Let the dashboard LLM note read a bounded excerpt of real log content

The Ollama dashboard assessment was built entirely from pre-computed
statistical scores/reasons/counts — a deliberately tested compaction step
stripped all raw message content before it reached the model, presumably to
keep the prompt small for a local, GPU-constrained instance. That raw
content (sample_events/timeline, already truncated to short messages)
already flows through the pipeline; it was just filtered out at the last
step. Now the top-scoring field deviations and incidents each carry a
small, bounded number of real message excerpts, and the prompt explicitly
asks the model to flag suspicious content (injection attempts, unusual
command lines) that pure statistical scoring can't see — purely a
qualitative addition to the narrative note, never feeding back into scoring
or suppression.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
larssand
2026-09-24 07:04:58 +02:00
parent caa37de98e
commit b0cc9dbdfe
4 changed files with 54 additions and 1 deletions

View File

@@ -554,6 +554,19 @@ The monitor refreshes deterministic detections every `FGAI_MONITOR_INTERVAL` sec
The dashboard also exposes `Ollama assessment timeout seconds`; raise this when
Ollama is running but large multi-stream summaries still time out.
The assessment is mostly built from pre-computed statistical scores and reasons
(deviation scores, burst z-scores, relationship names), not raw log content —
deliberately compacted this way to keep the prompt small for a local, often
GPU-constrained model even when the underlying deployment has hundreds of
streams or millions of daily events. On top of that, the top-scoring field
deviations and incidents each carry a small, bounded number of real message
excerpts (already truncated short), so the note can call out content a
statistical score alone can't surface, such as a suspicious value in a URL or
command-line field. This is intentionally a qualitative addition layered on
top of the statistical findings, not a replacement for them, and it never
feeds back into scoring or suppression — it only changes the wording of the
narrative note.
The script activates `.venv` inside the script process. If you also want your current shell prompt to show the venv, run:
```bash