Smart Log Manager

A multi-tenant platform that turns noisy, high-volume logs into automated anomaly detection and AI root-cause analysis.

Multi-tenant FastAPI + React/TypeScript platform that orchestrates log ingestion, ML anomaly detection and an agentic RCA pipeline, hardened with row-level security, SSO, secrets management and automated PII anonymization.

Incident triage across multi-tenant log streams was manual and slow, with root-cause analysis bottlenecked on tribal knowledge and no safe way to handle sensitive data.

• Architected a multi-tenant FastAPI + React/TypeScript platform orchestrating ingestion, anomaly detection and root-cause analysis.
• Built an agentic RCA pipeline on LangGraph + Azure OpenAI with prompt-driven reasoning that minimises hallucinated incident statements.
• Engineered the full ML lifecycle: Isolation Forest / LOF unsupervised detection plus supervised scoring, with APIs for training, vectorization and model activation.
• Hardened persistence with PostgreSQL Row-Level Security and SQLAlchemy ORM across batch and streaming log collection.
• Shipped a federated micro-frontend (Vite module federation + Grommet) for model management and live training observability.
• Operationalised with Docker/Kubernetes, Keycloak SSO, HashiCorp Vault secrets, and Presidio + spaCy PII anonymization.

1. 01

   Enforced tenant isolation in PostgreSQL with Row-Level Security, not in the API layer.

   For multi-tenant log data, one missed WHERE clause is a cross-tenant leak. Pushing isolation into the database makes that entire class of bug structurally impossible, at the cost of some query flexibility, the right trade for security-sensitive data.

2. 02

   Led with unsupervised anomaly detection (Isolation Forest / LOF) before supervised scoring.

   Labelled incident data is scarce and biased early on. Unsupervised detection delivers day-one value with no training set; supervised scoring folds in later as labels accumulate, avoiding a cold start where nothing is flagged until data exists.

3. 03

   Ran RCA as a guarded LangGraph state machine rather than a free-form prompt chain.

   Typed tools, timeouts and schema validation around every model call keep reasoning auditable and isolate failures to a single node. That is what minimises hallucinated incident statements: the difference between a demo and something an SRE trusts at 3am.

4. 04

   Anonymised PII at ingestion with Presidio + spaCy, not on read.

   Stripping sensitive data before it lands in storage or reaches the LLM is a stricter boundary than redacting at query time. The reprocessing overhead is far cheaper than the blast radius of a leak.

Source is HPE-internal and cannot be published — architecture and trade-offs walked through on request.