# docker-compose.yaml
services:
  loki:
    image: grafana/loki:3.2.0
    ports:
      - "3100:3100"
    volumes:
      - ./loki-data:/loki
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - monitoring

  promtail:
    image: grafana/promtail:3.2.0
    volumes:
      - /var/log:/var/log
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./promtail/config.yaml:/etc/promtail/config.yaml
    networks:
      - monitoring

  qdrant:
    image: qdrant/qdrant:1.9.0
    ports:
      - "6333:6333"
      - "6334:6334"
    volumes:
      - ./qdrant-data:/qdrant/storage
    networks:
      - monitoring

  ollama:
    image: ollama/ollama:latest
    ports:
      - "11434:11434"
    volumes:
      - ./ollama-data:/root/.ollama
    networks:
      - monitoring

  grafana:
    image: grafana/grafana:11.0.0
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin123
    volumes:
      - ./grafana-data:/var/lib/grafana
    networks:
      - monitoring
    depends_on:
      - loki

networks:
  monitoring:
    driver: bridge

# promtail/config.yaml
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/*.log
          
  - job_name: docker
    static_configs:
      - targets:
          - localhost
        labels:
          job: docker
          __path__: /var/lib/docker/containers/*/*.log

# Install Promtail
wget https://github.com/grafana/loki/releases/download/v3.2.0/promtail-linux-amd64.zip
unzip promtail-linux-amd64.zip
sudo mv promtail-linux-amd64 /usr/local/bin/promtail

# Configure
sudo tee /etc/promtail/config.yaml << 'EOF'
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://your-main-vps:3100/loki/api/v1/push

scrape_configs:
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: remote-system
          instance: vps-01
          __path__: /var/log/*.log
EOF

# Start service
sudo systemctl start promtail
sudo systemctl enable promtail

# scripts/vectorize_logs.py
import json
import requests
from datetime import datetime
from openai import OpenAI

# Local Ollama client
client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")

QDRANT_URL = "http://localhost:6333"
COLLECTION_NAME = "vps_logs"

def embed_text(text: str) -> list:
    """Generate text embeddings using Ollama"""
    response = client.embeddings.create(
        model="nomic-embed-text",
        input=text
    )
    return response.data[0].embedding

def upsert_log_entry(log_entry: dict):
    """Store log entry in Qdrant"""
    
    # Extract key information
    message = log_entry.get("message", "")
    level = log_entry.get("level", "INFO")
    timestamp = log_entry.get("timestamp", "")
    host = log_entry.get("host", "unknown")
    
    # Build query text (for future RAG search)
    query_text = f"[{level}] {message}"
    
    # Generate vector
    vector = embed_text(query_text)
    
    # Store in Qdrant
    payload = {
        "level": level,
        "timestamp": timestamp,
        "host": host,
        "message": message,
        "raw_log": json.dumps(log_entry, ensure_ascii=False)
    }
    
    # Generate point ID (using timestamp hash)
    point_id = hash(f"{host}:{timestamp}:{message[:50]}") % (2**63)
    
    requests.put(
        f"{QDRANT_URL}/collections/{COLLECTION_NAME}/points/{point_id}",
        json={"vector": vector, "payload": payload}
    )
    
    return point_id

def batch_vectorize(log_file: str, limit: int = 1000):
    """Batch vectorize log file"""
    with open(log_file) as f:
        lines = f.readlines()[:limit]
    
    for i, line in enumerate(lines):
        try:
            entry = json.loads(line.strip())
            upsert_log_entry(entry)
            print(f"[{i+1}/{limit}] Indexed: {entry.get('message', '')[:50]}...")
        except:
            continue

if __name__ == "__main__":
    import sys
    if len(sys.argv) > 1:
        batch_vectorize(sys.argv[1])
    else:
        print("Usage: python vectorize_logs.py <logfile>")

# scripts/init_qdrant.py
import requests
import json

QDRANT_URL = "http://localhost:6333"

def create_collection():
    """Create log collection"""
    payload = {
        "vectors": {
            "size": 768,  # nomic-embed-text vector dimensions
            "distance": "Cosine"
        }
    }
    
    response = requests.put(
        f"{QDRANT_URL}/collections/vps_logs",
        json=payload
    )
    
    if response.status_code == 200:
        print("Collection 'vps_logs' created successfully!")
    else:
        print(f"Error: {response.text}")

if __name__ == "__main__":
    create_collection()

# scripts/llm_diagnose.py
import json
import requests
from openai import OpenAI

client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")
QDRANT_URL = "http://localhost:6333"

SYSTEM_PROMPT = """You are a senior VPS operations expert. Your task is to diagnose current issues based on log data and historical failure cases, then provide fix recommendations.

Output format:
1. 【Issue Summary】One-sentence description of the current failure
2. 【Root Cause Analysis】Detailed analysis of possible causes
3. 【Similar Historical Cases】Reference matching historical failures from vector database (if any)
4. 【Fix Recommendations】Provide specific fix commands or steps
5. 【Priority】Urgency assessment"""

def search_similar_logs(query: str, limit: int = 5) -> list:
    """Search similar logs in Qdrant"""
    # Generate query vector
    embed_response = client.embeddings.create(
        model="nomic-embed-text",
        input=query
    )
    query_vector = embed_response.data[0].embedding
    
    # Search
    response = requests.post(
        f"{QDRANT_URL}/collections/vps_logs/query",
        json={
            "query": query_vector,
            "limit": limit,
            "with_payload": True
        }
    )
    
    return response.json().get("result", [])

def diagnose_issue(recent_logs: str, query: str) -> dict:
    """Use LLM to diagnose issues"""
    
