AI-Assisted Web Server Log Interpretation Using LLaMA Model

Abstract

Modern web infrastructures generate large volumes of access logs that contain valuable information related to system activity, user behaviour, performance monitoring, and cybersecurity threats. Manual analysis of these logs is time-consuming, error-prone, and inefficient for detecting suspicious activities in real time. This project presents the design and implementation of a Local AI System for Log Interpretation using LLaMA models, capable of performing automated log analysis, anomaly detection, AI-assisted summarization, and conversational log investigation within a privacy-preserving local execution environment. The system integrates Django-based operational management, Linux scheduling utilities (Cron and At), quantized GGUF(GPT-Generated Unified Format) LLaMA models, and Retrieval-Augmented Generation (RAG) techniques to support both scheduled analysis workflows and interactive “Chat with AI” operations. The log files uploaded/access from read-only specified location are passed to the AI inference engine, where log parsing, OWASP-based threat detection, contextual analysis, and structured JSON response generation are performed using locally deployed LLaMA models. Through CPU-compatible inference utilising llama-cpp-python, the project maintains lightweight deployment while enabling instantaneous, recurring, and scheduled analysis execution. GPU-accelerated environments such as Google Colab and Kaggle were additionally utilized for large-scale inference evaluation and high-volume log processing experiments. The conversational RAG workflow enables users to interact directly with uploaded logs using natural language queries and receive AI-generated cybersecurity insights, suspicious activity explanations, and remediation recommendations. Experimental evaluation demonstrates reliable task execution, efficient response generation, structured report handling, and effective contextual reasoning capabilities for both scheduled analysis and conversational AI-assisted workflows. The proposed system provides a modular, privacy-preserving, and locally deployable solution for intelligent cybersecurity log analysis and operational threat interpretation.

Introduction

The text describes a Local AI System for Log Interpretation, designed to automate cybersecurity log analysis using Large Language Models (LLMs), particularly LLaMA, and Retrieval-Augmented Generation (RAG).

Modern web applications and enterprise systems generate large volumes of server logs containing authentication attempts, HTTP requests, system errors, and suspicious activities. Traditional log analysis relies on manual inspection and predefined rules, which can be time-consuming and may lack contextual understanding. Cloud-based AI solutions also raise concerns about data privacy, security, and operational costs.

The proposed system addresses these challenges by integrating automated log preprocessing, OWASP-based threat detection, local AI analysis, semantic retrieval, and conversational investigation. It identifies potential threats such as SQL injection, command injection, cross-site scripting (XSS), directory traversal, server-side request forgery (SSRF), and authentication failures.

The system follows two main workflows:

1. Automated log analysis: Uploaded or locally accessible server logs are parsed using regular expressions to extract relevant information, identify suspicious patterns, and classify potential threats. A locally hosted LLaMA model then generates security summaries, risk assessments, and mitigation recommendations.

2. Conversational log investigation: Using RAG and a Chroma vector database, the system retrieves relevant log entries and allows users to investigate incidents by asking questions in natural language. LLaMA generates contextual responses based on the retrieved evidence.

The methodology includes log collection, preprocessing, threat classification, AI-assisted interpretation, semantic retrieval, and report generation. The system produces structured JSON reports containing log statistics, detected threats, supporting evidence, summaries, and recommended security measures. It also supports immediate execution, recurring scheduling through cron, and one-time scheduling through at.

The system architecture uses Python, Django, MySQL, ChromaDB, and locally hosted quantized LLaMA models through llama-cpp-python. Django manages authentication, analysis jobs, scheduling, and reports, while an independent Python analysis engine performs log processing and threat detection. Local execution reduces dependence on external AI services and helps protect sensitive security information.

The literature review discusses existing technologies such as DeepLog for anomaly detection, Drain for log parsing, LogBERT for semantic analysis, ChatLog for conversational investigation, and RAG for context-aware question answering. The proposed system combines these approaches into a unified platform.

Conclusion

The proposed Local AI System for Log Interpretation using LLaMA Models demonstrates the integration of automated cybersecurity analysis, AI-assisted threat interpretation, and conversational investigation within a unified local execution environment. The system combines preprocessing pipelines, OWASP-based threat detection, quantized LLaMA inference, Retrieval-Augmented Generation (RAG), and semantic retrieval techniques to improve operational visibility and intelligent log analysis capabilities. By supporting both scheduled automated workflows and interactive conversational investigation, the framework provides flexibility for continuous monitoring as well as contextual cybersecurity analysis. The use of locally deployable AI models, Chroma vector databases, and subprocess-based execution additionally improves privacy preservation, deployment control, and operational scalability without requiring dependency on external AI services. The project further demonstrates the practical integration of modern Large Language Models and retrieval-based architectures within cybersecurity environments while maintaining lightweight deployment characteristics through quantized inference and optimized processing workflows. Overall, the system provides a modular and extensible foundation for AI-assisted log interpretation, automated threat analysis, and conversational cybersecurity investigation within locally controlled infrastructures.

References

[1] M. Du, F. Li, G. Zheng, and V. Srikumar, “DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning,” Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2017. [2] P. He, J. Zhu, Z. Zheng, and M. R. Lyu, “Drain: An Online Log Parsing Approach with Fixed Depth Tree,” IEEE International Conference on Web Services (ICWS), 2017. [3] H. Zhang, X. Huang, and J. Wang, “LogBERT: Log Anomaly Detection via BERT,” arXiv preprint arXiv:2103.04475, 2021. [4] Y. Liu, S. Wang, and X. Li, “ChatLog: Conversational Log Analysis using Large Language Models,” arXiv preprint, 2023. [5] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W. Yih, T. Rocktäschel, S. Riedel, and D. Kiela, “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” Advances in Neural Information Processing Systems (NeurIPS), vol. 33, pp. 9459–9474, 2020. [6] H. Touvron, L. Martin, K. Stone, et al., “LLaMA 2: Open Foundation and Fine-Tuned Chat Models,” arXiv preprint arXiv:2307.09288, 2023. [7] AI@Meta, “The Llama 3 Herd of Models,” arXiv preprint arXiv:2407.21783, 2024. [8] J. Devlin, M. W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding,” Proceedings of NAACL-HLT, pp. 4171–4186, 2019. [9] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, ?. Kaiser, and I. Polosukhin, “Attention Is All You Need,” Advances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017. [10] OWASP Foundation, “OWASP Top 10: The Ten Most Critical Web Application Security Risks,” OWASP Foundation, 2021. [11] Python Software Foundation, “Python Documentation,” Available: https://docs.python.org/ [12] Django Software Foundation, “Django Documentation,” Available: https://docs.djangoproject.com/ [13] ChromaDB Developers, “Chroma Documentation,” Available: https://docs.trychroma.com/ [14] A. Betlen and Contributors, “llama-cpp-python Documentation,” Available: https://github.com/abetlen/llama-cpp-python [15] Linux Foundation, “Cron and At Command Documentation,” Linux Manual Pages Documentation, Available: https://man7.org/linux/man-pages/

Copyright

Copyright © 2026 Mrs. Chinchu Mohanan K, V. Reddy Ganesh. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.