Come analizzare log Nginx con un LLM locale? | Antonio Pedoto
Scopri come analizzare i log Nginx con un LLM locale usando Ollama e Python. Script pratico e prompt ottimizzati per Llama 3.
Why use a local LLM for analyzing Nginx logs?
Have you ever stared at thousands of Nginx log lines without knowing what to look for? I have. I solved it using a local LLM. The model understands the Nginx format. It spots anomalies. It keeps data on my server. Response time is nearly instant.
Benefits versus cloud services
Security. No data leaves your server. Cost. No API fees. Speed. Latency drops to milliseconds. Control. You choose when to update.
Security and privacy requirements
Keep logs on premises. Anonymize sensitive fields. Store results locally. Audit the code yourself.
Prepare the environment: install Ollama and Llama 3
I installed Ollama on Ubuntu. Here are the quick steps.
Install Ollama
Check the installation:
If you see the version, you're good.
Download the Llama 3 model
Download takes a few minutes. Start the service:
Check port 11434. If it doesn't respond, restart Ollama.
Extract and anonymize Nginx logs
Nginx logs are text lines. Here's an example:
Typical Nginx log structure
Fields: IP, identity, user, timestamp, request, status, size, referrer, agent.
Anonymization script
Run this before parsing.
Write the Python script for parsing and LLM calls
Parse key fields
Format prompt for Llama 3
Interpret results and optimize the prompt
Analyze model responses
Read the output. Compare with expectations. If vague, reword the prompt.
Iterate for better precision
Add context. Example: "Focus on 4xx and 5xx errors." Lower temperature for deterministic output. Test with different log samples.
In summary Install Ollama, pull Llama 3, start the service. Anonymize logs with a Python script. Parse key fields, build clear prompts. Send to the model, interpret responses. Iterate prompts for better accuracy.
FAQ
How can I guarantee logs are anonymized before sending to the LLM? Use a Python script that replaces IPs, user-agents, and paths with placeholders before sending.
What is the maximum prompt size for Llama 3? The context window is 8,000 tokens. Split longer logs into smaller chunks.
Can I use a different model with Ollama? Yes. Ollama supports Mistral, Phi, Gemma, and others. Pull with ollama pull .
Common error
Ollama not responding: Check port 11434 is free. Verify the model is running. Restart Ollama if needed. Check logs with journalctl -u ollama.