    # Search similar historical cases
    similar_cases = search_similar_logs(query)
    
    # Build context
    context = f"""
=== Recent Error Logs ===
{recent_logs}

=== Similar Historical Cases ===
"""
    
    for case in similar_cases:
        payload = case.get("payload", {})
        context += f"""
- Time: {payload.get('timestamp', 'N/A')}
  Host: {payload.get('host', 'N/A')}
  Level: {payload.get('level', 'N/A')}
  Content: {payload.get('message', 'N/A')[:200]}
"""
    
    # Call LLM
    response = client.chat.completions.create(
        model="llama3.2:3b",
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": context}
        ],
        temperature=0.3,
        max_tokens=1500
    )
    
    return {
        "diagnosis": response.choices[0].message.content,
        "similar_cases_count": len(similar_cases)
    }

if __name__ == "__main__":
    import sys
    if len(sys.argv) > 1:
        query = sys.argv[1]
        # Read last 50 lines of error logs
        recent_logs = ""
        with open("/tmp/recent_errors.log") as f:
            recent_logs = f.read()
        
        result = diagnose_issue(recent_logs, query)
        print(result["diagnosis"])

#!/bin/bash
# scripts/daily_inspection.sh

LOG_FILE="/var/log/inspection_$(date +%Y%m%d).log"
RECENT_ERRORS="/tmp/recent_errors.log"

# Fetch last 1 hour of ERROR/WARN logs from Loki
echo "Fetching recent errors from Loki..."
curl -g 'http://localhost:3100/loki/api/v1/query_range?query={job="varlogs"} |= "error" or |= "warn"&start=1h ago&end=now' \
  -H 'Accept: application/json' | jq '.data.result[0].values' > "$RECENT_ERRORS"

# If no errors, skip
if [ ! -s "$RECENT_ERRORS" ]; then
    echo "No recent errors found. Skipping diagnosis."
    exit 0
fi

# Run LLM diagnosis
echo "Running LLM diagnosis..."
python3 /opt/vps-logs-analyzer/scripts/llm_diagnose.py "system errors detected" > "$LOG_FILE"

# Send alert (if critical issue)
if grep -qi "critical\|urgent" "$LOG_FILE"; then
    curl -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \
      -d "chat_id=<CHAT_ID>" \
      -d "text=$(head -20 "$LOG_FILE")"
fi

echo "Inspection completed. Report: $LOG_FILE"

{
  "dashboard": {
    "title": "VPS Log Intelligence",
    "panels": [
      {
        "title": "Recent Error Logs",
        "type": "logs",
        "datasource": "Loki",
        "targets": [
          {
            "expr": "{job=~\"varlogs|docker\"} |= `error` or |= `warn`"
          }
        ]
      },
      {
        "title": "LLM Diagnosis Results",
        "type": "text",
        "targets": [
          {
            "rawSql": "SELECT diagnosis FROM ai_diagnostics ORDER BY time DESC LIMIT 1"
          }
        ]
      }
    ]
  }
}

# alerting/rules.yaml
groups:
  - name: vps_logs
    rules:
      - alert: HighErrorRate
        expr: count by (host) (count_over_time({job="varlogs"} |= "error"[5m])) > 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High error rate on {{ $labels.host }}"
          
      - alert: LLMDiagnosisCritical
        expr: vector(1)
        for: 0m
        labels:
          severity: critical
        annotations:
          summary: "Critical issue detected by AI"

# Trigger diagnosis
query = "MySQL connection refused"
recent_logs = """
2026-08-06T10:23:15Z ERROR: Too many connections
2026-08-06T10:23:16Z ERROR: Aborted connection 12345
2026-08-06T10:23:17Z ERROR: Can't create new thread
"""

result = diagnose_issue(recent_logs, query)

#!/bin/bash
# deploy_logs_platform.sh

set -e

echo "🚀 Deploying AI-powered VPS Log Analysis Platform"

# 1. Create directory structure
mkdir -p ~/vps-logs-analyzer/{config,scripts,logs,data}
cd ~/vps-logs-analyzer

# 2. Pull Docker Compose
cat > docker-compose.yaml << 'EOF'
services:
  loki:
    image: grafana/loki:3.2.0
    ports: ["3100:3100"]
    volumes: ["./data/loki:/loki"]
    command: -config.file=/etc/loki/local-config.yaml
    
  qdrant:
    image: qdrant/qdrant:1.9.0
    ports: ["6333:6333", "6334:6334"]
    volumes: ["./data/qdrant:/qdrant/storage"]
    
  ollama:
    image: ollama/ollama:latest
    ports: ["11434:11434"]
    volumes: ["./data/ollama:/root/.ollama"]
    
  grafana:
    image: grafana/grafana:11.0.0
    ports: ["3000:3000"]
    environment: ["GF_SECURITY_ADMIN_PASSWORD=admin123"]
    volumes: ["./data/grafana:/var/lib/grafana"]
    depends_on: ["loki"]
EOF

# 3. Start services
docker compose up -d

# 4. Wait for services to be ready
echo "⏳ Waiting for services..."
sleep 10

# 5. Initialize Qdrant
python3 scripts/init_qdrant.py

# 6. Pull embedding model
echo "📥 Pulling nomic-embed-text model..."
curl -s http://localhost:11434/api/pull -d '{"name":"nomic-embed-text"}'

# 7. Pull LLM model
echo "📥 Pulling llama3.2:3b model..."
curl -s http://localhost:11434/api/pull -d '{"name":"llama3.2:3b"}'

echo "✅ Deployment complete!"
echo "   Grafana: http://your-vps:3000 (admin/admin123)"
echo "   Qdrant:  http://your-vps:6333"