2026-10-09T13:16:00.167690-07:00 web-02 sshd[37452]: Accepted publickey for françois from 91.119.182.123 port 33741 ssh2: ED25519 SHA256:bf827c74711e3bc5 2026-10-09T13:16:00.218528-07:00 bastion haproxy[941]: 192.78.193.48:46014 [77227] http-in app/web-01 7069/0/539/539/7069 200 41185 - - ---- 653/653/94/94/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:16:00.314208-07:00 bastion haproxy[901]: 45.244.244.222:24278 [70488] http-in app/web-03 5910/0/379/379/5910 302 83580 - - ---- 701/701/49/49/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:16:00.480879-07:00 api-07 app[30421]: INFO order 22350 confirmed for deploy in 5085 ms (region us-east-1, queue invoices) 2026-10-09T13:16:00.638165-07:00 db-replica nginx[1205]: 203.196.184.181 - - "GET /login HTTP/1.1" 301 55088 "-" "python-requests/2.32.3" 2026-10-09T13:16:00.999757-07:00 db-replica nginx[1206]: 91.249.145.79 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 11869 "-" "Go-http-client/1.1" 2026-10-09T13:16:01.001563-07:00 db-primary app[30115]: INFO request_id=07e992959e41dcbd method=GET path=/api/v2/users status=404 duration=3940ms 2026-10-09T13:16:01.004426-07:00 api-07 app[30052]: INFO worker 44 picked job f77e2d95b2b49b3c from queue webhooks 2026-10-09T13:16:01.015201-07:00 worker-12 nginx[1209]: 91.98.196.137 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 42869 "-" "Go-http-client/1.1" 2026-10-09T13:16:01.156109-07:00 db-replica nginx[1203]: 172.43.9.228 - - "GET /health HTTP/1.1" 200 703 "-" "kube-probe/1.31" 2026-10-09T13:16:01.171934-07:00 db-replica nginx[1207]: 192.87.174.200 - ci "POST /health HTTP/1.1" 200 45574 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:01.353058-07:00 api-07 haproxy[932]: 91.121.92.247:24233 [83463] http-in app/cache-3 1102/0/871/871/1102 301 41492 - - ---- 430/430/59/59/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:01.392052-07:00 api-08 sshd[25445]: Failed password for invalid user backup from 192.209.208.237 port 5315 ssh2 2026-10-09T13:16:01.518516-07:00 bastion haproxy[928]: 192.226.169.111:11034 [24145] http-in app/cache-3 9578/0/153/153/9578 200 25125 - - ---- 294/294/84/84/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:16:01.668189-07:00 worker-12 postgres[18772]: LOG: duration: 5957.201 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:16:01.712241-07:00 api-08 app[30187]: INFO request_id=af8f91bdc7cf952b method=GET path=/api/v2/search?q=invoice status=404 duration=5595ms 2026-10-09T13:16:01.793468-07:00 db-replica sshd[18391]: Failed password for invalid user zoë from 91.78.35.166 port 55941 ssh2 2026-10-09T13:16:01.798229-07:00 web-01 sshd[19718]: Connection closed by 91.76.35.236 port 41703 [preauth] 2026-10-09T13:16:01.911169-07:00 edge-fr-1 nginx[1209]: 192.144.116.60 - - "GET /login HTTP/1.1" 200 20016 "-" "Go-http-client/1.1" 2026-10-09T13:16:02.039381-07:00 api-08 app[30140]: INFO request_id=b86e8b34e1717698 method=GET path=/static/app.js status=200 duration=142ms 2026-10-09T13:16:02.149289-07:00 web-02 sshd[50202]: Received disconnect from 10.26.100.12 port 20923:11: Bye Bye [preauth] 2026-10-09T13:16:02.166900-07:00 api-08 app[30901]: INFO order 30136 confirmed for backup in 4016 ms (region us-east-1, queue emails) 2026-10-09T13:16:02.482288-07:00 edge-fr-1 sshd[36082]: Received disconnect from 91.222.120.163 port 43838:11: Bye Bye [preauth] 2026-10-09T13:16:02.517581-07:00 web-02 nginx[1202]: 172.81.5.234 - - "GET /health HTTP/1.1" 404 15832 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:02.555527-07:00 db-primary haproxy[902]: 192.115.153.226:61548 [77377] http-in app/api-07 2454/0/615/615/2454 200 64300 - - ---- 835/835/28/28/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:02.555528-07:00 db-primary sshd[20222]: Connection closed by 192.98.158.178 port 45234 [preauth] 2026-10-09T13:16:02.581848-07:00 web-02 app[30382]: INFO worker 76 picked job 2b988c302fdf2fa2 from queue emails 2026-10-09T13:16:02.619782-07:00 web-01 app[30005]: INFO worker 17 picked job a7e885aed85dabee from queue webhooks 2026-10-09T13:16:02.717144-07:00 web-03 app[30878]: ERROR payment declined for order 81152: card_declined (code 23), customer notified 2026-10-09T13:16:03.051078-07:00 api-07 sshd[28202]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:16:03.156735-07:00 cache-3 app[30275]: INFO order 39049 confirmed for root in 6006 ms (region us-east-1, queue emails) 2026-10-09T13:16:03.284665-07:00 worker-12 postgres[16819]: LOG: duration: 6158.843 ms statement: SELECT * FROM orders WHERE customer_id = 53955 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:03.318191-07:00 web-01 app[30858]: INFO request_id=8d5ab5684ebe33ff method=GET path=/api/v2/orders/8841 status=404 duration=8875ms 2026-10-09T13:16:03.323322-07:00 web-01 nginx[1202]: 10.27.87.21 - françois "POST /api/v2/orders/8841 HTTP/1.1" 200 35127 "-" "python-requests/2.32.3" 2026-10-09T13:16:03.627520-07:00 db-replica app[30326]: DEBUG cache hit ratio 6% over the last minute (38262 lookups) 2026-10-09T13:16:03.744056-07:00 bastion nginx[1208]: 10.227.217.13 - - "GET /health HTTP/1.1" 502 13340 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:03.878549-07:00 db-replica app[30620]: DEBUG cache hit ratio 91% over the last minute (45418 lookups) 2026-10-09T13:16:04.065305-07:00 api-08 sshd[56719]: Connection closed by 172.132.68.137 port 4556 [preauth] 2026-10-09T13:16:04.117004-07:00 api-07 haproxy[913]: 172.39.231.6:15651 [62373] http-in app/web-03 9120/0/137/137/9120 200 65257 - - ---- 157/157/71/71/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:16:04.267042-07:00 web-03 sshd[58879]: Accepted publickey for françois from 91.110.20.204 port 1984 ssh2: ED25519 SHA256:b9048efa661dba6d 2026-10-09T13:16:04.286059-07:00 bastion audit: type=USER_LOGIN msg=audit(1791576964.13:52881): pid=52881 uid=0 auid=6163 ses=971 msg='op=login id=6163 exe="/usr/sbin/sshd" hostname=? addr=172.207.188.159 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:04.335349-07:00 bastion app[30378]: INFO health check ok: db 644 ms, cache 644 ms, queue depth 11 2026-10-09T13:16:04.411477-07:00 db-primary app[30001]: INFO worker 85 picked job 7a0e2936edcd2c24 from queue orders 2026-10-09T13:16:04.536270-07:00 web-03 kernel: [24996.191057] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.81.37.238 DST=10.0.983.983 LEN=46 TOS=0x00 PREC=0x00 TTL=46 ID=24996 DF PROTO=TCP SPT=53051 DPT=53051 WINDOW=24996 RES=0x00 SYN URGP=0 2026-10-09T13:16:04.657085-07:00 api-08 sshd[33425]: Invalid user zoë from 91.31.231.248 port 36253 2026-10-09T13:16:04.950752-07:00 db-primary systemd[1]: Started Session 24522 of User akira. 2026-10-09T13:16:05.106772-07:00 db-primary app[30901]: INFO health check ok: db 512 ms, cache 512 ms, queue depth 31 2026-10-09T13:16:05.125095-07:00 web-01 kubelet[800]: I1009 13:16:05.603041 1049 kubelet.go:1049] "Pod is terminating, skipping pod status update" pod="default/api-6cf22e03b0d9bcab" 2026-10-09T13:16:05.390770-07:00 cache-3 app[30807]: DEBUG cache hit ratio 44% over the last minute (97683 lookups) 2026-10-09T13:16:05.522890-07:00 web-02 app[30904]: INFO request_id=e0157074aedb164a method=GET path=/static/app.js status=404 duration=1922ms 2026-10-09T13:16:05.552376-07:00 cache-3 haproxy[904]: 172.137.18.226:28583 [31381] http-in app/bastion 1839/0/178/178/1839 200 3866 - - ---- 554/554/94/94/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:16:05.920053-07:00 cache-3 app[30023]: WARN slow query (3444 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '28 minutes' 2026-10-09T13:16:05.923260-07:00 edge-fr-1 app[30108]: INFO request_id=046aa27d597aafa4 method=GET path=/login status=500 duration=9539ms 2026-10-09T13:16:05.974195-07:00 api-08 app[30828]: INFO worker 48 picked job 934639bf5ef27be2 from queue orders 2026-10-09T13:16:06.037007-07:00 edge-fr-1 sshd[52982]: Connection closed by 91.153.185.123 port 41550 [preauth] 2026-10-09T13:16:06.218085-07:00 web-01 app[30358]: INFO health check ok: db 897 ms, cache 897 ms, queue depth 72 2026-10-09T13:16:06.340174-07:00 web-01 systemd[1]: session-71006.scope: Deactivated successfully. 