🛠️ AI DevOps Incident Assistant — AI-Powered Log Troubleshooting Tool

A full-stack AI DevOps troubleshooting assistant that analyzes Docker, Nginx, Linux, CI/CD, database, and deployment logs to generate incident summaries, likely root causes, safe debugging commands, resolution checklists, and prevention recommendations.

🚀 Quick Start · 🧠 Architecture · 🌐 Frontend · 🔌 API · 📸 Screenshots

📌 Overview

AI DevOps Incident Assistant is a full-stack AI application built to help junior DevOps engineers and support teams analyze infrastructure and deployment incidents faster.

The application allows users to paste logs or incident notes, select an incident category, and receive a structured troubleshooting report. The backend combines rule-based log pattern detection with Gemini-powered analysis to identify likely causes, supporting evidence, safe debugging commands, resolution steps, and prevention recommendations.

The project focuses on real-world DevOps troubleshooting scenarios such as:

Nginx reverse proxy failures
Docker container crashes
Backend upstream connection errors
CI/CD deployment issues
Linux service failures
Database connection problems
Suspicious bot/scanner activity

Key Idea: The assistant should guide investigation safely by suggesting read-only diagnostic commands first, rather than jumping directly to risky restart/delete actions.

🎯 Why I Built This

I built this project to connect my DevOps internship experience with practical AI application development.

During DevOps work, many incidents begin with raw logs such as 502 Bad Gateway, 504 Gateway Timeout, connection refused, container restart loops, Nginx upstream failures, or database connection errors. Reading these logs manually requires experience, context, and systematic debugging.

This project explores how AI can assist with:

Log interpretation
Incident classification
Root cause analysis
Safe debugging workflows
Resolution checklists
Preventive DevOps recommendations

The goal was not to replace DevOps engineers, but to build an AI assistant that helps engineers reason through incidents faster and more safely.

✨ Features

🧾 Paste Docker, Nginx, Linux, CI/CD, database, or deployment logs
🗂️ Select incident category: Nginx, Docker, CI/CD, Linux, Database, Security, or Unknown
🔍 Rule-based detection for known log patterns
🤖 Gemini-powered structured incident analysis
🚨 Severity classification: Low, Medium, High, or Critical
🧠 Likely root cause explanation
📌 Evidence extraction from logs
🛡️ Safe debugging commands-first approach
✅ Step-by-step resolution checklist
📈 Prevention recommendations for monitoring and configuration
🌐 React frontend for log input and analysis display
🔗 CORS-enabled FastAPI backend integration

🧠 System Architecture

Incident Logs / Notes
   │
   ▼
React Frontend Input
   │
   ▼
FastAPI /analyze Endpoint
   │
   ├──► Rule-Based Pattern Checker
   │       ├── 502 / 504 detection
   │       ├── Connection refused detection
   │       ├── Nginx resolver issue detection
   │       ├── Docker restart/crash detection
   │       ├── MongoDB connection issue detection
   │       └── Suspicious scanner path detection
   │
   ▼
Gemini Prompt with Guardrails
   │
   ▼
Structured Incident Analysis
   │
   ▼
Frontend Result Display

Core Analysis Flow

Stage	Component	Purpose
Log Input	React	Accept logs or incident notes from user
Category Selection	React dropdown	Provide incident context such as Nginx, Docker, CI/CD, or Database
API Layer	FastAPI	Receive logs and return structured analysis
Rule-Based Checks	Custom Python logic	Detect common known patterns before AI analysis
AI Analysis	Gemini API	Generate root cause, commands, checklist, and prevention steps
Output Display	React	Show rule-based findings and AI incident report

🧩 Rule-Based Pattern Detection

The backend includes a lightweight rule checker before calling Gemini. This helps detect high-confidence operational patterns.

