# Ubuntu/Debian
sudo apt update
sudo apt install -y fluent-bit

# Or use Docker
docker run -d \
  --name fluent-bit \
  -v /var/log:/var/log:ro \
  -v /var/lib/docker/containers:/var/lib/docker/containers:ro \
  -v /root/fluent-bit:/fluent-bit/etc \
  --privileged \
  fluent-bit/fluent-bit:latest

# /etc/fluent-bit/fluent-bit.conf
[SERVICE]
    Flush        1
    Log_Level    info
    Parsers_File parsers.conf

[INPUT]
    Name         tail
    Path         /var/log/syslog,/var/log/auth.log,/var/log/nginx/*.log
    Parser       syslog
    Tag          system.*
    Refresh_Interval 5

[OUTPUT]
    Name         stdout
    Match        *
    Format       json

# One-click Docker Compose deployment
cat > docker-compose.yml << 'EOF'
version: '3.8'
services:
  loki:
    image: grafana/loki:2.9.0
    ports:
      - "3100:3100"
    volumes:
      - /root/loki-data:/loki
    command: -config.file=/etc/loki/local-config.yaml

  promtail:
    image: grafana/promtail:2.9.0
    volumes:
      - /var/log:/var/log
      - /root/promtail-config.yaml:/etc/promtail/config.yaml
EOF

docker-compose up -d

import os
import json
import re
from datetime import datetime, timedelta
from collections import defaultdict
import subprocess

# Fetch logs from Loki API
def fetch_recent_logs(hours=2):
    """Fetch recent logs from Loki API"""
    import requests
    end = datetime.now().timestamp() * 1e9
    start = (datetime.now() - timedelta(hours=hours)).timestamp() * 1e9
    query = '=~ "error|fail|warn|denied|timeout"'
    url = f"http://localhost:3100/loki/api/v1/query_range?query={query}&start={start}&end={end}"
    resp = requests.get(url)
    return resp.json().get('data', {}).get('result', [])

# Extract log patterns
def extract_patterns(logs):
    """Extract key patterns from logs"""
    patterns = defaultdict(int)
    for stream in logs:
        for ts, line in stream.get('values', []):
            # Extract IPs, error codes, module names
            ips = re.findall(r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b', line)
            errors = re.findall(r'ERROR[:\s]+(\w+)', line, re.IGNORECASE)
            for ip in ips:
                patterns[f'IP:{ip}'] += 1
            for err in errors:
                patterns[f'ERROR:{err}'] += 1
    return dict(patterns)

# LLM-based root cause analysis
def analyze_with_llm(patterns, recent_logs_text):
    """Call local LLM for root cause analysis"""
    prompt = f"""You are a DevOps expert. Analyze the following log patterns and anomalies,
identify the root cause, and provide fix recommendations.

Anomaly Pattern Statistics:
{json.dumps(patterns, indent=2, ensure_ascii=False)}

Recent Anomaly Logs (first 50 lines):
{recent_logs_text[:2000]}

Please output:
1. Root cause analysis (one sentence)
2. Impact scope
3. Recommended fix steps
4. Risk level (high/medium/low)
"""
    # Use subprocess to call local Ollama
    result = subprocess.run(
        ['ollama', 'run', 'llama3', prompt],
        capture_output=True, text=True, timeout=60
    )
    return result.stdout

import asyncio
import logging
from datetime import datetime

class LogMonitor:
    def __init__(self, check_interval=300):
        self.check_interval = check_interval  # Check every 5 minutes
        self.baseline_patterns = {}
        self.thresholds = {
            'error_rate': 10,      # Errors per minute threshold
            'auth_failures': 5,    # Auth failure threshold
            'disk_full': 90,       # Disk usage threshold
        }
    
    async def run(self):
        logging.info("Starting AI log monitoring daemon...")
        while True:
            try:
                await self.check()
                await asyncio.sleep(self.check_interval)
            except Exception as e:
                logging.error(f"Monitoring loop error: {e}")
                await asyncio.sleep(60)
    
    async def check(self):
        """Perform one check cycle"""
        logs = fetch_recent_logs(hours=0.1)  # Last 10 minutes
        patterns = extract_patterns(logs)
        