2026-10-09T13:16:06.341524-07:00 edge-fr-1 kernel: [99277.049617] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.144.33.203 DST=10.0.909.909 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=99277 DF PROTO=TCP SPT=12364 DPT=12364 WINDOW=99277 RES=0x00 SYN URGP=0 2026-10-09T13:16:06.383473-07:00 web-01 app[30695]: INFO health check ok: db 155 ms, cache 155 ms, queue depth 19 2026-10-09T13:16:06.408849-07:00 edge-fr-1 nginx[1201]: 203.118.61.101 - - "GET /wp-login.php HTTP/1.1" 404 82442 "-" "Go-http-client/1.1" 2026-10-09T13:16:06.465166-07:00 cache-3 sshd[46572]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:16:06.514442-07:00 bastion app[30353]: INFO request_id=d1974d269f316169 method=GET path=/api/v2/orders status=200 duration=4136ms 2026-10-09T13:16:06.796705-07:00 web-03 app[30384]: INFO order 44692 confirmed for deploy in 6637 ms (region us-east-1, queue orders) 2026-10-09T13:16:07.641443-07:00 cache-3 sshd[3390]: Failed password for invalid user akira from 203.124.159.201 port 64585 ssh2 2026-10-09T13:16:07.806628-07:00 bastion app[30746]: INFO request_id=bc59abaf31056ff3 method=GET path=/static/app.js status=500 duration=7045ms 2026-10-09T13:16:07.838870-07:00 bastion app[30195]: INFO request_id=57367a1e65c8ae10 method=GET path=/admin status=401 duration=6989ms 2026-10-09T13:16:07.994211-07:00 web-02 haproxy[939]: 203.4.231.112:47638 [40480] http-in app/db-primary 419/0/449/449/419 200 71496 - - ---- 219/219/70/70/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:16:08.004805-07:00 edge-fr-1 app[30218]: INFO request_id=a2ee67c79364d1a5 method=GET path=/metrics status=204 duration=4376ms 2026-10-09T13:16:08.172501-07:00 worker-12 nginx[1207]: 203.236.224.96 - - "GET /static/app.js HTTP/1.1" 302 89236 "-" "Go-http-client/1.1" 2026-10-09T13:16:08.346425-07:00 web-01 app[30475]: INFO request_id=b616d9def5dcc8eb method=GET path=/favicon.ico status=301 duration=4044ms 2026-10-09T13:16:08.606364-07:00 db-replica app[30740]: INFO worker 78 finished job 8f85849141a9485f in 295 ms 2026-10-09T13:16:08.694094-07:00 web-02 app[30279]: INFO worker 23 finished job 7ea7ddd36c92c87d in 9609 ms 2026-10-09T13:16:08.787888-07:00 web-01 nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.128.18.199, server: app.example.com, request: "GET /api/v2/search?q=invoice HTTP/1.1", upstream: "http://10.0.386.386:8080/api/v2/search?q=invoice" 2026-10-09T13:16:08.839258-07:00 api-07 app[30391]: INFO worker 82 finished job a6ca9e28ce5d6b0b in 3230 ms 2026-10-09T13:16:08.872528-07:00 cache-3 app[30066]: INFO request_id=13fabe3d6165949d method=GET path=/admin status=301 duration=5711ms 2026-10-09T13:16:08.916739-07:00 cache-3 nginx[1210]: 192.219.246.95 - - "GET /api/v2/users HTTP/1.1" 200 80754 "-" "Go-http-client/1.1" 2026-10-09T13:16:09.191053-07:00 api-08 haproxy[915]: 203.231.222.86:16912 [77348] http-in app/cache-3 6261/0/185/185/6261 404 26098 - - ---- 911/911/90/90/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:16:09.318414-07:00 db-replica sshd[7936]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:16:09.417660-07:00 web-02 nginx[1200]: 192.208.170.47 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 44269 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:10.040041-07:00 api-08 app[30680]: INFO request_id=95566f9e6fee3669 method=GET path=/wp-login.php status=500 duration=1734ms 2026-10-09T13:16:10.073585-07:00 edge-fr-1 app[30380]: INFO request_id=fe3c47792b4d3a18 method=GET path=/favicon.ico status=204 duration=2012ms 2026-10-09T13:16:10.100102-07:00 web-02 systemd[1]: session-77385.scope: Deactivated successfully. 2026-10-09T13:16:10.161765-07:00 web-01 nginx[1201]: 172.159.119.13 - - "GET /static/main.css HTTP/1.1" 200 21661 "-" "kube-probe/1.31" 2026-10-09T13:16:10.226118-07:00 bastion sshd[64584]: Connection closed by 172.73.130.129 port 18160 [preauth] 2026-10-09T13:16:10.243251-07:00 cache-3 app[30062]: INFO request_id=17dcfb3a3c7a1305 method=GET path=/static/app.js status=302 duration=8184ms 2026-10-09T13:16:10.406866-07:00 worker-12 sshd[33954]: Connection closed by 10.166.44.86 port 27895 [preauth] 2026-10-09T13:16:10.452471-07:00 db-primary app[30519]: DEBUG cache hit ratio 97% over the last minute (17549 lookups) 2026-10-09T13:16:10.589125-07:00 cache-3 app[30817]: INFO order 48888 confirmed for zoë in 6977 ms (region us-east-1, queue webhooks) 2026-10-09T13:16:10.615097-07:00 web-01 haproxy[942]: Server app/web-03 is UP, reason: Layer7 check passed, code: 200, check duration: 386ms. 99 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:16:10.715566-07:00 db-primary sshd[38153]: Failed password for invalid user françois from 45.251.220.76 port 65188 ssh2 2026-10-09T13:16:10.748611-07:00 api-08 haproxy[907]: 91.25.248.41:39795 [45114] http-in app/web-03 2457/0/910/910/2457 204 72662 - - ---- 525/525/31/31/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:16:11.052020-07:00 web-03 app[30067]: INFO request_id=cd54770d1975fb15 method=GET path=/admin status=404 duration=2171ms 2026-10-09T13:16:11.060604-07:00 db-replica nginx[1200]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.213.156.73, server: app.example.com, request: "GET /api/v2/orders/8841 HTTP/1.1", upstream: "http://10.0.811.811:8080/api/v2/orders/8841" 2026-10-09T13:16:11.157141-07:00 api-07 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:16:11.313091-07:00 cache-3 app[30607]: ERROR payment declined for order 55253: card_declined (code 56), customer notified 2026-10-09T13:16:11.340386-07:00 bastion sshd[55804]: Invalid user priya from 10.239.42.177 port 27152 2026-10-09T13:16:11.908536-07:00 db-primary nginx[1207]: 10.217.239.56 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 11904 "-" "kube-probe/1.31" 2026-10-09T13:16:11.914516-07:00 web-02 app[30527]: INFO health check ok: db 403 ms, cache 403 ms, queue depth 42 2026-10-09T13:16:12.002177-07:00 db-primary nginx[1204]: 203.212.106.98 - - "GET /api/v2/users HTTP/1.1" 200 30090 "-" "kube-probe/1.31" 2026-10-09T13:16:12.284636-07:00 worker-12 app[30055]: INFO order 38260 confirmed for müller in 6284 ms (region eu-west-1, queue emails) 2026-10-09T13:16:12.423044-07:00 worker-12 nginx[1200]: 172.49.208.28 - sørensen "POST /.env HTTP/1.1" 301 29439 "-" "kube-probe/1.31" 2026-10-09T13:16:12.820089-07:00 bastion sshd[43481]: pam_unix(sshd:session): session opened for user françois(uid=2724) by (uid=0) 2026-10-09T13:16:12.875113-07:00 web-01 systemd[1]: Started Session 28468 of User priya. 2026-10-09T13:16:12.914573-07:00 web-01 app[30247]: INFO worker 77 finished job 8c94b6073aec5c6c in 6448 ms 2026-10-09T13:16:12.955859-07:00 web-03 app[30716]: INFO worker 80 picked job 5bd47fdd1215837f from queue webhooks 2026-10-09T13:16:13.020285-07:00 edge-fr-1 nginx[1203]: 10.236.231.144 - - "GET /api/v2/orders HTTP/1.1" 204 16365 "-" "kube-probe/1.31" 2026-10-09T13:16:13.280514-07:00 db-primary app[30665]: INFO order 43174 confirmed for priya in 1868 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:16:13.304418-07:00 api-08 app[30576]: ERROR payment declined for order 46366: card_declined (code 99), customer notified 2026-10-09T13:16:13.599992-07:00 bastion app[30992]: WARN retrying upstream 203.86.105.88:56953 after timeout (1608 ms), attempt 1 of 3 2026-10-09T13:16:13.796505-07:00 bastion app[30484]: INFO order 88372 confirmed for ci in 8278 ms (region us-east-1, queue webhooks) 2026-10-09T13:16:14.284592-07:00 cache-3 nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.142.245.172, server: app.example.com, request: "GET /static/app.js HTTP/1.1", upstream: "http://10.0.476.476:8080/static/app.js" 2026-10-09T13:16:14.479968-07:00 edge-fr-1 sshd[24470]: Failed password for invalid user akira from 45.6.0.74 port 52908 ssh2 2026-10-09T13:16:14.701848-07:00 web-02 sshd[46130]: Accepted publickey for akira from 91.56.58.192 port 10764 ssh2: ED25519 SHA256:85387921de278378 2026-10-09T13:16:14.736846-07:00 db-replica haproxy[940]: 203.224.22.202:35426 [57224] http-in app/api-08 5036/0/502/502/5036 404 46928 - - ---- 244/244/83/83/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:16:14.752512-07:00 web-03 app[30375]: INFO request_id=271502150c1ba11b method=GET path=/login status=200 duration=6887ms 2026-10-09T13:16:14.990506-07:00 db-primary nginx[1208]: 203.63.60.60 - - "GET /static/app.js HTTP/1.1" 401 44637 "-" "curl/8.4.0" 2026-10-09T13:16:15.007031-07:00 web-03 sshd[58956]: Invalid user müller from 10.57.221.240 port 18883 2026-10-09T13:16:15.102888-07:00 cache-3 app[30859]: INFO worker 12 finished job d3919eff6ae02e04 in 6942 ms 2026-10-09T13:16:15.279185-07:00 api-08 app[30987]: INFO order 16701 confirmed for françois in 8988 ms (region ap-northeast-1, queue emails) 2026-10-09T13:16:15.279997-07:00 db-replica haproxy[926]: 91.151.127.66:16028 [86375] http-in app/worker-12 7073/0/924/924/7073 502 13071 - - ---- 941/941/12/12/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:16:15.398748-07:00 web-01 app[30022]: INFO request_id=4e2a7b7b39126e83 method=GET path=/health status=401 duration=330ms 2026-10-09T13:16:15.466284-07:00 db-replica nginx[1204]: 91.182.135.46 - - "GET /metrics HTTP/1.1" 401 37693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:15.580037-07:00 bastion nginx[1206]: 91.242.61.116 - - "GET /static/app.js HTTP/1.1" 401 50050 "-" "python-requests/2.32.3" 2026-10-09T13:16:15.677736-07:00 cache-3 kernel: [59794.252375] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.247.46.198 DST=10.0.191.191 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=59794 DF PROTO=TCP SPT=53734 DPT=53734 WINDOW=59794 RES=0x00 SYN URGP=0 2026-10-09T13:16:15.778072-07:00 api-07 haproxy[901]: 172.50.36.248:50572 [39190] http-in app/db-replica 989/0/750/750/989 404 76995 - - ---- 127/127/60/60/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:15.800881-07:00 api-07 app[30833]: INFO order 60081 confirmed for müller in 9820 ms (region ap-northeast-1, queue orders) 2026-10-09T13:16:15.890069-07:00 db-replica app[30718]: INFO worker 10 finished job 4dcc7946eb5e48c1 in 2021 ms 2026-10-09T13:16:15.976642-07:00 web-01 nginx[1201]: 192.243.1.29 - françois "POST /static/app.js HTTP/1.1" 200 58694 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:16.148906-07:00 web-03 nginx[1204]: 10.86.126.60 - akira "POST /.env HTTP/1.1" 200 6375 "-" "python-requests/2.32.3" 2026-10-09T13:16:16.279147-07:00 web-02 app[30084]: INFO worker 65 picked job c4544614219e55e8 from queue emails 2026-10-09T13:16:16.834051-07:00 web-01 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:16:16.872556-07:00 bastion kernel: [23142.471855] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.96.72.216 DST=10.0.443.443 LEN=53 TOS=0x00 PREC=0x00 TTL=53 ID=23142 DF PROTO=TCP SPT=49004 DPT=49004 WINDOW=23142 RES=0x00 SYN URGP=0 2026-10-09T13:16:16.989640-07:00 db-primary postgres[16757]: LOG: duration: 9210.852 ms statement: SELECT * FROM orders WHERE customer_id = 37771 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:17.152003-07:00 web-02 app[30618]: INFO worker 98 finished job 863d41f83370eb27 in 7622 ms 2026-10-09T13:16:17.250060-07:00 worker-12 cron[32937]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:16:17.395219-07:00 db-replica app[30223]: INFO request_id=44f7f7b414feb057 method=GET path=/health status=404 duration=6903ms 2026-10-09T13:16:17.441032-07:00 cache-3 nginx[1202]: 45.77.36.87 - - "GET /wp-login.php HTTP/1.1" 404 29264 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:17.627714-07:00 web-02 app[30479]: INFO worker 87 picked job bff27388c48a3339 from queue orders 2026-10-09T13:16:17.832379-07:00 worker-12 haproxy[907]: 10.230.158.246:50870 [12690] http-in app/db-primary 2940/0/137/137/2940 200 55973 - - ---- 808/808/17/17/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:16:18.505091-07:00 cache-3 nginx[1201]: 45.52.211.179 - - "GET /static/app.js HTTP/1.1" 200 69315 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:18.560278-07:00 api-08 haproxy[935]: 192.177.164.26:4389 [42298] http-in app/bastion 5923/0/599/599/5923 502 26166 - - ---- 628/628/38/38/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:16:18.697040-07:00 db-primary app[30236]: DEBUG cache hit ratio 53% over the last minute (33479 lookups) 2026-10-09T13:16:18.743167-07:00 bastion app[30251]: INFO order 47319 confirmed for zoë in 3417 ms (region ap-northeast-1, queue emails) 2026-10-09T13:16:18.795039-07:00 edge-fr-1 sshd[3784]: Accepted publickey for root from 91.158.171.92 port 5883 ssh2: ED25519 SHA256:73ff5181a4e147c8 2026-10-09T13:16:18.958252-07:00 edge-fr-1 systemd[1]: Started Session 14487 of User zoë. 2026-10-09T13:16:19.237801-07:00 db-replica sshd[2412]: Failed password for invalid user sørensen from 172.237.180.160 port 34426 ssh2 2026-10-09T13:16:19.440315-07:00 edge-fr-1 postgres[18479]: LOG: duration: 5612.60 ms statement: SELECT * FROM orders WHERE customer_id = 18069 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:19.777861-07:00 worker-12 app[30506]: INFO request_id=38db640de54cc4df method=GET path=/static/main.css status=502 duration=2420ms 2026-10-09T13:16:19.911230-07:00 api-07 app[30822]: INFO request_id=2aeccd94076c5da3 method=GET path=/favicon.ico status=502 duration=1439ms 2026-10-09T13:16:19.923723-07:00 bastion app[30056]: INFO request_id=543076079af4c07a method=GET path=/login status=502 duration=2209ms 2026-10-09T13:16:20.198704-07:00 web-01 nginx[1200]: 10.17.230.85 - - "GET /api/v2/orders HTTP/1.1" 500 45463 "-" "python-requests/2.32.3" 2026-10-09T13:16:20.387103-07:00 web-03 sshd[41241]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:16:20.939149-07:00 api-07 systemd[1]: session-76560.scope: Deactivated successfully. 2026-10-09T13:16:20.967691-07:00 edge-fr-1 haproxy[906]: 10.96.194.19:62549 [50566] http-in app/bastion 8355/0/43/43/8355 502 81965 - - ---- 742/742/63/63/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:16:21.051855-07:00 api-07 app[30820]: INFO worker 34 finished job 37e12fceea11ed12 in 659 ms 2026-10-09T13:16:21.125147-07:00 web-02 nginx[1201]: 203.62.213.33 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 5141 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:21.138782-07:00 db-replica systemd[1]: Started Session 13260 of User zoë. 2026-10-09T13:16:21.234092-07:00 worker-12 app[30902]: DEBUG cache hit ratio 66% over the last minute (89426 lookups) 2026-10-09T13:16:21.329104-07:00 bastion app[30559]: DEBUG cache hit ratio 7% over the last minute (29294 lookups) 2026-10-09T13:16:21.457098-07:00 web-03 app[30957]: INFO worker 38 finished job 366a23fc1a758157 in 2117 ms 2026-10-09T13:16:21.469299-07:00 web-01 nginx[1200]: 91.31.70.41 - - "GET /static/main.css HTTP/1.1" 302 47164 "-" "kube-probe/1.31" 2026-10-09T13:16:21.532022-07:00 api-08 sshd[36053]: Accepted publickey for deploy from 172.149.245.230 port 43490 ssh2: ED25519 SHA256:ad0420cea5daebe8 2026-10-09T13:16:21.551156-07:00 edge-fr-1 sshd[32477]: Accepted publickey for müller from 91.96.37.89 port 27172 ssh2: ED25519 SHA256:3888ea0c792984a7 2026-10-09T13:16:21.593643-07:00 cache-3 nginx[1201]: 203.122.197.251 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 9077 "-" "Go-http-client/1.1" 2026-10-09T13:16:21.634188-07:00 bastion nginx[1204]: 172.80.99.57 - - "GET /metrics HTTP/1.1" 302 82422 "-" "kube-probe/1.31" 2026-10-09T13:16:22.104059-07:00 edge-fr-1 sshd[27103]: Connection closed by 172.149.157.7 port 55721 [preauth] 2026-10-09T13:16:22.177601-07:00 db-replica kubelet[800]: E1009 13:16:22.177166 5956 pod_workers.go:5956] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-929eb2d3516725e3" 2026-10-09T13:16:22.256235-07:00 cache-3 app[30281]: INFO worker 18 picked job 2055ddad059b6d38 from queue invoices 2026-10-09T13:16:22.402958-07:00 edge-fr-1 sshd[36175]: Failed password for invalid user backup from 192.118.242.235 port 53579 ssh2 2026-10-09T13:16:22.471263-07:00 db-primary app[30991]: ERROR payment declined for order 81177: card_declined (code 84), customer notified 2026-10-09T13:16:22.497714-07:00 db-primary app[30557]: INFO worker 94 picked job 1c58df46b83b0725 from queue emails 2026-10-09T13:16:22.698790-07:00 edge-fr-1 app[30578]: INFO request_id=e3e67bb1cda51de6 method=GET path=/static/app.js status=200 duration=2050ms 2026-10-09T13:16:23.008065-07:00 web-02 nginx[1208]: 91.67.219.251 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 16481 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:23.056735-07:00 web-03 cron[19447]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:16:23.057812-07:00 bastion haproxy[928]: 10.100.217.25:51580 [11650] http-in app/web-01 8465/0/529/529/8465 200 69713 - - ---- 568/568/22/22/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:16:23.063926-07:00 api-08 nginx[1204]: 192.5.82.121 - - "GET /metrics HTTP/1.1" 200 54048 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:23.078637-07:00 db-primary postgres[16459]: LOG: duration: 9311.339 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:16:23.120038-07:00 api-07 postgres[20805]: LOG: duration: 2397.599 ms statement: SELECT * FROM orders WHERE customer_id = 72860 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:23.265182-07:00 web-03 nginx[1206]: 10.25.44.236 - - "GET /favicon.ico HTTP/1.1" 302 47072 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:23.277478-07:00 worker-12 nginx[1200]: 45.39.148.130 - akira "POST /api/v2/orders/8841 HTTP/1.1" 502 22553 "-" "curl/8.4.0" 2026-10-09T13:16:23.316472-07:00 web-03 app[30364]: INFO request_id=e3ff006927524554 method=GET path=/api/v2/users status=200 duration=859ms 2026-10-09T13:16:23.341511-07:00 db-primary kernel: [46579.312328] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.75.237.143 DST=10.0.757.757 LEN=70 TOS=0x00 PREC=0x00 TTL=70 ID=46579 DF PROTO=TCP SPT=36978 DPT=36978 WINDOW=46579 RES=0x00 SYN URGP=0 2026-10-09T13:16:23.394146-07:00 web-02 systemd[1]: Started Session 48405 of User backup. 