265 lines
11 KiB
Python
265 lines
11 KiB
Python
# LLM-Powered Monitoring Agent
|
|
|
|
import time
|
|
import json
|
|
import subprocess
|
|
import ollama
|
|
from discord_webhook import DiscordWebhook
|
|
import requests
|
|
import data_storage
|
|
import re
|
|
from datetime import datetime, timezone
|
|
|
|
# Load configuration
|
|
import config
|
|
|
|
from syslog_rfc5424_parser import parser
|
|
|
|
# --- Data Ingestion & Parsing Functions ---
|
|
|
|
def get_system_logs():
|
|
"""Gets the last 100 lines of /var/log/syslog and parses them."""
|
|
try:
|
|
with open("/var/log/syslog", "r") as f:
|
|
log_lines = f.readlines()[-100:]
|
|
|
|
parsed_logs = []
|
|
for line in log_lines:
|
|
try:
|
|
parsed_logs.append(parser.parse(line).as_dict())
|
|
except Exception:
|
|
# If parsing fails, just append the raw line
|
|
parsed_logs.append({"raw_log": line.strip()})
|
|
|
|
return {"syslog": parsed_logs}
|
|
except FileNotFoundError:
|
|
print("Error: /var/log/syslog not found.")
|
|
return {"syslog": []}
|
|
except Exception as e:
|
|
print(f"Error reading syslog: {e}")
|
|
return {"syslog": []}
|
|
|
|
def get_network_metrics():
|
|
"""Gets network metrics by pinging 8.8.8.8."""
|
|
try:
|
|
ping_output = subprocess.check_output(["ping", "-c", "3", "8.8.8.8"], text=True)
|
|
# Use regex to parse the output
|
|
packets_transmitted_match = re.search(r"(\d+) packets transmitted", ping_output)
|
|
packets_received_match = re.search(r"(\d+) received", ping_output)
|
|
packet_loss_match = re.search(r"(\d+\.?\d*)% packet loss", ping_output)
|
|
rtt_match = re.search(r"rtt min/avg/max/mdev = [\d\.]+/([\d\.]+)/[\d\.]+/([\d\.]+)\s ms", ping_output)
|
|
|
|
if packets_transmitted_match and packets_received_match and packet_loss_match and rtt_match:
|
|
return {
|
|
"packets_transmitted": int(packets_transmitted_match.group(1)),
|
|
"packets_received": int(packets_received_match.group(1)),
|
|
"packet_loss_percent": float(packet_loss_match.group(1)),
|
|
"round_trip_ms_avg": float(rtt_match.group(2)),
|
|
}
|
|
else:
|
|
# Try to parse the summary line for different ping versions
|
|
summary_match = re.search(r"(\d+) packets transmitted, (\d+) received, (\d+\.?\d*)% packet loss", ping_output)
|
|
if summary_match:
|
|
rtt_match = re.search(r"round-trip min/avg/max/stddev = [\d\.]+/([\d\.]+)/[\d\.]+/([\d\.]+)\s ms", ping_output)
|
|
avg_rtt = float(rtt_match.group(1)) if rtt_match else "N/A"
|
|
return {
|
|
"packets_transmitted": int(summary_match.group(1)),
|
|
"packets_received": int(summary_match.group(2)),
|
|
"packet_loss_percent": float(summary_match.group(3)),
|
|
"round_trip_ms_avg": avg_rtt,
|
|
}
|
|
return {"error": "Failed to parse ping output"}
|
|
except (subprocess.CalledProcessError, FileNotFoundError):
|
|
print("Error: 'ping' command not found or failed to execute.")
|
|
return {"error": "ping command failed"}
|
|
|
|
def get_cpu_temperature():
|
|
"""Gets the CPU temperature using the sensors command."""
|
|
try:
|
|
sensors_output = subprocess.check_output(["sensors"], text=True)
|
|
# Use regex to find the CPU temperature
|
|
match = re.search(r"Package id 0:\s+\+([\d\.]+)", sensors_output)
|
|
if match:
|
|
return {"cpu_temperature": float(match.group(1))}
|
|
else:
|
|
return {"cpu_temperature": "N/A"}
|
|
except (subprocess.CalledProcessError, FileNotFoundError):
|
|
print("Error: 'sensors' command not found. Please install lm-sensors.")
