This master’s thesis addressed the problem of event analysis in an OpenShift cluster. The key challenge was distinguishing between ordinary outlier events and contextually significant anomalies that indicate malfunctioning of the system or cluster. The aim of the thesis was to compare statistical methods and machine learning models for anomaly detection and to use a large language model to generate explanations and recommended actions.
The introduction presents a brief theoretical background on the OpenShift platform. It also describes the results of existing research on anomaly detection using machine learning and artificial intelligence. As part of the practical work, a Red Hat OpenShift AI environment was deployed on the Red Hat OpenShift Container Platform, while the data was collected and processed in a Jupyter Notebook environment. A basic statistical analysis of events was performed using the z-score method and the interquartile range (IQR) method. Subsequently, several machine learning models were tested: isolation forest, one-class support vector machine (OCSVM), local outlier factor (LOF), and an autoencoder. The commonly detected anomalies were combined into a consensus model, whose output was then forwarded to the large language model moonshotai/Kimi-K2-Instruct-0905 for generating explanations and recommendations. The results were displayed on a web page within the cluster.
The results showed that the z-score method is suitable for detecting short-term pronounced incidents, while IQR is more appropriate for recurring deviations without broader context. Machine learning models detect a wider range of anomalies because they consider multiple features and the relationships between events. Individual models highlight different aspects of irregularities — isolation forest detects rarer warnings, OCSVM focuses on recurring warnings, while the autoencoder and LOF emphasize the most common loops within the system. Despite certain similarities, the individual models detect different types of anomalies, which is also reflected in the relatively low agreement between the models, particularly in the case of LOF. The consensus model further increases the robustness of detection, although it requires additional interpretation. The large language model (LLM) provides meaningful explanations and guidance for further diagnostics, but it does not fully replace expert analysis. Future work could include testing different model configurations, real-time anomaly detection, intentionally inducing faults in a test project, and evaluating the exact proportion of anomalies for which the LLM correctly identifies the underlying cause. Different LLM approaches could also be compared.
|
