Technical Documentation: AI Log Analysis System (AWS/Docker)

1. Introduction and Project Goal

This project presents a fully functional cloud ecosystem for automatic system log analysis using local language models (LLMs). The system integrates advanced networking mechanisms (VPC), containerization (Docker), and artificial intelligence (Ollama/Gemma3).

2. Infrastructure Architecture (Cloud & Network)

The infrastructure is deployed on AWS (Amazon Web Services), ensuring enterprise-level scalability and security.

2.1. Compute Instance Characteristics

Parameter	Specification
Instance type	m7i-flex.large (2 vCPU, 8 GB RAM)
Operating system	Ubuntu 24.04 LTS
Storage (EBS)	30 GB SSD

Fig. 1. Configuration of the m7i-flex.large compute instance in the eu-north-1 region. This instance family was selected based on Gemma 3 1b memory requirements (8 GB RAM) and CPU performance for inference operations.

2.2. Network Addressing CIDR 10.0.1.0/24

A /24 subnet mask was applied, enabling precise resource segmentation and limiting the broadcast domain to 250 IP addresses.

IP Address	Function in the system
10.0.1.0	Network ID
10.0.1.1	AWS VPC Router (Default Gateway)
10.0.1.2	AWS AmazonProvidedDNS
10.0.1.4 - 10.0.1.254	Pool available for hosts (EC2, containers)
10.0.1.255	Broadcast Address

3. System Security (Security Groups)

A Least Privilege policy was implemented through AWS Stateful Firewall configuration.

3.1. Inbound Rules

• Port 22 (SSH): Restricted to the administrator’s specific IP address (/32), preventing external brute-force attacks.
• Port 80 (HTTP): Open to public traffic (0.0.0.0/0) to provide access to the chat interface.

Fig. 2. Security Group inbound rule configuration. Strict administrative access restriction (SSH) was applied exclusively for the authorized administrator IP address. Port 80 remains open to public traffic, enabling access to the Nginx web interface.

3.2. Outbound Rules

• All Traffic (0.0.0.0/0): Full outbound traffic is allowed, which is required for package updates (apt update) and downloading AI models via the Ollama protocol.

Fig. 3. Outbound rules allowing full traffic (0.0.0.0/0). This is critical for Ollama’s “pull” mechanism, where model weights must be downloaded from external repositories on first run, as well as for recurring Ubuntu security updates.

4. Application Layer and Containerization

The application is based on a microservices architecture managed with Docker Compose.

services:
    frontend:
        image: nginx:latest
        ports:
            - '80:8080'

    backend:
        image: fastapi-python:3.13
        ports:
            - '8000:8000'

    ollama-app:
        image: ollama/ollama
        ports:
            - '11434:11434'

4.1. AI Engine

The analytical core of the system is the Gemma 3 1b model. It was chosen due to its excellent performance-to-RAM ratio, enabling fast inference on the CPU of m7i-flex instances.

Fig. 4. View of system processes and container status. Optimal RAM utilization is visible while running Gemma3 in a Docker environment.

5. Maintenance

In line with operational best practices, the following rules were implemented:

1. Stopping resources: The EC2 instance is turned off (Stopped) during inactive hours, reducing costs by approximately 90%.
2. EBS management: Regular cleanup of unused Docker images (docker system prune) ensures optimal usage of the 30 GB disk.

6. Future Development Plans

Planned improvements include:

1. Subnet separation: Public and private subnets to separate front-end and back-end logic.
2. Platform deployment: Use dedicated container tools and orchestration (ECS, EKS).
3. Development simulation: Implement users, IAM policies, and roles.

7. Credits

The main project (web application with Gemma) was developed with the team here.