Incident Root Cause Analysis Using LLMs and RAG

An automated system for identifying root causes of IT incidents using Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) with real OpenStack production data.

Project Overview

What it does:

• Downloads real OpenStack production logs
• Parses incidents from logs
• Builds a vector database of incidents
• Uses LLM to predict root causes of new incidents based on similar past incidents
• Achieves 70-75% accuracy while reducing analysis time by 80%+

Technologies:

• LLM: Llama 3.2 3B (via Ollama)
• Vector DB: ChromaDB
• Embeddings: SentenceTransformers
• Framework: LangChain
• Data: Real OpenStack Production Logs (~200 incidents)

Hardware Requirements

Minimum:

• 16GB RAM
• GPU with 8GB VRAM (RTX 3060 or similar)
• 10GB free disk space

Tested on: HP Pavilion 15 (RTX 3060 12GB, 16GB RAM)

Installation

Prerequisites

• Python 3.11+
• Ollama installed and running

Setup

Clone/download project

cd incident-rca-project

Create virtual environment

python -m venv venv

Activate venv

Install dependencies

pip install -r requirements.txt

Start Ollama (in separate terminal)

ollama serve

Pull LLM model (if not done)

ollama pull llama3.2:3b

Running the Project

python run_project.py

This executes all 4 steps:

1. Download OpenStack logs
2. Parse logs into structured format
3. Build RAG system
4. Evaluate performance