Monitoring to Mitigate Micro-Outages in MikroTik-Based ISP Topologies Using Natural Language#

Joaquin Tadeo Riedmaier, Santiago Agustín Zualet (Universidad Nacional de Misiones, Argentina)

• Why: The clearest example at this meeting of LLMs entering network operations — and it is designed privacy-first, which is the pattern most likely to survive contact with real enterprises.
• What: An on-prem monitoring stack for MikroTik-based small ISPs: syslog push plus RouterOS v7 REST pull (interface traffic/errors, CPU/RAM, connection tracking, ARP, PPPoE/RADIUS sessions) through Django/Python/PostgreSQL, with noise filtering (37 cyclic log lines collapsed into one event row), threshold alerts via Telegram, and a locally hosted LLM answering natural-language questions via text-to-SQL over flattened read-only views with RAG-anchored responses (grounding goal ≥95%). Projected effect: critical-event diagnosis from ~90 minutes to ~18. Everything stays inside the ISP (framed against Argentine data-protection law 25.326); an external-API extension exists only as an anonymized option.
• How: Flattened schema (fewer JOINs → fewer hallucinations), a SELECT-only database user so the model cannot modify anything, and cross-signal correlation of L2/L3 metrics, conntrack, RADIUS sessions, and syslog. The LLM runs on 32 GB of RAM locally.
• Where applicable: Built for the 1,500+ small ISP/cooperative context in Argentina, but the architecture — a read-only natural-language query layer over normalized telemetry — transfers to any environment. The time-savings figure is a projection; the slides explicitly label the flagship correlation scenario as illustrative, not measured.