recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage.

splunk

Techniques

Sample rules

Ollama Repeated Application Errors

source: splunk
technicques:

Description

Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry.

Detection logic

`ollama_server`
(level=ERROR OR level=FATAL)


| rex field=_raw "msg=\"(?<msg>[^\"]+)\""

| rex field=_raw "exit_code=(?<exit_code>\d+)"


| eval event_time=_time

| bin _time span=5m


| stats count as error_count
        earliest(event_time) as first_seen
        latest(event_time) as last_seen
        values(msg) as error_messages
        values(exit_code) as exit_codes
        dc(msg) as unique_errors
  by _time host


| where error_count > 1


| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S")

| eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")

| eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium")

| eval attack_type="Repeated Ollama Application Errors"


| table first_seen last_seen host error_count
        unique_errors error_messages severity attack_type


| `ollama_repeated_application_errors_filter`