|
|
return {"cpu_temperature": "N/A"}
|
|
|
|
def get_gpu_temperature():
|
|
"""Gets the GPU temperature using the sensors command."""
|
|
try:
|
|
sensors_output = subprocess.check_output(["sensors"], text=True)
|
|
# Use regex to find the GPU temperature for amdgpu
|
|
match = re.search(r"edge:\s+\+([\d\.]+)", sensors_output)
|
|
if match:
|
|
return {"gpu_temperature": float(match.group(1))}
|
|
else:
|
|
# if amdgpu not found, try radeon
|
|
match = re.search(r"temp1:\s+\+([\d\.]+)", sensors_output)
|
|
if match:
|
|
return {"gpu_temperature": float(match.group(1))}
|
|
else:
|
|
return {"gpu_temperature": "N/A"}
|
|
except (subprocess.CalledProcessError, FileNotFoundError):
|
|
print("Error: 'sensors' command not found. Please install lm-sensors.")
|
|
return {"gpu_temperature": "N/A"}
|
|
|
|
def get_login_attempts():
|
|
"""Gets system login attempts from /var/log/auth.log."""
|
|
try:
|
|
with open("/var/log/auth.log", "r") as f:
|
|
log_lines = f.readlines()
|
|
|
|
failed_logins = []
|
|
for line in log_lines:
|
|
if "Failed password" in line:
|
|
failed_logins.append(line.strip())
|
|
|
|
return {"failed_login_attempts": failed_logins}
|
|
except FileNotFoundError:
|
|
print("Error: /var/log/auth.log not found.")
|
|
return {"failed_login_attempts": []}
|
|
except Exception as e:
|
|
print(f"Error reading login attempts: {e}")
|
|
return {"failed_logins": []}
|
|
|
|
# --- LLM Interaction Function ---
|
|
|
|
def analyze_data_with_llm(data, baselines):
|
|
"""Analyzes data with the local LLM."""
|
|
prompt = f"""
|
|
**Role:** You are a dedicated and expert system administrator. Your primary role is to identify anomalies and provide concise, actionable reports.
|
|
|
|
**Instruction:** Analyze the following system and network data for any activity that appears out of place or different. Consider unusual values, errors, or unexpected patterns as anomalies. Compare the current data with the historical baseline data to identify significant deviations.
|
|
|
|
**Context:**
|
|
Here is the system data in JSON format for your analysis: {json.dumps(data, indent=2)}
|
|
|
|
**Historical Baseline Data:**
|
|
{json.dumps(baselines, indent=2)}
|
|
|
|
**Output Request:** If you find an anomaly, provide a report as a single, coherent, natural language paragraph. The report must clearly state the anomaly, its potential cause, and its severity (e.g., high, medium, low). If no anomaly is found, respond with "OK".
|
|
|
|
**Reasoning Hint:** Think step by step to come to your conclusion. This is very important.
|
|
"""
|
|
try:
|
|
response = ollama.generate(model="llama3.1:8b", prompt=prompt)
|
|
return response['response'].strip()
|
|
except Exception as e:
|
|
print(f"Error interacting with LLM: {e}")
|
|
return None
|
|
|
|
|
|
# --- Alerting Functions ---
|
|
|
|
def send_discord_alert(message):
|
|
"""Sends an alert to Discord."""
|
|
webhook = DiscordWebhook(url=config.DISCORD_WEBHOOK_URL, content=message)
|
|
try:
|
|
response = webhook.execute()
|
|
if response.status_code == 200:
|
|
print("Discord alert sent successfully.")
|
|
else:
|
|
print(f"Error sending Discord alert: {response.status_code} - {response.content}")
|
|
except Exception as e:
|
|
print(f"Error sending Discord alert: {e}")
|
|
|
|
def send_google_home_alert(message):
|
|
"""Sends an alert to a Google Home speaker via Home Assistant."""
