Log Insight & AIOps

Log Insight

Point your devices' syslog at vConfig (UDP 514) to get:

• Per-device log timelines joined with the device inventory — a log line is never just a hostname, it's a device with a role, a site, a topology position.
• Pattern insight: recurring messages are clustered so a new pattern stands out from the noise.
• Alert enrichment: BGP flap and surge alerts link to the matching log window.

AI-assisted analysis

vConfig can hand a masked incident bundle (alerts, log excerpts, affected topology) to an LLM and return:

• A root-cause hypothesis with the supporting evidence listed.
• A remediation proposal — expressed as a config template you can review.

The three iron rules

1. The LLM is the brain, never the hands. Every proposed change goes through the normal change workflow: review → approval → execution → verification. Nothing touches a device without an operator's decision.
2. Graded autonomy. Start at Tier 0 (analysis only). Raise to Tier 1 (pre-approved low-risk actions) only when you're comfortable — per action type, under your control.
3. Snapshot first, always reversible. Any executed remediation is preceded by a config snapshot; rollback is one click.

Data masking

Before anything leaves your instance for analysis, a masking layer strips credentials, SNMP communities, and (configurably) IP addresses/customer names. The masking rules are visible and testable in the UI — you can see exactly what the model would receive. You choose the LLM endpoint: a cloud API or a local model inside your network.

Note

AI features are optional and disabled until you configure a model endpoint. Everything else in vConfig works without them.