Let the dashboard LLM note read a bounded excerpt of real log content
The Ollama dashboard assessment was built entirely from pre-computed statistical scores/reasons/counts — a deliberately tested compaction step stripped all raw message content before it reached the model, presumably to keep the prompt small for a local, GPU-constrained instance. That raw content (sample_events/timeline, already truncated to short messages) already flows through the pipeline; it was just filtered out at the last step. Now the top-scoring field deviations and incidents each carry a small, bounded number of real message excerpts, and the prompt explicitly asks the model to flag suspicious content (injection attempts, unusual command lines) that pure statistical scoring can't see — purely a qualitative addition to the narrative note, never feeding back into scoring or suppression. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
13
README.md
13
README.md
@@ -554,6 +554,19 @@ The monitor refreshes deterministic detections every `FGAI_MONITOR_INTERVAL` sec
|
||||
The dashboard also exposes `Ollama assessment timeout seconds`; raise this when
|
||||
Ollama is running but large multi-stream summaries still time out.
|
||||
|
||||
The assessment is mostly built from pre-computed statistical scores and reasons
|
||||
(deviation scores, burst z-scores, relationship names), not raw log content —
|
||||
deliberately compacted this way to keep the prompt small for a local, often
|
||||
GPU-constrained model even when the underlying deployment has hundreds of
|
||||
streams or millions of daily events. On top of that, the top-scoring field
|
||||
deviations and incidents each carry a small, bounded number of real message
|
||||
excerpts (already truncated short), so the note can call out content a
|
||||
statistical score alone can't surface, such as a suspicious value in a URL or
|
||||
command-line field. This is intentionally a qualitative addition layered on
|
||||
top of the statistical findings, not a replacement for them, and it never
|
||||
feeds back into scoring or suppression — it only changes the wording of the
|
||||
narrative note.
|
||||
|
||||
The script activates `.venv` inside the script process. If you also want your current shell prompt to show the venv, run:
|
||||
|
||||
```bash
|
||||
|
||||
Reference in New Issue
Block a user