Enterprise AI Root Cause Analysis (RCA) Agent

An open-source, locally hosted AI agent designed to accelerate enterprise incident resolution. By leveraging Retrieval-Augmented Generation (RAG) over historical IT tickets and server logs, this agent assists IT support and Change Implementation teams in rapidly identifying root causes for system outages, effectively reducing Mean Time to Resolution (MTTR).

This project demonstrates a modular, dual-engine AI architecture, allowing users to toggle between a pure semantic search pipeline and an autonomous, tool-calling reasoning agent.

Architecture & Tech Stack

• Frontend: Streamlit (Conversational UI)
• Vector Database: ChromaDB (Local, ephemeral storage)
• AI Orchestration (Dual-Engine)(I know ;p): LangChain & LlamaIndex
• Local Inference: Llama 3 (via Ollama)
• Embeddings: Nomic-Embed-Text (via Ollama)
• Package Management: uv

flowchart LR
    %% Define Styles
    classDef ui fill:#4B4B4B,stroke:#fff,stroke-width:2px,color:#fff;
    classDef logic fill:#005A9C,stroke:#fff,stroke-width:2px,color:#fff;
    classDef data fill:#006400,stroke:#fff,stroke-width:2px,color:#fff;
    classDef llm fill:#8B0000,stroke:#fff,stroke-width:2px,color:#fff;

    subgraph Frontend["Frontend Controller"]
        UI[Streamlit UI app.py]:::ui
    end

    subgraph Middleware["AI Orchestration"]
        UI -- User Query --> Switch{Engine Toggle}
        Switch -- Fast Search --> Llama[LlamaIndex RAG]:::logic
        Switch -- Deep Analysis --> Chain[LangChain Agent]:::logic
    end

    subgraph DataLayer["Local Storage"]
        Llama -->|Retrieve Logs| VectorDB[(ChromaDB)]:::data
        Chain -.->|Tool: Search| VectorDB
    end

    subgraph Intelligence["Local Inference"]
        Llama -->|Generate| LLM((Ollama: Llama 3)):::llm
        Chain -->|Reasoning| LLM
    end

    subgraph Ingestion["Ingestion Pipeline"]
        Gen[generator.py Mock Data] -->|JSON| Index[indexer.py]
        Index -->|Embeddings| VectorDB
    end

Loading

---

System Modules & Functional Blueprint

This project strictly adheres to a separation of concerns. The architecture is divided into three distinct layers: Data Ingestion, AI Middleware, and the UI Controller.

Below is the blueprint for rebuilding or extending this system.

1. Data Ingestion Pipeline (src/ingestion/)

Responsible for generating, processing, and vectorizing enterprise data.

• generator.py (Synthetic Data Mocker):
  • Responsibility: Simulates an enterprise IT environment by generating mock JSON tickets (e.g., Jira/ServiceNow style) and server log snippets.
  • Output: Populates the data/raw/ directory with structured incident data containing symptoms, root causes, and resolutions.
• indexer.py (Vector Embedding Engine):
  • Responsibility: Reads the raw JSON data, splits the text into optimal chunk sizes, and passes them through the embedding model.
  • Output: Instantiates a persistent ChromaDB collection in data/chroma_db/, creating a mathematical index of all historical incidents for rapid similarity search.

2. AI Logic Layer (src/engines/)

Implements the Strategy Design Pattern. The frontend interacts only with a base class, allowing the underlying AI framework to be swapped dynamically.

• engine_base.py (The Contract):
  • Responsibility: Defines an Abstract Base Class (ABC) ensuring all engines implement a standard generate_response(query: str) -> str method.
• engine_llamaindex.py (Fast RAG Engine):
  • Responsibility: Implements a pure semantic search pipeline optimized for speed.
  • Flow: Takes the user query -> embeds it -> queries ChromaDB for the top K most relevant historical tickets -> injects them into a strict prompt -> returns a factual summary via Llama 3.
• engine_langchain.py (Autonomous Tool Agent):
  • Responsibility: Implements a multi-step reasoning agent.
  • Flow: Parses the user query, determines which tools to use (e.g., querying the vector database, checking a mock server status), executes those tools sequentially, evaluates the observations, and synthesizes a comprehensive final response.

3. Frontend Controller (src/app.py)

• Responsibility: Renders the chat interface using Streamlit. Manages session state, captures user queries, and provides a sidebar toggle to switch between the LlamaIndex and LangChain engines on the fly. It is completely decoupled from the AI implementation details.

4. Shared Utilities (src/utils/config.py)

• Responsibility: The single source of truth for the entire application. It defines absolute file paths (using pathlib), database collection names, and LLM hyperparameters (temperature, top-k retrieval limits) to ensure consistency across all modules.

---

Environment Setup & Execution

This project uses uv for lightning-fast, deterministic dependency management.

Prerequisites

1. Install uv.
2. Install Ollama and pull the required local models:

   ollama pull llama3
   ollama pull nomic-embed-text
   

Installation

Clone the repository and initialize the environment:

  ```Bash
  uv sync

Running the System

To rebuild the project from scratch, execute the modules in the following order:

1. Generate the mock enterprise data:

   python src/ingestion/generator.py

2. Build the Vector Database:

   python src/ingestion/indexer.py

3. Launch the UI:

   streamlit run src/app.py
   

This system is designed for enterprise data privacy. By utilizing local embedding models and local LLM inference via Ollama, zero data—including mock server logs and ticket summaries—ever leaves the host machine.