Pattern	Possible Meaning
`502` / `Bad Gateway`	Upstream container failure, wrong backend host, or port mismatch
`504` / `Gateway Timeout`	Slow backend response, timeout issue, or blocked upstream service
`connection refused`	Backend service down, wrong port, or unreachable container
`no resolver defined`	Nginx Docker DNS resolver issue
`404` / `not found`	Route mismatch, domain mapping issue, or wrong proxy target
`port is already allocated`	Port conflict with another process/container
`restart`, `exited`, `crash`	Container crash or application startup failure
`permission denied`	File permission, volume mount, or privilege issue
`mongo` + `connection failed`	MongoDB URI, auth, Docker network, or DB availability issue
`.env`, `.git`, `wp-login`, `xmlrpc`	Possible bot/scanner activity

🌐 Web Application

The React frontend provides a clean interface for testing incident analysis workflows.

Frontend Capabilities

Select incident type
Paste logs or incident notes
Load a sample Nginx 502 incident
Submit logs for AI analysis
View rule-based findings
View AI incident summary and severity
View root cause and evidence
View safe debugging commands
View step-by-step resolution checklist
View prevention recommendations
Clear input and test another incident

🔌 API Endpoints

Method	Endpoint	Purpose
GET	`/health`	Check backend health
POST	`/analyze`	Analyze DevOps logs and return rule-based + AI findings

Example Request

{
  "incident_type": "Nginx",
  "logs": "connect() failed (111: Connection refused) while connecting to upstream, upstream: \"http://172.18.0.5:3000/\", host: \"example.com\", request: \"GET / HTTP/1.1\", status: 502"
}

Example Rule-Based Findings

[
  "Detected 502/Bad Gateway pattern: possible upstream container failure, wrong upstream host, or backend port mismatch.",
  "Detected connection refused pattern: backend service may be down, not listening on the expected port, or unreachable from Nginx."
]

🛠️ Tech Stack

Layer	Technology
Backend	FastAPI, Uvicorn
Frontend	React, Vite
AI Model	Gemini API
Rule Engine	Custom Python pattern checker
Environment Management	python-dotenv
Data Format	JSON API
Language	Python, JavaScript

📁 Project Structure

AI-DevOps-Incident-Assistant/
│
├── backend/
│   ├── app/
│   │   ├── main.py                 # FastAPI routes, CORS, API setup
│   │   ├── config.py               # Environment and Gemini config
│   │   ├── schemas.py              # Pydantic request/response schemas
│   │   ├── rule_checker.py         # Rule-based log pattern detection
│   │   └── incident_analyzer.py    # Gemini prompt and incident analysis logic
│   │
│   ├── samples/                    # Optional sample incident logs
│   ├── requirements.txt
│   ├── .env.example
│   └── .gitignore
│
├── frontend/
│   ├── src/
│   │   ├── App.jsx                 # React incident analyzer UI
│   │   ├── App.css                 # Main styling
│   │   ├── index.css
│   │   └── main.jsx
│   │
│   ├── package.json
│   └── vite.config.js
│
├── screenshots/
│   ├── backend-health-check.png
│   ├── backend-analyze-nginx-502.png
│   ├── frontend-input-sample.png
│   ├── frontend-rule-findings.png
│   ├── frontend-ai-analysis-root-cause.png
│   └── frontend-ai-analysis-commands.png
│
├── README.md
└── .gitignore

🚀 Quick Start

Prerequisites

Python 3.10+
Node.js and npm
Gemini API key
Git

1. Clone the Repository

git clone https://github.com/aadi090204/AI-DevOps-Incident-Assistant.git
cd AI-DevOps-Incident-Assistant

2. Backend Setup

Go to the backend folder:

cd backend

Create and activate a virtual environment:

python -m venv venv
venv\Scripts\activate

Install backend dependencies:

pip install -r requirements.txt

Create a .env file inside the backend folder:

