Daily AI Log Summary

A lightweight, automated tool that analyzes system logs—specifically optimized for Postfix and Dovecot mail servers—extracts key security and operational facts, and generates a concise daily summary using a local AI model (Ollama).

Features

• Structured Log Analysis: Deterministically extracts facts from journalctl logs (Postfix/postscreen rejections, Dovecot logins, relay abuse, SPF/DKIM anomalies, etc.).
• AI Summarization: Uses Ollama (e.g., llama3.2:1b) to synthesize raw facts into a readable daily report.
• Repeat Offender Tracking: Persistently tracks suspicious IPs across multiple days to identify long-term probing.
• Automated Emailing: Sends the summary and raw facts via SMTP.
• Dockerized: Easy deployment with a minimal footprint.
• Systemd Integration: Includes an example unit for robust "always-on" operation.

How It Works

1. Fetch: Retrieves yesterday's logs for a specific systemd unit using journalctl.
2. Analyze: Python regex-based extraction identifies successful logins, authentication failures, blocked relay attempts, and more.
3. Track: Suspicious IPs are stored in a persistent state file. If an IP appears on multiple days, it's flagged as a "repeat offender."
4. Summarize: Raw facts are fed to a local Ollama instance with a specific system prompt to generate a concise narrative.
5. Report: An email is sent to the administrator with the AI summary and the full list of extracted facts.

Prerequisites

• Docker: For running the analyzer.
• Ollama: A running Ollama instance (locally or accessible via network).
• Systemd Journals: The host must use systemd journals (the container mounts these as read-only).

Ollama Setup

This tool requires an Ollama server to handle the AI summarization.

1. Install Ollama

If you don't have Ollama installed, you can install it on Linux with:

curl -fsSL https://ollama.com/install.sh | sh

Alternatively, you can run Ollama as a Docker container:

docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama

2. Select and Pull a Model

The script defaults to llama3.2:1b, which is lightweight and fast for this task. You must pull the model before the script can use it:

ollama pull llama3.2:1b

You can choose other models (like llama3, mistral, gemma) by pulling them and updating the OLLAMA_MODEL variable in your .env file.

3. Run the Server

If installed natively, Ollama usually starts automatically as a systemd service. You can check its status:

systemctl status ollama

If you need to run it manually:

ollama serve

Setup

1. Clone the repository:

   git clone https://github.com/youruser/daily-ai-summary.git
   cd daily-ai-summary
   

2. Configure Environment: Copy .env.example to .env (or whatever path you'll use in your systemd unit) and fill in your details:

   cp .env.example .env
   nano .env
   

   Key variables to set: REPORT_TO_EMAIL, REPORT_FROM_EMAIL, SMTP_SERVER, OLLAMA_API_URL.

3. Build the Docker Image:

   docker build -t daily-ai-summary .
   

Running

Manual Test Run

You can run the container manually to verify your configuration:

docker run --rm \
    --network=host \
    --env-file=.env \
    -v /var/log/journal:/var/log/journal:ro \
    -v /run/log/journal:/run/log/journal:ro \
    -v /etc/machine-id:/etc/machine-id:ro \
    -v $(pwd)/data:/data \
    daily-ai-summary

Note: Ensure RUN_NOW=true is set in your .env for an immediate run.

Production Deployment (Systemd)

1. Adjust systemd-daily-ai-summary.service.example with your actual paths (e.g., where your .env and data folder live).
2. Copy the service file:

   sudo cp systemd-daily-ai-summary.service.example /etc/systemd/system/daily-ai-summary.service
   

3. Enable and start:

   sudo systemctl daemon-reload
   sudo systemctl enable daily-ai-summary
   sudo systemctl start daily-ai-summary
   

Configuration

Variable	Default	Description
OLLAMA_API_URL	http://localhost:11434/api/generate	URL to your Ollama API.
OLLAMA_MODEL	llama3.2:1b	The model to use for summarization.
REPORT_TO_EMAIL	-	Recipient of the daily report.
JOURNAL_UNIT	mailserver	The systemd unit name to analyze.
TRUSTED_LOGIN_NETWORKS	10.0.0.0/24	CIDR ranges that won't be flagged as "untrusted" logins.
REPORT_TIME	08:00	When to run the daily report (24h format).
RUN_NOW	false	If true, runs the analysis immediately on startup.
DEBUG	false	Enable verbose logging.

Troubleshooting

• Journal Access: Ensure the user running Docker has permissions to read /var/log/journal. On many systems, this means being in the systemd-journal group.
• Ollama Connectivity: If Ollama is running on the host, the container needs --network=host to reach localhost:11434.
• State Persistence: If "repeat offenders" aren't being tracked across restarts, verify the /data mount is writable and correctly mapped in the systemd unit.
• No Logs Found: Check that JOURNAL_UNIT matches the exact name of the systemd service you want to monitor (e.g., postfix.service or dovecot.service).

License

MIT