|
|
# Simplify the message for better TTS delivery
|
|
simplified_message = message.split('.')[0] # Take the first sentence
|
|
|
|
url = f"{config.HOME_ASSISTANT_URL}/api/services/tts/speak"
|
|
headers = {
|
|
"Authorization": f"Bearer {config.HOME_ASSISTANT_TOKEN}",
|
|
"Content-Type": "application/json",
|
|
}
|
|
data = {
|
|
"entity_id": "tts.google_en_com",
|
|
"media_player_entity_id": config.GOOGLE_HOME_SPEAKER_ID,
|
|
"message": simplified_message,
|
|
}
|
|
try:
|
|
response = requests.post(url, headers=headers, json=data)
|
|
if response.status_code == 200:
|
|
print("Google Home alert sent successfully.")
|
|
else:
|
|
print(f"Error sending Google Home alert: {response.status_code} - {response.text}")
|
|
except Exception as e:
|
|
print(f"Error sending Google Home alert: {e}")
|
|
|
|
# --- Main Script Logic ---
|
|
|
|
daily_events = []
|
|
|
|
if __name__ == "__main__":
|
|
if config.TEST_MODE:
|
|
print("Running in test mode...")
|
|
system_logs = get_system_logs()
|
|
network_metrics = get_network_metrics()
|
|
cpu_temp = get_cpu_temperature()
|
|
gpu_temp = get_gpu_temperature()
|
|
login_attempts = get_login_attempts()
|
|
|
|
if system_logs and network_metrics:
|
|
combined_data = {
|
|
"timestamp": datetime.now(timezone.utc).isoformat(),
|
|
"system_logs": system_logs,
|
|
"network_metrics": network_metrics,
|
|
"cpu_temperature": cpu_temp,
|
|
"gpu_temperature": gpu_temp,
|
|
"login_attempts": login_attempts
|
|
}
|
|
data_storage.store_data(combined_data)
|
|
|
|
llm_response = analyze_data_with_llm(combined_data, data_storage.calculate_baselines())
|
|
|
|
if llm_response and llm_response != "OK":
|
|
print(f"Anomaly detected: {llm_response}")
|
|
if "high" in llm_response.lower():
|
|
send_discord_alert(llm_response)
|
|
send_google_home_alert(llm_response)
|
|
else:
|
|
print("No anomaly detected.")
|
|
else:
|
|
while True:
|
|
print("Running monitoring cycle...")
|
|
system_logs = get_system_logs()
|
|
network_metrics = get_network_metrics()
|
|
cpu_temp = get_cpu_temperature()
|
|
gpu_temp = get_gpu_temperature()
|
|
login_attempts = get_login_attempts()
|
|
|
|
if system_logs and network_metrics:
|
|
combined_data = {
|
|
"timestamp": datetime.now(timezone.utc).isoformat(),
|
|
"system_logs": system_logs,
|
|
"network_metrics": network_metrics,
|
|
"cpu_temperature": cpu_temp,
|
|
"gpu_temperature": gpu_temp,
|
|
"login_attempts": login_attempts
|
|
}
|
|
|
|
data_storage.store_data(combined_data)
|
|
|
|
llm_response = analyze_data_with_llm(combined_data, data_storage.calculate_baselines())
|
|
|
|
if llm_response and llm_response != "OK":
|
|
daily_events.append(llm_response)
|
|
if "high" in llm_response.lower():
|
|
send_discord_alert(llm_response)
|
|
send_google_home_alert(llm_response)
|
|
|
|
# Daily Recap Logic
|
|
current_time = time.strftime("%H:%M")
|
|
if current_time == config.DAILY_RECAP_TIME and daily_events:
|
|
recap_message = "\n".join(daily_events)
|
|
send_discord_alert(f"**Daily Recap:**\n{recap_message}")
|
|
daily_events = [] # Reset for the next day
|
|
|
|
time.sleep(300) # Run every 5 minutes
|
|
|
|
|