GEMINI_API_KEY=your_gemini_api_key_here

Start the FastAPI backend:

uvicorn app.main:app --reload

Open the backend API docs:

http://127.0.0.1:8000/docs

3. Frontend Setup

Open a new terminal and go to the frontend folder:

cd AI-DevOps-Incident-Assistant/frontend

Install frontend dependencies:

npm install

Start the React development server:

npm run dev

Open the frontend:

http://localhost:5173

🧪 Sample Incident Logs

Nginx 502 Upstream Failure

connect() failed (111: Connection refused) while connecting to upstream, upstream: "http://172.18.0.5:3000/", host: "example.com", request: "GET / HTTP/1.1", status: 502

Docker Container Restart / Missing Environment Variable

container exited with code 1 and keeps restarting. Error: missing required environment variable MONGO_URI. Application failed to start.

Nginx Docker Resolver Issue

2026/06/19 10:22:41 [error] 29#29: *45 no resolver defined to resolve app-backend while sending to client, client: 10.0.0.2, server: example.com, request: GET /, upstream: http://app-backend:3000/

Suspicious Scanner Activity

GET /.env 404
GET /.git/config 404
GET /wp-login.php 404
GET /xmlrpc.php 404
Multiple requests from same IP within 2 minutes

📸 Screenshots

Backend Health Check

Backend Nginx 502 Analysis

Frontend Sample Incident Input

Rule-Based Findings

AI Root Cause Analysis

AI Debugging Commands and Resolution Checklist

⚠️ What Went Wrong

While building the project, I had to handle a few practical issues:

Raw logs can be incomplete, so the AI needs to explain what additional information is required.
AI-generated troubleshooting can become risky if it suggests destructive commands too early.
Long incident analysis output cannot always fit in one screenshot.
Some issues can be detected quickly with simple rules before involving the LLM.
Frontend and backend integration required CORS configuration for local development.

✅ How I Fixed It

Added rule-based checks for common DevOps patterns before Gemini analysis.
Added strict prompt guardrails to prefer safe read-only debugging commands first.
Instructed the model not to suggest destructive actions such as volume deletion, database dropping, or Docker pruning unless clearly marked as risky.
Split screenshots into input, rule findings, root cause analysis, and command/checklist sections.
Added CORS middleware in FastAPI for React integration.
Structured the output into consistent sections for easier incident review.

📚 What I Learned

DevOps incidents become easier to debug when logs are converted into structured reasoning.
Rule-based detection and LLM analysis can complement each other.
AI troubleshooting tools need safety constraints to avoid harmful operational advice.
Nginx and Docker errors often require checking both application state and network configuration.
Frontend design matters when AI output is long and operationally detailed.
Incident response tools should provide evidence, not just conclusions.

🗺️ Future Work

Add incident history storage using SQLite or PostgreSQL
Add downloadable incident report generation
Add support for uploading .log and .txt files
Add Dockerfile and Docker Compose after local Docker testing
Add deployment support with environment-based API URLs
Add Prometheus metrics for request count, latency, and error rate
Add predefined incident templates for Nginx, Docker, MongoDB, GitHub Actions, and Linux systemd
Add severity-based triage dashboard
Add multi-model fallback support

🔐 Security Notes

The .env file is ignored by Git and should never be committed.
This tool should not be used with sensitive production logs unless secrets, tokens, passwords, and private IPs are redacted.
AI-generated debugging suggestions should be reviewed before execution.
Destructive commands should never be run without approval and backup verification.

📄 Disclaimer

This project is for educational and portfolio purposes only. It is an AI-assisted troubleshooting tool and should not be treated as a replacement for professional DevOps incident response. Always review commands before running them in production environments.

👤 Author

Adithya Anil AI Engineer / DevOps Engineer GitHub: aadi090204

Built as a full-stack AI + DevOps project exploring log analysis, incident response, root cause analysis, and safe operational troubleshooting.

Name		Name	Last commit message	Last commit date
Latest commit History 2 Commits
backend		backend
frontend		frontend
screenshots		screenshots
.gitignore		.gitignore
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation