Automating Daily Server Log Summaries with Python and Local LLMs

The Problem: Log Fatigue in Server Administration

Reviewing thousands of lines of server logs daily is tedious. Most entries are normal operational noise, but genuine warnings (such as SSH brute force attempts or out-of-memory events) can easily be overlooked. By pairing a simple Python script with a local LLM, you can automate daily analysis safely.

Step 1: Extracting Recent System Errors

We use journalctl to capture log entries with priority level 4 (Warning) through 0 (Emergency) from the last 24 hours:

journalctl --since "24 hours ago" -p 4 -u nginx -u ssh --no-pager > /tmp/recent_errors.log

Step 2: The Python Analysis Script

Create a script named summarize_logs.py that reads the filtered log file and submits a structured request to your local Ollama HTTP endpoint:

import json
import subprocess
import requests

def get_system_errors():
    cmd = ["journalctl", "--since", "24 hours ago", "-p", "4", "--no-pager", "-n", "150"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout.strip()

def summarize_with_local_llm(log_text):
    if not log_text:
        return "No errors or warnings recorded in the last 24 hours."

    prompt = f"""You are a Linux systems engineer. Summarize these server logs:
- Highlight critical security issues (e.g. SSH auth failures)
- Note recurring service errors
- List recommended fixes in 3 concise bullet points

Logs:
{log_text}
"""
    response = requests.post(
        "http://127.0.0.1:11434/api/generate",
        json={
            "model": "llama3.2:3b",
            "prompt": prompt,
            "stream": False
        },
        timeout=60
    )
    return response.json().get("response", "Error generating summary.")

if __name__ == "__main__":
    logs = get_system_errors()
    summary = summarize_with_local_llm(logs)
    print("=== DAILY SERVER LOG SUMMARY ===")
    print(summary)

Step 3: Testing the Script

Execute the script directly from your terminal:

python3 summarize_logs.py

The local model analyzes the journal output in seconds and returns a clean, structured security digest without uploading server telemetry to external servers.