This anomaly rule detects repeated Ollama inference requests that exhibit long response times on common inference endpoints: /api/generate, /api/chat, and /v1/chat/completions. It parses Ollama server logs to extract latency, source, host, and request details, converts latency to milliseconds, and flags sequences where latency exceeds 30 seconds. The search bins data in 10-minute windows, aggregating by time, source, and host to compute the count of long requests, average and maximum response times, and the affected URIs and status codes. If more than one long request is observed in a window, the rule raises a medium-to-high severity alert (high if max latency > 55 seconds) and labels the activity as “Long-Running Inference Requests.” The rule notes that logs do not reveal prompt content, so it should be treated as an exploratory performance signal rather than a prompt-injection indicator. The detected pattern is intended to surface performance bottlenecks related to model size, prompt length, or host resource constraints, rather than a guaranteed attack. The rule supports analyst workflow with references, known false positives, and drill-down guidance for deeper investigation.