# log_parser.py
import re
from datetime import datetime

LOG_PATTERN = r'(?P<timestamp>\S+)\s+(?P<pid>\d+)\s+(?P<level>\w+)\s+(?P<message>.*)'

def parse_log_line(line):
    """单行日志初步解析"""
    match = re.match(LOG_PATTERN, line.strip())
    if match:
        return match.groupdict()
    return {"raw": line}

def enrich_with_llm(parsed_log, llm_client):
    """使用 LLM 增强解析，提取更细粒度的语义信息"""
    
    prompt = f"""你是一个资深日志分析专家。请分析以下日志条目，提取结构化信息：
    
原始日志：{parsed_log.get('raw', '')}
解析字段：{parsed_log}

请返回 JSON 格式，包含以下字段：
- timestamp: ISO 格式时间戳
- level: 严重程度 (info/warning/error/critical)
- component: 涉及的组件 (如 kernel/nginx/docker/mysql)
- error_type: 错误类型分类 (如 connection_timeout/out_of_memory/auth_failed)
- severity: 综合评分 0-100
- related_ips: 涉及的 IP 地址列表
- affected_services: 受影响的微服务列表
- suggested_action: 建议的操作措施
"""
    
    try:
        response = llm_client.complete(prompt)
        # 解析 LLM 返回的 JSON
        return parse_json_response(response)
    except Exception as e:
        return {**parsed_log, "llm_error": str(e)}

# anomaly_scoring.py
from collections import deque
import numpy as np

class TimeSeriesAnomalyDetector:
    """基于统计基线的时序异常检测器"""
    
    def __init__(self, window_size=100, threshold_sigma=3):
        self.window = deque(maxlen=window_size)
        self.threshold_sigma = threshold_history
    
    def add_value(self, value):
        self.window.append(value)
        
    def check_anomaly(self, current_value):
        if len(self.window) < 10:
            return False, None
        
        mean = np.mean(self.window)
        std = np.std(self.window) if len(self.window) > 1 else 1
        
        if std == 0:
            return False, None
            
        z_score = abs(current_value - mean) / std
        is_anomalous = z_score > self.threshold_sigma
        
        return is_anomalous, z_score

class CompositeScoreCalculator:
    """组合多种异常来源的得分"""
    
    def calculate_time_series_score(self, ts_detector, metric_value):
        is_anom, z_score = ts_detector.check_anomaly(metric_value)
        return {"type": "time_series", "score": min(z_score / 5, 1.0), "anomaly": is_anom}
    
    def calculate_llm_score(self, llm_analysis):
        # LLM 给出的 severity 评分 0-100
        llm_severity = llm_analysis.get("severity", 0) / 100.0
        return {"type": "llm_semantic", "score": llm_severity, "anomaly": llm_severity > 0.7}
    
    def combine_scores(self, scores):
        weighted_sum = sum(s["score"] * (0.6 if s["type"] == "time_series" else 0.4) for s in scores)
        combined = min(weighted_sum, 1.0)
        any_anomaly = any(s["anomaly"] for s in scores)
        return {"combined_score": combined, "any_anomaly": any_anomaly, "details": scores}

# 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 拉取 Qwen 模型
ollama run qwen:7b-instruct-q4_K_M

# 或使用更小版本以节省资源
ollama run phi3:mini-instruct-q4_K_M

import requests

OLLAMA_BASE = "http://localhost:11434"

def call_ollama(prompt):
    response = requests.post(
        f"{OLLAMA_BASE}/api/generate",
        json={"model": "qwen:7b-instruct-q4_K_M", "prompt": prompt}
    )
    return response.json()["response"]