2026-10-09T13:16:23.416997-07:00 worker-12 kubelet[800]: I1009 13:16:23.411805 5186 kubelet.go:5186] "Pod is terminating, skipping pod status update" pod="default/api-1e26ce3a5efa6ec1" 2026-10-09T13:16:23.546491-07:00 edge-fr-1 app[30425]: INFO health check ok: db 806 ms, cache 806 ms, queue depth 61 2026-10-09T13:16:23.789879-07:00 bastion nginx[1202]: 10.250.127.116 - - "GET /wp-login.php HTTP/1.1" 404 42282 "-" "Go-http-client/1.1" 2026-10-09T13:16:23.813355-07:00 edge-fr-1 haproxy[915]: 91.170.134.76:50871 [93805] http-in app/worker-12 532/0/662/662/532 302 22973 - - ---- 685/685/14/14/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:23.898418-07:00 web-02 nginx[1208]: 172.113.170.32 - - "GET /static/app.js HTTP/1.1" 200 23359 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:24.115247-07:00 bastion nginx[1208]: 203.4.188.159 - sørensen "POST /static/main.css HTTP/1.1" 200 69142 "-" "kube-probe/1.31" 2026-10-09T13:16:24.252978-07:00 web-01 app[30530]: INFO request_id=08d34cd265fa3582 method=GET path=/health status=500 duration=9168ms 2026-10-09T13:16:24.437223-07:00 edge-fr-1 haproxy[917]: 45.120.179.159:34151 [13378] http-in app/api-07 8425/0/594/594/8425 404 2756 - - ---- 301/301/84/84/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:16:24.618733-07:00 db-replica app[30959]: INFO request_id=89efacd199e8bd84 method=GET path=/static/app.js status=301 duration=1747ms 2026-10-09T13:16:24.956322-07:00 web-02 app[30434]: INFO worker 19 finished job eeca0c9f188d4856 in 5505 ms 2026-10-09T13:16:25.239022-07:00 db-replica app[30029]: INFO request_id=f81019560307aa55 method=GET path=/api/v2/users status=200 duration=589ms 2026-10-09T13:16:25.271773-07:00 bastion systemd[1]: Started Session 54980 of User backup. 2026-10-09T13:16:25.309706-07:00 web-02 nginx[1200]: 203.77.151.113 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 69100 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:25.443760-07:00 api-08 dockerd[700]: time="2026-10-09T13:16:25.443760-07:00" level=info msg="Container f09f9b2f9115ecc8 exited with code 0" 2026-10-09T13:16:25.444307-07:00 cache-3 sshd[51825]: Invalid user root from 192.174.183.212 port 51407 2026-10-09T13:16:26.086357-07:00 worker-12 nginx[1210]: 172.2.197.171 - ci "POST /api/v2/search?q=invoice HTTP/1.1" 200 80817 "-" "kube-probe/1.31" 2026-10-09T13:16:26.174775-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791576986.134:89230): pid=89230 uid=0 auid=3353 ses=656 msg='op=login id=3353 exe="/usr/sbin/sshd" hostname=? addr=45.205.194.55 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:26.297927-07:00 web-01 haproxy[942]: 45.30.18.232:12847 [84351] http-in app/db-primary 4769/0/885/885/4769 200 54529 - - ---- 860/860/98/98/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:16:26.314857-07:00 api-07 kernel: [52173.162780] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.136.59.162 DST=10.0.581.581 LEN=14 TOS=0x00 PREC=0x00 TTL=14 ID=52173 DF PROTO=TCP SPT=52660 DPT=52660 WINDOW=52173 RES=0x00 SYN URGP=0 2026-10-09T13:16:26.384232-07:00 cache-3 sshd[37842]: Received disconnect from 45.82.56.182 port 8238:11: Bye Bye [preauth] 2026-10-09T13:16:26.545095-07:00 bastion nginx[1208]: 192.191.0.58 - backup "POST /api/v2/orders HTTP/1.1" 200 88056 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:27.043866-07:00 db-replica haproxy[922]: 10.216.78.57:29499 [97836] http-in app/db-primary 4123/0/289/289/4123 200 75138 - - ---- 706/706/54/54/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:16:27.053586-07:00 db-replica postgres[14217]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 37050 remain, 8057 scanned (88% of total) 2026-10-09T13:16:27.068433-07:00 bastion systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:16:27.149071-07:00 cache-3 app[30027]: INFO worker 22 finished job 3fba0e3347eb3c1a in 2432 ms 2026-10-09T13:16:27.182020-07:00 db-primary nginx[1200]: 10.68.69.59 - - "GET /favicon.ico HTTP/1.1" 401 66466 "-" "Go-http-client/1.1" 2026-10-09T13:16:27.421418-07:00 bastion app[30592]: INFO request_id=93c3bf23517be5f8 method=GET path=/static/app.js status=301 duration=899ms 2026-10-09T13:16:27.568970-07:00 web-02 app[30291]: INFO health check ok: db 496 ms, cache 496 ms, queue depth 24 2026-10-09T13:16:27.586150-07:00 api-07 cron[35876]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:16:27.728366-07:00 api-08 app[30324]: INFO order 59476 confirmed for priya in 7964 ms (region ap-northeast-1, queue emails) 2026-10-09T13:16:27.749684-07:00 api-08 app[30159]: INFO request_id=422d21e6301e9ea5 method=GET path=/static/app.js status=200 duration=6753ms 2026-10-09T13:16:27.832281-07:00 web-01 app[30348]: INFO order 73872 confirmed for françois in 2612 ms (region us-east-1, queue invoices) 2026-10-09T13:16:27.983991-07:00 bastion nginx[1207]: 203.132.237.220 - - "GET /wp-login.php HTTP/1.1" 302 57422 "-" "curl/8.4.0" 2026-10-09T13:16:28.004764-07:00 db-replica nginx[1207]: 172.193.48.203 - - "GET /static/app.js HTTP/1.1" 200 41289 "-" "python-requests/2.32.3" 2026-10-09T13:16:28.051049-07:00 cache-3 haproxy[943]: 203.148.193.145:34737 [21540] http-in app/web-03 4853/0/957/957/4853 500 77757 - - ---- 641/641/22/22/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:16:28.092034-07:00 cache-3 nginx[1200]: 203.22.108.115 - - "GET /metrics HTTP/1.1" 200 71804 "-" "Go-http-client/1.1" 2026-10-09T13:16:28.170717-07:00 db-replica sshd[37516]: Failed password for invalid user zoë from 45.85.129.208 port 16301 ssh2 2026-10-09T13:16:28.209159-07:00 db-primary app[30820]: INFO order 42148 confirmed for akira in 6331 ms (region us-east-1, queue orders) 2026-10-09T13:16:28.226806-07:00 api-08 app[30419]: INFO health check ok: db 452 ms, cache 452 ms, queue depth 93 2026-10-09T13:16:28.252957-07:00 web-02 nginx[1204]: 203.66.10.219 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 24365 "-" "kube-probe/1.31" 2026-10-09T13:16:28.340764-07:00 web-02 sshd[22423]: Connection closed by 203.11.17.83 port 47086 [preauth] 2026-10-09T13:16:28.588090-07:00 db-primary nginx[1200]: 91.175.182.125 - - "GET /.env HTTP/1.1" 200 18050 "-" "curl/8.4.0" 2026-10-09T13:16:28.816388-07:00 edge-fr-1 haproxy[903]: Server app/worker-12 is DOWN, reason: Layer4 timeout, check duration: 8079ms. 43 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:16:28.959345-07:00 db-primary haproxy[917]: 10.50.150.190:54157 [36967] http-in app/web-03 6039/0/603/603/6039 502 27231 - - ---- 341/341/57/57/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:16:29.015198-07:00 web-02 haproxy[935]: 45.226.152.113:58742 [52711] http-in app/api-08 3535/0/977/977/3535 401 44993 - - ---- 889/889/97/97/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:29.255642-07:00 web-02 nginx[1202]: 172.92.89.34 - - "GET /static/app.js HTTP/1.1" 502 18590 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:29.259347-07:00 worker-12 app[30890]: INFO request_id=182e8a9c41df38c9 method=GET path=/.env status=200 duration=6918ms 2026-10-09T13:16:29.377367-07:00 worker-12 app[30747]: INFO request_id=2484d4418e5c30d6 method=GET path=/api/v2/orders status=404 duration=2730ms 2026-10-09T13:16:29.918385-07:00 web-03 app[30547]: INFO request_id=806a0ea3fee2a6bd method=GET path=/api/v2/orders/8841 status=404 duration=3453ms 2026-10-09T13:16:30.141831-07:00 web-01 app[30300]: INFO worker 79 finished job b8e0da01a7fe04b5 in 4854 ms 2026-10-09T13:16:30.345855-07:00 bastion nginx[1205]: 91.221.4.36 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 56845 "-" "kube-probe/1.31" 2026-10-09T13:16:30.397605-07:00 bastion nginx[1204]: 172.170.6.180 - - "GET /static/app.js HTTP/1.1" 500 54741 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:30.441852-07:00 api-08 nginx[1207]: 172.57.192.221 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 12961 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:30.492435-07:00 bastion postgres[24636]: LOG: duration: 6779.816 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:16:30.708728-07:00 edge-fr-1 app[30749]: INFO request_id=b2c79cd04ca2acbb method=GET path=/favicon.ico status=404 duration=7499ms 2026-10-09T13:16:31.092620-07:00 api-08 systemd[1]: session-40277.scope: Deactivated successfully. 