
            ],
            temperature=0.3
        )

        result = json.loads(response.choices[0].message.content)

        return {
            "root_cause": result.get("root_cause", ""),
            "reasoning": result.get("reasoning", ""),
            "steps": result.get("steps", []),
            "confidence": result.get("confidence", 50)
        }

# noise_filter.py
from datetime import datetime, timedelta
from collections import defaultdict

class AlertNoiseFilter:
    """Alert noise reduction filter"""

    def __init__(self):
        # Historical alert pattern library
        self.pattern_library: dict[str, list] = {}
        # Known invalid alert patterns
        self.known_noise_patterns: list[dict] = []

    def is_noise(self, alert: dict) -> bool:
        """Determine if alert is known noise"""
        for pattern in self.known_noise_patterns:
            if self._matches_pattern(alert, pattern):
                return True
        return False

    def _matches_pattern(self, alert: dict, pattern: dict) -> bool:
        """Check if alert matches known noise pattern"""
        if alert.get("alert_name") != pattern.get("alert_name"):
            return False
        # Check frequency within time window
        freq = pattern.get("frequency", 0)
        if freq > 10:  # High-frequency repeated alerts considered noise
            return True
        return False

    def compress(self, alerts: list[dict]) -> list[dict]:
        """Alert compression: merge multiple triggers of the same event"""
        compressed = []
        seen_keys = set()

        for alert in alerts:
            # Generate compression key: alert name + instance + time window
            key = f"{alert['alert_name']}:{alert['instance']}"
            window_key = f"{key}:{alert['starts_at'].strftime('%Y%m%d%H')}"

            if window_key in seen_keys:
                # Find corresponding compressed entry and increment count
                for c in compressed:
                    if c.get("compress_key") == window_key:
                        c["repeat_count"] = c.get("repeat_count", 1) + 1
                        break
                continue

            seen_keys.add(window_key)
            compressed.append({
                **alert,
                "compress_key": window_key,
                "repeat_count": 1
            })

        return compressed

# correlation_engine.py
import asyncio
from datetime import datetime
from typing import Optional

class AlertCorrelationEngine:
    """Main alert correlation analysis engine"""

    def __init__(self, clustering: AlertClusteringEngine,
                 llm_analyzer: LLGRCAAnalyzer,
                 noise_filter: AlertNoiseFilter):
        self.clustering = clustering
        self.llm_analyzer = llm_analyzer
        self.noise_filter = noise_filter

    async def process_alerts(self, raw_alerts: list[dict]) -> list[dict]:
        """Process raw alerts, return aggregated event list"""

        # Step 1: Noise filtering
        filtered_alerts = [a for a in raw_alerts if not self.noise_filter.is_noise(a)]
        print(f"Raw alerts: {len(raw_alerts)}, After filtering: {len(filtered_alerts)}")

        # Step 2: Time-series clustering
        alert_groups = self.clustering.cluster(filtered_alerts)
        print(f"Clustering result: {len(alert_groups)} event groups")

        # Step 3: LLM root cause analysis
        events = []
        for group in alert_groups:
            if len(group) < 2:
                # Single alert output directly
                events.append({
                    "event_id": self._generate_id(),
                    "alert_count": 1,
                    "type": "single",
                    "alerts": group,
                    "root_cause": group[0].get("annotations", {}).get("summary", "Unknown"),
                    "confidence": 0.5,
                    "steps": ["Check alert details"],
                    "created_at": datetime.now().isoformat()
                })
                continue

            # LLM analysis
            analysis = await asyncio.to_thread(
                self.llm_analyzer.analyze, group
            )

            events.append({
                "event_id": self._generate_id(),
                "alert_count": len(group),
                "type": "correlated",
                "alerts": group,
                "root_cause": analysis["root_cause"],
                "reasoning": analysis["reasoning"],
                "confidence": analysis["confidence"] / 100.0,
                "steps": analysis["steps"],
                "created_at": datetime.now().isoformat()
            })

        return events

    def _generate_id(self) -> str:
        import uuid
        return uuid.uuid4().hex[:12]

# docker-compose.yml
version: '3.8'

services:
  # Prometheus monitoring
  prometheus:
    image: prom/prometheus:latest
    container_name: vps-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'

  # Alertmanager
  alertmanager:
    image: prom/alertmanager:latest
    container_name: vps-alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'

  # Node Exporter
  node-exporter:
    image: prom/node-exporter:latest
    container_name: vps-node-exporter
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--path.rootfs=/rootfs'

  # Grafana
  grafana:
    image: grafana/grafana:latest
    container_name: vps-grafana
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/datasources:/etc/grafana/provisioning/datasources
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin123

  # AI Alert Correlation Engine
  alert-correlator:
    build: ./alert-correlator
    container_name: vps-alert-correlator
    ports:
      - "8080:8080"
    environment:
      - LLM_API_KEY=${LLM_API_KEY}
      - LLM_BASE_URL=${LLM_BASE_URL}
      - LLM_MODEL=${LLM_MODEL:-qwen-max}
      - PROMETHEUS_URL=http://prometheus:9090
      - ALERTMANAGER_URL=http://alertmanager:9093
    volumes:
      - ./alert-correlator/config:/app/config
      - ./alert-correlator/models:/app/models

volumes:
  prometheus-data:
  grafana-data:

# prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "alerts.yml"

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']
        labels:
          instance: 'vps-primary'

alerting:
  alertmanagers:
    - static_configs:
        - targets: ['alertmanager:9093']

# alerts.yml
groups:
  - name: vps_critical
    rules:
      - alert: HighCPUUsage
        expr: 100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 90
        for: 5m
        labels:
          severity: critical
          category: resource
        annotations:
          summary: "CPU usage exceeds 90%"
          description: "{{ $labels.instance }} CPU usage {{ $value | printf \"%.1f\" }}%"

      - alert: MemoryExhaustion
        expr: (node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes * 100 > 95
        for: 3m
        labels:
          severity: critical
          category: resource
        annotations:
          summary: "Memory usage exceeds 95%"
          description: "{{ $labels.instance }} memory usage {{ $value | printf \"%.1f\" }}%"

      - alert: DiskSpaceCritical
        expr: (node_filesystem_avail_bytes / node_filesystem_size_bytes) * 100 < 5
        for: 10m
        labels:
          severity: critical
          category: storage
        annotations:
          summary: "Disk space below 5%"
          description: "{{ $labels.instance }} disk remaining {{ $value | printf \"%.1f\" }}%"

  - name: vps_network
    rules:
      - alert: NetworkLatencyHigh
        expr: histogram_quantile(0.99, rate(http_request_duration_seconds_bucket[5m])) > 2
        for: 5m
        labels:
          severity: warning
          category: network
        annotations:
          summary: "API response latency exceeds 2 seconds"

      - alert: ServiceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
          category: service
        annotations:
          summary: "Service {{ $labels.job }} is down"