2.1.6

[call518]

LogSentinelAI v2.1.6 — First Official Release

LogSentinelAI is an AI-powered cybersecurity tool that leverages large language models with declarative extraction to analyze security events, anomalies, and errors from various log sources. By declaring a Pydantic model as the desired output schema, the LLM automatically extracts and validates structured data — no regex rules or manual parsers required.

This is the first official GitHub Release, covering the full development history from initial commit through v2.1.6.

---

Supported Log Types

• Apache/HTTPD access logs
• Apache/HTTPD server error logs
• Linux system logs (/var/log/messages, /var/log/syslog)
• General-purpose log files (configurable schema)

---

LLM Provider Support

The following LLM backends are supported and configurable via environment variables:

• Ollama — local inference
• OpenAI — cloud API
• vLLM — self-hosted OpenAI-compatible endpoint
• Google Gemini — via OpenAI-compatible API
• Anthropic Claude — added in v2.1.x

All providers share a unified configuration interface through .env files.

---

Key Features

Declarative Log Extraction

Define a Pydantic model describing the fields you want to extract. The LLM analyzes log chunks and returns JSON conforming to that schema. No parsing logic required.

Elasticsearch / Kibana Integration

Analyzed results are shipped directly to Elasticsearch with structured metadata fields (@llm_provider, @llm_model, @processing_mode, @log_path, @chunk_analysis_start_utc, etc.). A pre-built Kibana dashboard template is included for immediate visualization.

Telegram Alerting

Critical and high-severity events can trigger real-time Telegram alerts. Alert threshold is configurable via TELEGRAM_ALERT_LEVEL.

Batch and Real-time Processing Modes

• Batch mode: processes existing log files in configurable chunk sizes with streaming I/O to limit memory usage to under 10 MB regardless of file size.
• Real-time mode: monitors live log files with configurable pending timeout (REALTIME_CHUNK_PENDING_TIMEOUT).

Wildcard Log Path Support

--log-path accepts glob patterns (e.g., /var/log/httpd/access_log.*), enabling bulk processing of rotated log files in a single invocation.

GeoIP Enrichment

Source IP addresses are enriched with geolocation data (country, city, ASN) using MaxMind GeoIP2 databases. Utilities for downloading and querying GeoIP databases are included (logsentinelai-geoip-download, logsentinelai-geoip-lookup).

Token Management

Per-chunk token counting for prompts and LLM responses is available. LLM_MAX_TOKENS is configurable, and a LLM_NO_THINK option suppresses chain-of-thought output on supported models to reduce token usage.

Structured Application Logging

Internal application logging is written to a configurable file (LOG_FILE, default /var/log/logsentinelai.log) with configurable level (LOG_LEVEL).

---

CLI Entry Points

Command	Description
logsentinelai	Main CLI dispatcher
logsentinelai-httpd-access	Analyze Apache access logs
logsentinelai-httpd-server	Analyze Apache error logs
logsentinelai-linux-system	Analyze Linux system logs
logsentinelai-general-log	Analyze generic logs with custom schema
logsentinelai-geoip-download	Download MaxMind GeoIP databases
logsentinelai-geoip-lookup	Query GeoIP for a given IP address

---

Configuration

Configuration is managed entirely through .env files. A .env.template is included in the package as a reference. Secrets are never committed — .env is excluded from version control.

A Gitleaks pre-commit hook is configured to prevent accidental secret exposure in commits.

---

Requirements

• Python 3.11 or 3.12 (Python 3.13+ is not supported due to dependency constraints)
• An accessible LLM endpoint (Ollama, OpenAI, vLLM, Gemini, or Anthropic)
• Optional: Elasticsearch 9.x for result storage and Kibana for visualization

---

Installation

pip install logsentinelai

Or with uv:

uv add logsentinelai

Full installation and usage instructions are available in INSTALL-and-USAGE.md.

---

Version History Summary

Series	Notable Changes
v0.1.x	Initial release; httpd access log analysis; Ollama and OpenAI support; ELK integration; Linux system log analyzer
v0.2.x – v0.4.x	vLLM client mode; Gemini LLM support; GeoIP enrichment; Rich JSON output; LLM API host configuration
v0.5.x – v0.8.x	Removed TCPDump analyzer; LLM_NO_THINK option; auto-sampling; enhanced logging across all modules
v1.0.x	English documentation set as default; --config option for custom config path; token counting utilities; Kibana dashboard enhancements (token size charts, elapsed time)
v1.1.x	Telegram alert integration; TELEGRAM_ALERT_LEVEL configuration; related logs display in alerts; utility module refactor
v2.0.x	Wildcard --log-path support; batch mode OOM fix (streaming I/O, max ~10 MB memory); Python version constraint enforced (>=3.11,<3.13); PyPI package badges
v2.1.x	Anthropic Claude LLM provider; .env-based configuration replacing config.template; Gitleaks pre-commit security hook; PyPI publish workflow improvements; pre-commit added as dependency

---

Links

• Installation and Usage Guide
• Architecture Documentation (DeepWiki)
• PyPI Package
• Issue Tracker

---

This discussion was created from the release 2.1.6.