AI Log Analyzer

LLM Provider

Provider Use LLM for deep analysis

Source & Run

Source

Containers

none selected

Tail lines per container 50–5000 lines

Hostname (optional) Paste log lines

Absolute path on server

Accepts a single file or a directory (recursively scans *.log). SecureCRT recordings (HH:MM:SS.ss §…) are auto-detected.

⌘+↵ or Ctrl+↵ to run

🔴 Live Tail

Syslog source Minimum severity

Streams classified events from a registered syslog listener source in real time (SSE — no polling, no build step).

Optimize Device

Target hostname (lab device) Platform

Cross-Source Correlation

Find hosts flagged by ≥2 sources (confirmed) vs 1 (suspected), across all registered sources.

Min severity Window (seconds)

Device Triage

Full verdict for one host: health score, severity histogram, top processes, deduped error patterns.

Hostname

Real-Config Samples

Sanitized production configs — secrets stripped before any LLM call.

Site Bundles

Whole-site analysis across all devices in a bundle.

Actions

Analysis

Site Documentation

🤖 AI Copilot

Ask anything about the selected site's config.

⌘+↵ to send from the textarea

🔎 Post-Mortem Search

Find a pattern across every device in the site.

↵ to search from the input

📄 Export Analysis Results

Different from Site Documentation: this exports the last analysis result (findings, gaps, score) from the Site tab.

Context · —

Health

—

No analysis yet

Active Alerts

—

critical + high

Devices

—

monitored

Last Analysis

—

UTC

Health Overview

—

Score trend (last 10)

— no history yet —

Critical 0

High 0

Medium 0

Executive Summary

Action Items

Click any row to expand the 5-phase incident playbook.

Severity	Description	Count	Devices

🔴 Live Tail

Classified events streaming in real time from the selected syslog source. Newest first; the view keeps the last 200 events.

Severity	Time	Device	Category	Description

📶 Fabric Stability

Per-device stability: flap oscillations (down↔up round trips), event-rate bursts vs the device's own baseline, and a heuristic 24h risk band from the activity trend. Worst devices first.

Device	Score	Flaps	Burst	Trend	24h Risk

🔭 Unknown Patterns

Message shapes no knowledge-base rule matched, mined into templates (variables masked as <ip>/<n>/<if>). A brand-new error shape often precedes an outage — review ⚠ rows first. 🆕 marks shapes never seen in any prior run (set AI_LOG_ANALYZER_TEMPLATE_STORE to enable).

	Template	Count	Hosts

⚙️ Config Optimization

Findings (scroll within block)

Monitoring Gaps

🔗 Cross-Source Correlation

🔬 Device Triage

—

health

Severity Histogram

Top Processes

Deduplicated Error Patterns

🌐 Site-Level Analysis

Cross-Device Findings

Site-Wide Monitoring Gaps

🗺️ Topology Map

Pick a layer below — devices are tiered by role (core → edge → dist → leaf). Drag any node to pin it; pins persist per site/layer in your browser. Reset Layout recomputes from scratch.

· Group by POP Show IPs

Firewall Router Switch Other · Critical finding High finding Medium finding

✅ Compliance Check Report

🤖 AI Copilot

Copilot

🔎 Post-Mortem Search Results

🎯 Site-Wide Strategic Optimization

Strategic Gaps

Best Practices Already Applied

Phased Roadmap

Recent Classified Events

Rows are tinted + accented by severity for fast scanning. Scroll within the table to see more.

Showing in a scroll-capped view

Sev	Time	Host	Cat	Description

👋 Welcome

Pick a source in the sidebar and run an analysis to populate this dashboard.

No analysis loaded yet

Try 📊 Logs → Run Analysis for the FRR lab, or pick a site bundle under 🌐 Site.