2026-10-09T13:16:31.162623-07:00 db-primary app[30983]: INFO request_id=b6a50c56236e24ee method=GET path=/metrics status=401 duration=8988ms 2026-10-09T13:16:31.409926-07:00 web-01 app[30963]: INFO worker 70 finished job dd01bdecc8fcdc93 in 4992 ms 2026-10-09T13:16:31.426651-07:00 api-08 nginx[1209]: 91.208.218.14 - akira "POST /api/v2/orders HTTP/1.1" 502 46470 "-" "Go-http-client/1.1" 2026-10-09T13:16:31.698039-07:00 db-replica systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:16:31.924439-07:00 cache-3 app[30031]: WARN slow query (2497 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '94 minutes' 2026-10-09T13:16:31.946049-07:00 api-08 systemd[1]: session-82039.scope: Deactivated successfully. 2026-10-09T13:16:32.294481-07:00 db-replica nginx[1201]: 45.82.161.153 - - "GET /static/app.js HTTP/1.1" 200 35018 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:32.536362-07:00 api-08 nginx[1210]: 10.1.140.147 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 20197 "-" "Go-http-client/1.1" 2026-10-09T13:16:32.654028-07:00 cache-3 nginx[1210]: 172.154.118.132 - françois "POST /metrics HTTP/1.1" 200 40734 "-" "Go-http-client/1.1" 2026-10-09T13:16:33.017266-07:00 api-08 systemd[1]: Started Session 54186 of User zoë. 2026-10-09T13:16:33.043097-07:00 web-02 systemd[1]: session-68752.scope: Deactivated successfully. 2026-10-09T13:16:33.353618-07:00 web-03 cron[13806]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:16:33.434966-07:00 web-03 app[30455]: INFO worker 70 picked job 00fc0fb031fe2339 from queue webhooks 2026-10-09T13:16:33.477086-07:00 cache-3 app[30223]: INFO order 18411 confirmed for backup in 1294 ms (region ap-northeast-1, queue emails) 2026-10-09T13:16:33.626354-07:00 worker-12 app[30694]: INFO worker 53 picked job fe6a74b48ce5fb86 from queue emails 2026-10-09T13:16:33.712926-07:00 cache-3 app[30272]: INFO request_id=b7925e2f84e9503b method=GET path=/static/app.js status=200 duration=9560ms 2026-10-09T13:16:34.109011-07:00 worker-12 sshd[2936]: Connection closed by 203.230.35.149 port 8000 [preauth] 2026-10-09T13:16:34.326640-07:00 db-primary haproxy[921]: 192.96.216.29:1327 [74847] http-in app/web-01 2150/0/132/132/2150 302 88492 - - ---- 486/486/56/56/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:16:34.384397-07:00 api-07 app[30056]: INFO request_id=ec481ecea050c642 method=GET path=/api/v2/orders/8841 status=401 duration=2518ms 2026-10-09T13:16:34.746902-07:00 web-03 app[30819]: INFO request_id=89a815083a298a2c method=GET path=/static/main.css status=404 duration=583ms 2026-10-09T13:16:34.928940-07:00 worker-12 haproxy[916]: 172.250.22.203:9198 [74924] http-in app/api-07 9422/0/516/516/9422 204 34961 - - ---- 713/713/37/37/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:16:34.937920-07:00 web-01 app[30866]: INFO request_id=a232c56ad7368a71 method=GET path=/admin status=200 duration=5411ms 2026-10-09T13:16:35.002865-07:00 db-primary app[30556]: INFO request_id=a8a0dba50c13d21e method=GET path=/admin status=404 duration=7080ms 2026-10-09T13:16:35.094910-07:00 db-primary app[30389]: INFO worker 71 picked job 9ed60c22f24d568d from queue invoices 2026-10-09T13:16:35.215011-07:00 cache-3 haproxy[933]: 192.94.172.214:25417 [75144] http-in app/worker-12 1408/0/517/517/1408 204 4943 - - ---- 577/577/17/17/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:16:35.240850-07:00 web-03 nginx[1206]: 203.254.16.241 - - "GET /metrics HTTP/1.1" 200 44625 "-" "curl/8.4.0" 2026-10-09T13:16:35.246678-07:00 bastion sshd[18963]: Failed password for invalid user zoë from 192.14.141.37 port 38110 ssh2 2026-10-09T13:16:35.471685-07:00 api-08 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:16:35.520645-07:00 api-08 sshd[53848]: Accepted publickey for françois from 45.220.168.138 port 51908 ssh2: ED25519 SHA256:55bc1c3ee90ea065 2026-10-09T13:16:35.537737-07:00 db-replica haproxy[904]: 172.17.229.194:40995 [25476] http-in app/web-03 3378/0/211/211/3378 200 54888 - - ---- 355/355/69/69/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:16:35.561618-07:00 db-replica kernel: [10498.446043] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.62.192.78 DST=10.0.948.948 LEN=62 TOS=0x00 PREC=0x00 TTL=62 ID=10498 DF PROTO=TCP SPT=12681 DPT=12681 WINDOW=10498 RES=0x00 SYN URGP=0 2026-10-09T13:16:35.610805-07:00 db-replica cron[35757]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:16:35.669438-07:00 db-primary app[30744]: INFO worker 76 finished job d63e59ca4866de8a in 7990 ms 2026-10-09T13:16:35.813347-07:00 edge-fr-1 haproxy[936]: 91.191.18.180:40109 [58818] http-in app/cache-3 6060/0/344/344/6060 200 84271 - - ---- 509/509/21/21/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:16:35.880465-07:00 api-08 nginx[1202]: 45.239.195.82 - - "GET /metrics HTTP/1.1" 502 87769 "-" "curl/8.4.0" 2026-10-09T13:16:36.058663-07:00 web-02 kernel: [61298.612248] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.217.82.21 DST=10.0.193.193 LEN=98 TOS=0x00 PREC=0x00 TTL=98 ID=61298 DF PROTO=TCP SPT=48371 DPT=48371 WINDOW=61298 RES=0x00 SYN URGP=0 2026-10-09T13:16:36.121679-07:00 bastion app[30972]: INFO request_id=5cc1d7dee5de0e05 method=GET path=/api/v2/search?q=invoice status=302 duration=2203ms 2026-10-09T13:16:36.159950-07:00 api-08 nginx[1209]: 45.75.193.187 - - "GET /metrics HTTP/1.1" 302 3473 "-" "kube-probe/1.31" 2026-10-09T13:16:36.433935-07:00 api-08 app[30624]: INFO worker 21 picked job ed399b419069e75f from queue emails 2026-10-09T13:16:36.511215-07:00 bastion nginx[1204]: 172.24.253.180 - - "GET /static/app.js HTTP/1.1" 200 63755 "-" "Go-http-client/1.1" 2026-10-09T13:16:36.782688-07:00 web-03 sshd[63761]: Accepted publickey for sørensen from 91.33.106.26 port 3721 ssh2: ED25519 SHA256:e72b65d4f589f485 2026-10-09T13:16:36.816015-07:00 api-08 app[30469]: INFO request_id=313c7f2606934254 method=GET path=/static/app.js status=500 duration=7426ms 2026-10-09T13:16:36.907708-07:00 api-07 nginx[1203]: 45.215.143.214 - - "GET /admin HTTP/1.1" 404 12753 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:37.032605-07:00 db-primary app[30884]: INFO order 29588 confirmed for akira in 7729 ms (region eu-west-1, queue invoices) 2026-10-09T13:16:37.280677-07:00 web-02 app[30002]: INFO worker 59 finished job dfd0de55fa0ec7af in 7089 ms 2026-10-09T13:16:37.305925-07:00 worker-12 sshd[31206]: Received disconnect from 10.129.42.85 port 14143:11: Bye Bye [preauth] 2026-10-09T13:16:37.472311-07:00 worker-12 nginx[1208]: 10.145.172.15 - - "GET /api/v2/orders HTTP/1.1" 200 33087 "-" "kube-probe/1.31" 2026-10-09T13:16:37.656205-07:00 db-primary app[30781]: INFO request_id=65b12a717fd60aef method=GET path=/login status=502 duration=1604ms 2026-10-09T13:16:37.665700-07:00 db-primary nginx[1208]: 192.137.108.12 - - "GET /.env HTTP/1.1" 200 55823 "-" "python-requests/2.32.3" 2026-10-09T13:16:37.719429-07:00 web-01 app[30499]: INFO health check ok: db 345 ms, cache 345 ms, queue depth 51 2026-10-09T13:16:37.768696-07:00 api-07 haproxy[906]: 192.8.150.160:57489 [38537] http-in app/worker-12 3567/0/603/603/3567 301 68194 - - ---- 388/388/22/22/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:16:37.787311-07:00 web-01 sshd[26981]: Connection closed by 91.55.253.170 port 16528 [preauth] 2026-10-09T13:16:38.119484-07:00 web-01 nginx[1210]: 45.117.249.65 - - "GET /metrics HTTP/1.1" 204 43737 "-" "python-requests/2.32.3" 2026-10-09T13:16:38.231275-07:00 bastion nginx[1204]: 45.165.34.159 - - "GET /metrics HTTP/1.1" 404 22505 "-" "Go-http-client/1.1" 2026-10-09T13:16:38.291010-07:00 db-replica haproxy[939]: 203.64.248.52:41251 [42644] http-in app/web-03 8249/0/676/676/8249 404 33117 - - ---- 712/712/92/92/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:16:38.339796-07:00 bastion nginx[1210]: 203.165.150.160 - root "POST /admin HTTP/1.1" 200 53555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:38.343336-07:00 worker-12 haproxy[910]: 10.78.30.100:46292 [59264] http-in app/web-02 2161/0/460/460/2161 502 5700 - - ---- 728/728/27/27/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:16:38.586570-07:00 web-01 systemd[1]: Started Session 44498 of User deploy. 