Logpsy 🤖🩺

Specialized SRE Incident Analysis Model for Structured Root Cause Analysis

Fine-tuned from Qwen2.5-Coder-7B-Instruct to analyze production logs and telemetry, identify evidence-backed incident hypotheses, and generate deterministic JSON for automated incident response pipelines.

---

Overview

Logpsy is a domain-specific Large Language Model designed for Site Reliability Engineering (SRE) workflows.

Unlike general-purpose chat models, Logpsy is trained to reason over raw operational telemetry—including logs from Kubernetes, Docker, Nginx, PostgreSQL, Kafka, Redis, Elasticsearch, and other infrastructure systems—to produce structured Root Cause Analysis (RCA).

The model prioritizes evidence over speculation. When sufficient telemetry is unavailable, it explicitly abstains instead of inventing explanations.

This makes Logpsy suitable for:

• AI-powered incident response
• Automated RCA pipelines
• Internal SRE assistants
• DevOps automation
• Observability platforms
• SIEM integrations
• Local infrastructure analysis

---

Key Features

🔍 Evidence-Driven RCA

Transforms noisy production logs into structured incident reports by separating:

• Observed facts
• Symptoms
• Supported hypotheses
• Missing telemetry
• Recommended verification steps

---

🚫 Built-in Abstention

Production incidents often lack enough evidence.

Instead of hallucinating a root cause, Logpsy can return:

"decision": "insufficient_telemetry"

along with the additional telemetry required for diagnosis.

---

📄 Strict JSON Output

Designed for machine consumption.

The model generates valid JSON only—making it straightforward to integrate with:

• Incident management systems
• Alerting pipelines
• SOAR platforms
• Internal dashboards
• Automation workflows

No markdown.

No conversational text.

No unnecessary formatting.

---

🛡 Conservative by Design

Logpsy is intentionally cautious.

It will:

• never fabricate infrastructure components
• never assume deployments occurred
• never invent metrics or traces
• never recommend destructive actions first
• always reference evidence from the provided logs

---

Supported Infrastructure

The training data includes incident scenarios involving:

• Kubernetes
• Docker
• Nginx
• PostgreSQL
• Redis
• Kafka
• Elasticsearch
• Linux services
• Reverse proxies
• Containerized workloads
• Microservices
• API gateways
• Database failures
• Network connectivity issues
• Health check failures
• Resource exhaustion scenarios

---

Example

Input

[docker-engine] container 9d1a8f failed health check:
connection refused on port 8080

[nginx] upstream timed out
(110: Connection timed out)
while connecting to upstream

---

Output

{
  "decision": "likely_cause",
  "confidence": 0.86,
  "incident_summary": "...",
  "observed_facts": [...],
  "symptoms": [...],
  "likely_causes": [...],
  "ruled_out": [...],
  "missing_telemetry": [...],
  "next_checks": [...],
  "operator_risk": "medium",
  "abstention_reason": ""
}

---

Local Deployment (Ollama)

1. Download

Download both files from this repository:

qwen2.5-coder-7b-instruct.Q4_K_M.gguf
Modelfile

---

2. Register the Model

ollama create logpsy-7b-v2 -f Modelfile

---

3. Run

ollama run logpsy-7b-v2

---

Python Example

from huggingface_hub import hf_hub_download
import httpx

# Download the GGUF model
model_path = hf_hub_download(
    repo_id="Shubhamranga11/logpsy",
    filename="qwen2.5-coder-7b-instruct.Q4_K_M.gguf",
    local_dir="./model"
)

response = httpx.post(
    "http://localhost:11434/api/chat",
    json={
        "model": "logpsy-7b-v2",
        "messages": [
            {
                "role": "user",
                "content": """
[docker-engine] container 9d1a8f failed health check:
connection refused on port 8080

[nginx] upstream timed out (110)
"""
            }
        ],
        "stream": False,
        "format": "json"
    },
    timeout=60.0
)

print(response.json()["message"]["content"])

---

Recommended System Prompt

The model was trained using the following behavioral instructions:

You are Logpsy, a local SRE incident analysis assistant.

Analyze raw logs and telemetry excerpts.

Separate observed facts, symptoms, supported hypotheses,
and missing evidence.

Rules:

1. Never state a root cause unless the telemetry supports it.
2. Prefer abstention when evidence is insufficient.
3. Quote evidence for every hypothesis.
4. Never invent services, deployments, traces, metrics or hosts.
5. Recommend verification before remediation.
6. Return valid JSON only.

---

Output Schema

{
  "decision": "cause_identified | likely_cause | insufficient_telemetry | multiple_hypotheses | no_incident",
  "confidence": 0.95,
  "incident_summary": "...",
  "observed_facts": [],
  "symptoms": [],
  "likely_causes": [],
  "ruled_out": [],
  "missing_telemetry": [],
  "next_checks": [],
  "operator_risk": "low | medium | high",
  "abstention_reason": ""
}

---

Training Details

Item	Value
Base Model	Qwen2.5-Coder-7B-Instruct
Fine-tuning Framework	Unsloth
Trainer	TRL SFTTrainer
Dataset	3,938 curated SRE incident examples
Validation Set	193 examples
Epochs	3
LoRA Rank	16
LoRA Alpha	16
Quantization	4-bit (QLoRA)
Hardware	NVIDIA H100 NVL
Cloud Platform	Microsoft Azure GPU VM
Final Training Loss	0.8167

---

Intended Use

Ideal for:

• Local LLM deployments
• Internal DevOps tooling
• Incident response automation
• Production log analysis
• SRE copilots
• CI/CD diagnostics
• Infrastructure monitoring assistants
• Research on structured reasoning over telemetry

---

Limitations

Logpsy analyzes only the telemetry provided.

It cannot:

• infer missing logs
• inspect live infrastructure
• access monitoring systems
• replace human incident response

When evidence is incomplete, the model intentionally abstains instead of guessing.

---

Citation

If you use Logpsy in research or production, please cite this repository.

@misc{logpsy2026,
  title={Logpsy: A Specialized LLM for Evidence-Based Site Reliability Incident Analysis},
  author={Shubham Ranga},
  year={2026},
  publisher={Hugging Face},
  url={https://huggingface.co/Shubhamranga11/logpsy}
}

---

License

MIT License.