# main_pipeline.py
import time
from datetime import datetime
from log_parser import parse_log_line, enrich_with_llm
from anomaly_scoring import TimeSeriesAnomalyDetector, CompositeScoreCalculator
from response_handler import trigger_alert, auto_heal

def setup_components():
    # 初始化各组件
    cpu_detector = TimeSeriesAnomalyDetector(window_size=200, threshold_sigma=2.5)
    memory_detector = TimeSeriesAnomalyDetector(window_size=200, threshold_sigma=2.5)
    llm_client = OllamaClient(base_url="http://localhost:11434")
    score_calculator = CompositeScoreCalculator()
    return cpu_detector, memory_detector, llm_client, score_calculator

def process_system_metrics(cpu_usage, memory_usage, cpu_detector, memory_detector):
    cpu_detector.add_value(cpu_usage)
    memory_detector.add_value(memory_usage)
    
    cpu_result = score_calculator.calculate_time_series_score(cpu_detector, cpu_usage)
    mem_result = score_calculator.calculate_time_series_score(memory_detector, memory_usage)
    return cpu_result, mem_result

def process_logs(log_lines, llm_client, score_calculator):
    llm_scores = []
    for line in log_lines[:10]:  # 每批处理最多 10 行日志
        parsed = parse_log_line(line)
        enriched = enrich_with_llm(parsed, llm_client)
        if enriched.get("severity", 0) > 70:  # 仅关注高严重性日志
            llm_result = score_calculator.calculate_llm_score(enriched)
            llm_scores.append(llm_result)
    return llm_scores

def anomaly_detection_loop(interval_seconds=60):
    cpu_detector, memory_detector, llm_client, score_calculator = setup_components()
    
    while True:
        # 1. 采集当前指标
        cpu_usage = get_cpu_usage()  # 实际实现读取 /proc/stat 或 Prometheus
        memory_usage = get_memory_usage()  # 实际实现读取 /proc/meminfo
        
        # 2. 检测时序异常
        cpu_ts_score, mem_ts_score = process_system_metrics(
            cpu_usage, memory_usage, cpu_detector, memory_detector
        )
        
        # 3. 分析最近日志
        recent_logs = read_recent_logs(hours=1)
        llm_scores = process_logs(recent_logs, llm_client, score_calculator)
        
        # 4. 组合评分
        all_scores = [cpu_ts_score, mem_ts_score] + llm_scores
        combined = score_calculator.combine_scores(all_scores)
        
        # 5. 决定是否触发响应
        if combined["any_anomaly"] or combined["combined_score"] > 0.5:
            alert_info = {
                "timestamp": datetime.now().isoformat(),
                "cpu_percent": cpu_usage,
                "memory_percent": memory_usage,
                "anomaly_details": combined["details"],
                "severity": "critical" if combined["combined_score"] > 0.8 else "warning"
            }
            
            # 根据严重级别采取行动
            if combined["combined_score"] > 0.8:
                trigger_alert(alert_info, channel=["slack", "email"])
                auto_heal(alert_info)  # 尝试自动修复
            else:
                trigger_alert(alert_info, channel=["internal_log"])  # 仅记录日志
        
        time.sleep(interval_seconds)

if __name__ == "__main__":
    anomaly_detection_loop(interval_seconds=30)

# prompts.yaml
log_analysis_prompt: |
  你是一个专业的 DevOps 日志分析助手。请分析以下服务器日志，提取结构化信息并以 JSON 格式返回。
  
  原始日志: {{log_content}}
  
  要求输出:
  - timestamp: 标准 ISO 时间字符串
  - level: info/warning/error/critical
  - 组件名称: 如 nginx, docker, kernel, mysql 等
  - error_classification: 将错误归类到标准类别中
  - severity_score: 0-100 的严重程度评分
  - impact_assessment: 该错误对业务的影响程度描述
  - recommended_actions: 1-3 条具体的修复建议
  - related_knowledge_links: 相关的文档或知识库链接索引

anomaly_investigation_prompt: |
  你是一位经验丰富的 SRE 工程师。用户报告了如下问题：{{user_report}}。
  
  请结合以下监控数据进行分析，给出可能的原因和解决方案：
  
  监控数据: {{monitoring_data}}
  最近日志摘要: {{recent_log_summary}}
  
  你的回答应该包括:
  - 最可能的 root cause (按可能性排序)
  - 每个原因的验证步骤
  - 推荐的修复方案 (如有必要提供具体命令)
  - 预防措施建议