2026-10-09T13:16:38.798699-07:00 edge-fr-1 nginx[1208]: 45.206.18.97 - deploy "POST /api/v2/users HTTP/1.1" 404 31265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:38.900563-07:00 edge-fr-1 app[30999]: INFO request_id=c7a0fb7b3bb2337a method=GET path=/api/v2/users status=500 duration=9344ms 2026-10-09T13:16:39.470332-07:00 web-03 app[30979]: INFO worker 55 picked job f3d545d83e64c71d from queue webhooks 2026-10-09T13:16:39.521936-07:00 web-03 app[30803]: INFO worker 81 finished job d24e1134ec1720c9 in 3183 ms 2026-10-09T13:16:39.620691-07:00 web-03 postgres[4711]: LOG: duration: 2434.668 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:16:39.667657-07:00 api-08 nginx[1201]: 91.176.217.115 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 46234 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:39.758292-07:00 api-07 app[30009]: INFO request_id=893f063911893b10 method=GET path=/health status=301 duration=6531ms 2026-10-09T13:16:39.943035-07:00 api-08 sshd[5736]: Connection closed by 10.244.176.171 port 27951 [preauth] 2026-10-09T13:16:39.973167-07:00 web-01 haproxy[908]: 91.94.206.8:7550 [25262] http-in app/api-08 1094/0/702/702/1094 500 26066 - - ---- 433/433/62/62/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:16:40.108277-07:00 db-replica app[30140]: INFO worker 81 finished job 8a76e71b3d61fb41 in 8521 ms 2026-10-09T13:16:40.445086-07:00 db-primary postgres[2871]: LOG: checkpoint complete: wrote 3089 buffers (70%); 0 WAL file(s) added, 0 removed, 81 recycled; write=2743.336 s, sync=0.336 s, total=2743.336 s 2026-10-09T13:16:40.561710-07:00 bastion haproxy[944]: 45.3.163.7:5941 [73268] http-in app/cache-3 9468/0/281/281/9468 302 43756 - - ---- 581/581/18/18/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:16:40.799094-07:00 web-01 nginx[1210]: 203.152.15.25 - - "GET /favicon.ico HTTP/1.1" 500 63206 "-" "curl/8.4.0" 2026-10-09T13:16:40.985697-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577000.286:89764): pid=89764 uid=0 auid=6023 ses=171 msg='op=login id=6023 exe="/usr/sbin/sshd" hostname=? addr=203.57.84.246 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:41.217363-07:00 api-08 nginx[1203]: 91.211.249.23 - - "GET /login HTTP/1.1" 404 44792 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:41.400925-07:00 web-01 sshd[14950]: Accepted publickey for sørensen from 192.246.219.86 port 22204 ssh2: ED25519 SHA256:63d0d6a0d1ce4e9f 2026-10-09T13:16:41.406144-07:00 db-replica sshd[54128]: Connection closed by 203.96.219.164 port 31705 [preauth] 2026-10-09T13:16:41.618342-07:00 cache-3 app[30587]: INFO order 69558 confirmed for priya in 6630 ms (region eu-west-1, queue webhooks) 2026-10-09T13:16:42.012641-07:00 api-07 haproxy[930]: 203.134.29.178:39099 [99675] http-in app/db-replica 2726/0/235/235/2726 200 3806 - - ---- 508/508/46/46/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:16:42.318762-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577002.54:48279): pid=48279 uid=0 auid=5759 ses=938 msg='op=login id=5759 exe="/usr/sbin/sshd" hostname=? addr=10.28.70.66 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:42.402861-07:00 edge-fr-1 haproxy[935]: 10.104.81.38:26735 [68894] http-in app/web-03 6965/0/233/233/6965 404 61577 - - ---- 541/541/68/68/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:16:42.459854-07:00 edge-fr-1 app[30441]: INFO order 86108 confirmed for sørensen in 3363 ms (region ap-northeast-1, queue emails) 2026-10-09T13:16:42.467176-07:00 web-02 app[30075]: INFO worker 68 finished job 1a2a7c26ed09f829 in 8904 ms 2026-10-09T13:16:42.581687-07:00 web-01 sshd[56568]: Connection closed by 192.26.235.215 port 59923 [preauth] 2026-10-09T13:16:42.852290-07:00 db-replica nginx[1201]: 91.225.99.168 - - "GET /api/v2/orders HTTP/1.1" 200 19157 "-" "python-requests/2.32.3" 2026-10-09T13:16:42.978172-07:00 edge-fr-1 app[30650]: ERROR payment declined for order 27685: card_declined (code 71), customer notified 2026-10-09T13:16:43.003897-07:00 edge-fr-1 kernel: [17557.284697] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.7.0.239 DST=10.0.782.782 LEN=94 TOS=0x00 PREC=0x00 TTL=94 ID=17557 DF PROTO=TCP SPT=23145 DPT=23145 WINDOW=17557 RES=0x00 SYN URGP=0 2026-10-09T13:16:43.022002-07:00 api-08 app[30489]: INFO order 12894 confirmed for zoë in 2455 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:16:43.200983-07:00 web-03 app[30904]: INFO health check ok: db 342 ms, cache 342 ms, queue depth 54 2026-10-09T13:16:43.244185-07:00 web-02 sshd[9896]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:16:43.471470-07:00 api-08 app[30659]: INFO request_id=078869e910ec9255 method=GET path=/wp-login.php status=404 duration=2025ms 2026-10-09T13:16:43.609810-07:00 web-03 app[30326]: INFO worker 38 finished job 6fc71e0ed40fac61 in 9254 ms 2026-10-09T13:16:43.616128-07:00 db-replica nginx[1209]: 203.1.87.61 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 42544 "-" "kube-probe/1.31" 2026-10-09T13:16:43.727192-07:00 web-03 app[30136]: INFO worker 39 finished job 889dfef4bb9e52d7 in 1919 ms 2026-10-09T13:16:43.814890-07:00 web-01 nginx[1204]: 45.67.206.74 - - "GET /wp-login.php HTTP/1.1" 404 71266 "-" "Go-http-client/1.1" 2026-10-09T13:16:43.824816-07:00 db-primary nginx[1201]: 10.171.116.74 - - "GET /health HTTP/1.1" 200 36372 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:43.869776-07:00 api-07 app[30251]: INFO order 77664 confirmed for root in 3837 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:16:43.944105-07:00 cache-3 nginx[1201]: 192.176.95.132 - - "GET /admin HTTP/1.1" 404 29277 "-" "curl/8.4.0" 2026-10-09T13:16:43.984908-07:00 cache-3 sshd[56440]: Connection closed by 45.162.214.77 port 32678 [preauth] 2026-10-09T13:16:43.986000-07:00 bastion postgres[15245]: LOG: duration: 2523.636 ms statement: SELECT * FROM orders WHERE customer_id = 34031 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:44.139223-07:00 api-08 app[30929]: INFO order 43564 confirmed for akira in 5182 ms (region eu-west-1, queue invoices) 2026-10-09T13:16:44.161244-07:00 db-replica nginx[1210]: 45.240.209.232 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 2237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:44.212528-07:00 worker-12 nginx[1207]: 203.52.74.176 - müller "POST /health HTTP/1.1" 204 41268 "-" "Go-http-client/1.1" 2026-10-09T13:16:44.383346-07:00 api-08 sshd[6005]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:16:44.608059-07:00 web-01 sshd[19896]: Invalid user müller from 91.149.142.243 port 19597 2026-10-09T13:16:44.766040-07:00 bastion app[30374]: INFO request_id=3f749c32e7e2db04 method=GET path=/favicon.ico status=200 duration=2662ms 2026-10-09T13:16:45.390412-07:00 api-08 postgres[4848]: LOG: duration: 1174.900 ms statement: SELECT * FROM orders WHERE customer_id = 69759 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:45.421017-07:00 cache-3 sshd[57232]: Invalid user root from 192.186.127.96 port 44258 2026-10-09T13:16:45.500443-07:00 edge-fr-1 nginx[1204]: 172.185.108.218 - - "GET /health HTTP/1.1" 204 45598 "-" "Go-http-client/1.1" 2026-10-09T13:16:45.579048-07:00 web-01 sshd[43291]: pam_unix(sshd:session): session opened for user priya(uid=7295) by (uid=0) 2026-10-09T13:16:45.799871-07:00 api-08 nginx[1209]: 172.165.23.116 - backup "POST /.env HTTP/1.1" 200 33587 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:16:45.810716-07:00 web-03 app[30962]: INFO request_id=8561a1a185d314b4 method=GET path=/wp-login.php status=302 duration=3333ms 2026-10-09T13:16:45.837541-07:00 worker-12 nginx[1208]: 10.180.185.89 - ci "POST /static/app.js HTTP/1.1" 502 488 "-" "python-requests/2.32.3" 2026-10-09T13:16:45.876646-07:00 web-03 nginx[1206]: 172.248.72.177 - - "GET /favicon.ico HTTP/1.1" 404 24460 "-" "kube-probe/1.31" 2026-10-09T13:16:45.930294-07:00 web-02 app[30112]: INFO order 45929 confirmed for root in 8897 ms (region eu-west-1, queue invoices) 2026-10-09T13:16:46.095629-07:00 cache-3 kernel: [78079.760611] TCP: request_sock_TCP: Possible SYN flooding on port 7367. Sending cookies. Check SNMP counters. 2026-10-09T13:16:46.194100-07:00 web-01 postgres[18794]: LOG: duration: 5240.857 ms statement: SELECT * FROM orders WHERE customer_id = 72518 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:46.265278-07:00 db-replica nginx[1201]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 45.22.136.99, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.717.717:8080/metrics" 2026-10-09T13:16:46.370014-07:00 db-replica cron[45909]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:16:46.408468-07:00 web-03 app[30621]: INFO order 92378 confirmed for ci in 1142 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:16:46.419109-07:00 db-replica app[30991]: INFO order 51365 confirmed for françois in 5886 ms (region ap-northeast-1, queue orders) 2026-10-09T13:16:46.433483-07:00 db-replica systemd[1]: session-55043.scope: Deactivated successfully. 