        # Detect anomalies
        anomalies = []
        for pattern, count in patterns.items():
            if pattern.startswith('ERROR:'):
                anomalies.append({
                    'type': 'error_spike',
                    'pattern': pattern,
                    'count': count,
                    'severity': 'high' if count > 20 else 'medium'
                })
            elif pattern.startswith('IP:'):
                # Detect brute force attacks
                if 'auth' in pattern.lower() and count > 10:
                    anomalies.append({
                        'type': 'brute_force',
                        'ip': pattern[3:],
                        'count': count,
                        'severity': 'high'
                    })
        
        if anomalies:
            # Call LLM for analysis
            logs_text = fetch_recent_logs(hours=0.1)
            analysis = analyze_with_llm(patterns, logs_text)
            
            # Send alert
            await self.send_alert(anomalies, analysis)

version: '3.8'
services:
  # Log collection
  fluent-bit:
    image: fluent-bit:latest
    volumes:
      - /var/log:/var/log:ro
      - /root/config/fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf:ro
    depends_on:
      - loki

  # Log storage
  loki:
    image: grafana/loki:2.9.0
    ports:
      - "3100:3100"
    volumes:
      - /root/loki-data:/loki
    command: -config.file=/etc/loki/local-config.yaml

  # AI analysis service
  log-analyzer:
    build: ./log-analyzer
    environment:
      - LOKI_URL=http://loki:3100
      - OLLAMA_URL=http://host.docker.internal:11434
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
    volumes:
      - /root/log-analyzer/config:/app/config
    depends_on:
      - loki
    restart: unless-stopped

  # Grafana visualization
  grafana:
    image: grafana/grafana:10.2.0
    ports:
      - "3000:3000"
    volumes:
      - /root/grafana-data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    depends_on:
      - loki

# alert_sender.py
import asyncio
import httpx
from datetime import datetime

class AlertSender:
    def __init__(self, telegram_token, telegram_chat_id):
        self.telegram_token = telegram_token
        self.telegram_chat_id = telegram_chat_id
        self.telegram_url = f"https://api.telegram.org/bot{telegram_token}"
    
    async def send_telegram(self, message: str, severity: str = 'info'):
        """Send Telegram alert"""
        emoji = {'high': '🔴', 'medium': '🟡', 'low': '🟢'}.get(severity, '⚪')
        
        formatted = f"""{emoji} **VPS Anomaly Alert**
📅 {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
🔧 Root Cause Analysis:
{message}

— SelfVPS AI Monitor"""
        
        async with httpx.AsyncClient() as client:
            await client.post(
                f"{self.telegram_url}/sendMessage",
                json={
                    'chat_id': self.telegram_chat_id,
                    'text': formatted,
                    'parse_mode': 'Markdown'
                }
            )

# query_logs.py
import os
from langchain_community.vectorstores import Chroma
from langchain.embeddings import OllamaEmbeddings
from langchain.llms import Ollama
from langchain.chains import RetrievalQA

# Load historical log vector store
embeddings = OllamaEmbeddings(model="nomic-embed-text")
vectorstore = Chroma(
    persist_directory="/root/log-analyzer/chroma_db",
    embedding_function=embeddings
)

# Create QA chain
llm = Ollama(model="llama3")
qa_chain = RetrievalQA.from_chain_type(
    llm=llm,
    retriever=vectorstore.as_retriever(),
    return_source_documents=True
)

# Natural language query
query = "What anomalies occurred yesterday?"
result = qa_chain({"query": query})
print(result['result'])

query = "Find all 502 error logs"
result = qa_chain({"query": query})
print(result['result'])