2026-10-09T13:16:46.517533-07:00 edge-fr-1 app[30658]: INFO order 73546 confirmed for müller in 2018 ms (region us-east-1, queue orders) 2026-10-09T13:16:46.620721-07:00 bastion nginx[1203]: 91.47.32.110 - - "GET /api/v2/users HTTP/1.1" 404 65697 "-" "Go-http-client/1.1" 2026-10-09T13:16:46.670924-07:00 bastion nginx[1208]: 45.15.229.230 - deploy "POST /wp-login.php HTTP/1.1" 401 45556 "-" "python-requests/2.32.3" 2026-10-09T13:16:47.096694-07:00 db-replica postgres[15887]: LOG: duration: 1482.202 ms statement: SELECT * FROM orders WHERE customer_id = 57656 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:47.384083-07:00 web-03 haproxy[924]: 203.196.216.60:59970 [44784] http-in app/edge-fr-1 9971/0/882/882/9971 401 44397 - - ---- 658/658/92/92/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:16:47.407536-07:00 bastion sshd[24090]: Failed password for invalid user backup from 192.134.29.183 port 15532 ssh2 2026-10-09T13:16:47.511258-07:00 web-01 nginx[1206]: 172.112.86.42 - françois "POST /static/main.css HTTP/1.1" 200 10815 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:47.663555-07:00 db-replica app[30474]: DEBUG cache hit ratio 6% over the last minute (77745 lookups) 2026-10-09T13:16:47.837513-07:00 web-03 app[30240]: WARN slow query (3269 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '10 minutes' 2026-10-09T13:16:47.982439-07:00 web-03 nginx[1205]: 10.102.166.233 - - "GET /static/app.js HTTP/1.1" 200 2651 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:48.189954-07:00 web-02 haproxy[908]: 45.169.147.192:17810 [53372] http-in app/db-replica 6624/0/665/665/6624 401 15317 - - ---- 894/894/30/30/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:16:48.249326-07:00 bastion nginx[1209]: 192.75.48.13 - - "GET /api/v2/users HTTP/1.1" 401 88042 "-" "curl/8.4.0" 2026-10-09T13:16:48.512062-07:00 db-replica nginx[1205]: 172.44.159.160 - - "GET /health HTTP/1.1" 200 89230 "-" "curl/8.4.0" 2026-10-09T13:16:48.587366-07:00 web-03 systemd[1]: session-85611.scope: Deactivated successfully. 2026-10-09T13:16:48.683623-07:00 edge-fr-1 nginx[1203]: 91.255.248.49 - - "GET /.env HTTP/1.1" 200 58900 "-" "python-requests/2.32.3" 2026-10-09T13:16:48.717357-07:00 web-03 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:16:48.812948-07:00 edge-fr-1 app[30698]: INFO worker 11 finished job a4129802528d2401 in 2879 ms 2026-10-09T13:16:48.821366-07:00 web-03 nginx[1209]: 172.249.29.56 - - "GET /health HTTP/1.1" 301 8365 "-" "kube-probe/1.31" 2026-10-09T13:16:48.856279-07:00 api-07 nginx[1208]: 91.13.54.188 - - "GET /.env HTTP/1.1" 200 48868 "-" "Go-http-client/1.1" 2026-10-09T13:16:48.917173-07:00 bastion postgres[27035]: LOG: duration: 8685.564 ms statement: SELECT * FROM orders WHERE customer_id = 24023 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:49.004485-07:00 cache-3 app[30913]: INFO worker 55 picked job 5c4a89aa6b6ca635 from queue orders 2026-10-09T13:16:49.028719-07:00 api-08 systemd[1]: Started Session 69866 of User sørensen. 2026-10-09T13:16:49.281971-07:00 worker-12 app[30444]: INFO worker 74 finished job 30a3996d212ca91b in 4310 ms 2026-10-09T13:16:49.286353-07:00 bastion nginx[1210]: 203.220.111.54 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 48079 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:49.638965-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577009.600:87556): pid=87556 uid=0 auid=7346 ses=857 msg='op=login id=7346 exe="/usr/sbin/sshd" hostname=? addr=45.205.234.223 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:50.047965-07:00 edge-fr-1 nginx[1207]: 10.81.91.232 - - "GET /.env HTTP/1.1" 200 80781 "-" "python-requests/2.32.3" 2026-10-09T13:16:50.363653-07:00 web-02 kernel: [94769.109273] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.27.40.115 DST=10.0.882.882 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=94769 DF PROTO=TCP SPT=19316 DPT=19316 WINDOW=94769 RES=0x00 SYN URGP=0 2026-10-09T13:16:50.427722-07:00 web-02 app[30238]: INFO worker 54 picked job cdc3bfd5df75e0ce from queue webhooks 2026-10-09T13:16:50.783355-07:00 db-replica nginx[1204]: 91.128.72.162 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 41192 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:50.921801-07:00 web-02 systemd[1]: Started Session 63855 of User zoë. 2026-10-09T13:16:51.124649-07:00 edge-fr-1 app[30579]: INFO health check ok: db 200 ms, cache 200 ms, queue depth 79 2026-10-09T13:16:51.153573-07:00 db-primary postgres[30140]: LOG: duration: 1003.961 ms statement: SELECT * FROM orders WHERE customer_id = 26436 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:51.201465-07:00 db-replica app[30545]: INFO worker 98 finished job 1bf7e5d8c1ce302c in 1057 ms 2026-10-09T13:16:51.333132-07:00 edge-fr-1 nginx[1209]: 45.234.107.83 - - "GET /static/main.css HTTP/1.1" 404 67949 "-" "kube-probe/1.31" 2026-10-09T13:16:51.461061-07:00 api-08 kubelet[800]: I1009 13:16:51.330694 4110 kubelet.go:4110] "Pod is terminating, skipping pod status update" pod="default/api-0be522a9f2ed4191" 2026-10-09T13:16:51.624976-07:00 db-replica haproxy[915]: 10.216.23.115:38668 [56606] http-in app/api-07 1808/0/742/742/1808 404 81269 - - ---- 313/313/26/26/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:16:51.690912-07:00 web-02 app[30068]: INFO order 46533 confirmed for müller in 1929 ms (region eu-west-1, queue webhooks) 2026-10-09T13:16:51.696600-07:00 db-replica nginx[1207]: 10.186.246.24 - - "GET /static/main.css HTTP/1.1" 404 37859 "-" "curl/8.4.0" 2026-10-09T13:16:51.741323-07:00 api-08 app[30745]: INFO health check ok: db 375 ms, cache 375 ms, queue depth 89 2026-10-09T13:16:51.847052-07:00 web-01 app[30806]: INFO worker 71 finished job ea8530a250c5dd41 in 9543 ms 2026-10-09T13:16:51.865497-07:00 api-08 app[30678]: INFO worker 34 finished job 6921cbb2443f510e in 6076 ms 2026-10-09T13:16:51.898551-07:00 db-primary sshd[53488]: pam_unix(sshd:session): session opened for user zoë(uid=9565) by (uid=0) 2026-10-09T13:16:52.174609-07:00 worker-12 sshd[48682]: Invalid user müller from 91.15.145.194 port 64749 2026-10-09T13:16:52.321047-07:00 worker-12 sshd[30895]: Accepted publickey for priya from 91.109.108.199 port 13711 ssh2: ED25519 SHA256:624e31b945c38d07 2026-10-09T13:16:52.544959-07:00 edge-fr-1 nginx[1209]: 203.179.133.118 - root "POST /wp-login.php HTTP/1.1" 404 43937 "-" "Go-http-client/1.1" 2026-10-09T13:16:52.709115-07:00 web-01 sshd[26332]: Connection closed by 203.175.133.24 port 42682 [preauth] 2026-10-09T13:16:52.858815-07:00 cache-3 dockerd[700]: time="2026-10-09T13:16:52.858815-07:00" level=info msg="Container 775d4924bdf91d00 exited with code 0" 2026-10-09T13:16:52.908765-07:00 web-01 kernel: [98603.133757] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.137.236.190 DST=10.0.397.397 LEN=84 TOS=0x00 PREC=0x00 TTL=84 ID=98603 DF PROTO=TCP SPT=62335 DPT=62335 WINDOW=98603 RES=0x00 SYN URGP=0 2026-10-09T13:16:52.919958-07:00 bastion app[30671]: INFO order 74416 confirmed for akira in 4078 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:16:53.117945-07:00 bastion haproxy[947]: 192.127.213.116:14908 [29666] http-in app/db-replica 7086/0/824/824/7086 502 84515 - - ---- 325/325/62/62/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:16:53.199893-07:00 worker-12 app[30844]: INFO worker 64 picked job 068db3e915fdff44 from queue emails 2026-10-09T13:16:53.277285-07:00 web-03 systemd[1]: Started Session 80027 of User akira. 2026-10-09T13:16:53.336287-07:00 db-primary systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:16:53.360093-07:00 web-01 app[30171]: INFO order 43166 confirmed for root in 3723 ms (region us-east-1, queue webhooks) 2026-10-09T13:16:53.524052-07:00 worker-12 app[30749]: INFO worker 38 picked job e0e88501d130a49e from queue webhooks 2026-10-09T13:16:53.584764-07:00 worker-12 haproxy[912]: 91.190.238.140:8536 [47726] http-in app/cache-3 6276/0/551/551/6276 302 77781 - - ---- 657/657/69/69/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:16:53.681315-07:00 bastion app[30587]: INFO worker 78 finished job c7c8cf214d13e2f3 in 7386 ms 2026-10-09T13:16:53.717568-07:00 web-01 nginx[1203]: 172.41.54.127 - - "GET /static/app.js HTTP/1.1" 404 8211 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:53.780888-07:00 db-replica cron[16516]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:16:53.855462-07:00 bastion app[30255]: DEBUG cache hit ratio 35% over the last minute (80941 lookups) 2026-10-09T13:16:53.959433-07:00 api-08 nginx[1205]: 10.245.25.121 - - "GET /api/v2/users HTTP/1.1" 200 61131 "-" "Go-http-client/1.1" 2026-10-09T13:16:54.087328-07:00 cache-3 nginx[1207]: 10.215.119.140 - - "GET /wp-login.php HTTP/1.1" 404 34818 "-" "python-requests/2.32.3" 2026-10-09T13:16:54.305103-07:00 edge-fr-1 kernel: [19638.515859] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.26.144.14 DST=10.0.511.511 LEN=70 TOS=0x00 PREC=0x00 TTL=70 ID=19638 DF PROTO=TCP SPT=55741 DPT=55741 WINDOW=19638 RES=0x00 SYN URGP=0 2026-10-09T13:16:54.413544-07:00 web-03 app[30531]: INFO order 61557 confirmed for zoë in 1764 ms (region eu-west-1, queue invoices) 2026-10-09T13:16:54.486070-07:00 web-03 app[30099]: INFO order 75814 confirmed for müller in 6659 ms (region us-east-1, queue webhooks) 2026-10-09T13:16:54.609216-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577014.631:94167): pid=94167 uid=0 auid=8832 ses=266 msg='op=login id=8832 exe="/usr/sbin/sshd" hostname=? addr=203.176.121.212 terminal=/dev/pts/0 res=success' 2026-10-09T13:16:54.616330-07:00 web-02 app[30546]: INFO request_id=89aa8ddd5b6dc726 method=GET path=/static/main.css status=301 duration=798ms 2026-10-09T13:16:54.838854-07:00 web-03 app[30280]: INFO request_id=4b2509d66450df5b method=GET path=/admin status=204 duration=6678ms 2026-10-09T13:16:54.949793-07:00 worker-12 systemd[1]: Started Session 11814 of User root. 2026-10-09T13:16:55.378261-07:00 web-03 systemd[1]: Started Session 95269 of User akira. 2026-10-09T13:16:55.513140-07:00 web-01 app[30909]: INFO worker 88 picked job 63d20c2300a56824 from queue emails 2026-10-09T13:16:55.530685-07:00 db-primary app[30616]: INFO request_id=de13f80ae5638e68 method=GET path=/api/v2/search?q=invoice status=301 duration=4585ms 2026-10-09T13:16:55.537187-07:00 edge-fr-1 app[30490]: INFO request_id=6591cf65d82185ec method=GET path=/static/app.js status=200 duration=7309ms 2026-10-09T13:16:55.726006-07:00 bastion app[30899]: INFO worker 57 finished job 2c0478551cfb0016 in 1732 ms 2026-10-09T13:16:55.728328-07:00 worker-12 systemd[1]: session-56819.scope: Deactivated successfully. 2026-10-09T13:16:55.744552-07:00 bastion sshd[10154]: Invalid user müller from 172.43.10.13 port 52040 2026-10-09T13:16:55.823786-07:00 edge-fr-1 app[30487]: INFO request_id=ebbd20a724bf60ed method=GET path=/favicon.ico status=404 duration=1411ms 2026-10-09T13:16:55.892380-07:00 web-03 app[30569]: INFO worker 83 finished job 70228f39d7adbfb1 in 234 ms 2026-10-09T13:16:55.918531-07:00 db-primary app[30855]: INFO worker 82 finished job 3227747654e3fa3f in 7347 ms 2026-10-09T13:16:55.990884-07:00 edge-fr-1 kernel: [61308.433911] TCP: request_sock_TCP: Possible SYN flooding on port 42812. Sending cookies. Check SNMP counters. 2026-10-09T13:16:56.016564-07:00 bastion sshd[16228]: Connection closed by 172.180.139.19 port 62862 [preauth] 2026-10-09T13:16:56.232446-07:00 api-08 app[30334]: INFO worker 97 picked job e84ba5e155e0e4ed from queue orders 2026-10-09T13:16:56.296238-07:00 api-08 app[30831]: INFO request_id=037c6635e426303e method=GET path=/static/app.js status=200 duration=343ms 2026-10-09T13:16:56.313507-07:00 api-07 postgres[3499]: LOG: checkpoint complete: wrote 8613 buffers (37%); 0 WAL file(s) added, 0 removed, 45 recycled; write=4134.500 s, sync=0.500 s, total=4134.500 s 2026-10-09T13:16:56.403971-07:00 db-replica sshd[17367]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:16:56.447951-07:00 edge-fr-1 nginx[1209]: 45.225.59.17 - - "GET /login HTTP/1.1" 200 83735 "-" "curl/8.4.0" 2026-10-09T13:16:56.552769-07:00 edge-fr-1 postgres[11632]: LOG: duration: 3862.534 ms statement: SELECT * FROM orders WHERE customer_id = 61040 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:56.555142-07:00 api-08 app[30606]: WARN slow query (8704 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '48 minutes' 2026-10-09T13:16:57.160625-07:00 api-07 app[30766]: ERROR cache miss storm: 8452 misses in 3634 ms, key prefix session:priya 2026-10-09T13:16:57.229540-07:00 db-replica postgres[28674]: LOG: duration: 7951.840 ms statement: SELECT * FROM orders WHERE customer_id = 58975 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:16:57.246466-07:00 api-07 nginx[1202]: 172.184.195.105 - root "POST /health HTTP/1.1" 200 28197 "-" "python-requests/2.32.3" 2026-10-09T13:16:57.256921-07:00 cache-3 nginx[1210]: 10.200.176.36 - - "GET /api/v2/users HTTP/1.1" 200 76570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:16:57.291617-07:00 api-07 sshd[9039]: Invalid user zoë from 45.47.185.71 port 29537 2026-10-09T13:16:57.440002-07:00 web-01 nginx[1210]: 192.252.31.209 - ci "POST /health HTTP/1.1" 500 37584 "-" "python-requests/2.32.3" 2026-10-09T13:16:57.696739-07:00 web-02 nginx[1202]: 45.191.191.143 - - "GET /metrics HTTP/1.1" 200 31228 "-" "curl/8.4.0" 2026-10-09T13:16:57.944521-07:00 worker-12 kernel: [52981.816039] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.196.234.95 DST=10.0.776.776 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=52981 DF PROTO=TCP SPT=60487 DPT=60487 WINDOW=52981 RES=0x00 SYN URGP=0 2026-10-09T13:16:57.949876-07:00 api-08 nginx[1201]: 172.138.176.211 - akira "POST /static/app.js HTTP/1.1" 200 72202 "-" "kube-probe/1.31" 2026-10-09T13:16:58.022547-07:00 worker-12 app[30283]: INFO request_id=75907bf18e7783b4 method=GET path=/metrics status=502 duration=2556ms 2026-10-09T13:16:58.135742-07:00 db-primary postgres[2261]: LOG: duration: 9339.871 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:16:58.242065-07:00 api-07 app[30898]: INFO request_id=cd7aa4af9049e794 method=GET path=/health status=200 duration=3864ms 2026-10-09T13:16:58.323780-07:00 cache-3 nginx[1208]: 192.51.151.73 - - "GET /login HTTP/1.1" 200 77503 "-" "Go-http-client/1.1" 2026-10-09T13:16:58.341000-07:00 worker-12 sshd[58608]: Received disconnect from 10.202.220.191 port 45481:11: Bye Bye [preauth] 2026-10-09T13:16:58.391675-07:00 worker-12 app[30047]: INFO order 75972 confirmed for sørensen in 9250 ms (region eu-west-1, queue invoices) 2026-10-09T13:16:58.440508-07:00 worker-12 kernel: [61563.276388] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.235.184.154 DST=10.0.178.178 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=61563 DF PROTO=TCP SPT=2682 DPT=2682 WINDOW=61563 RES=0x00 SYN URGP=0 2026-10-09T13:16:58.640516-07:00 db-replica sshd[39260]: Connection closed by 203.63.66.114 port 58069 [preauth] 2026-10-09T13:16:58.692743-07:00 api-08 haproxy[937]: 172.141.188.120:12891 [57616] http-in app/worker-12 2042/0/440/440/2042 502 25476 - - ---- 602/602/30/30/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:16:58.767278-07:00 web-01 nginx[1210]: 172.119.12.20 - priya "POST /api/v2/orders HTTP/1.1" 404 72288 "-" "Go-http-client/1.1" 2026-10-09T13:16:58.861118-07:00 api-08 sshd[35052]: Failed password for invalid user deploy from 10.121.11.134 port 43194 ssh2 2026-10-09T13:16:58.935546-07:00 edge-fr-1 systemd[1]: session-79635.scope: Deactivated successfully. 2026-10-09T13:16:58.941562-07:00 web-02 haproxy[907]: 10.159.38.165:34620 [93143] http-in app/worker-12 4823/0/754/754/4823 200 68494 - - ---- 214/214/80/80/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:16:58.990913-07:00 api-08 sshd[16343]: Failed password for invalid user sørensen from 45.153.85.96 port 53215 ssh2 2026-10-09T13:16:58.994227-07:00 bastion nginx[1210]: 45.115.62.59 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 22335 "-" "python-requests/2.32.3" 2026-10-09T13:16:59.030061-07:00 db-replica haproxy[947]: 91.40.38.233:33313 [51641] http-in app/api-08 3416/0/556/556/3416 200 87601 - - ---- 225/225/48/48/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:16:59.287585-07:00 worker-12 sshd[51059]: Accepted publickey for priya from 91.239.154.197 port 50134 ssh2: ED25519 SHA256:f7c1c832f4a04ecf 2026-10-09T13:16:59.332509-07:00 web-01 haproxy[919]: 45.116.224.157:23363 [57344] http-in app/db-replica 9194/0/145/145/9194 200 74580 - - ---- 763/763/55/55/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:16:59.347798-07:00 web-03 app[30072]: INFO order 54438 confirmed for zoë in 1171 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:16:59.362649-07:00 cache-3 app[30758]: INFO order 13961 confirmed for müller in 1056 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:16:59.446327-07:00 edge-fr-1 app[30536]: WARN slow query (9181 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '53 minutes' 2026-10-09T13:16:59.480659-07:00 web-02 nginx[1208]: 45.124.198.163 - - "GET /metrics HTTP/1.1" 404 65153 "-" "python-requests/2.32.3" 2026-10-09T13:16:59.786487-07:00 api-08 app[30661]: INFO request_id=110bd9feb979d455 method=GET path=/static/main.css status=204 duration=1367ms 2026-10-09T13:16:59.854849-07:00 db-replica systemd[1]: Started Session 69505 of User root. 2026-10-09T13:17:00.033428-07:00 web-02 systemd[1]: Started Session 94957 of User priya. 2026-10-09T13:17:00.075767-07:00 db-primary app[30476]: INFO order 39440 confirmed for müller in 9518 ms (region us-east-1, queue webhooks) 2026-10-09T13:17:00.297077-07:00 bastion app[30930]: INFO request_id=ec3d45e90d33549d method=GET path=/static/app.js status=502 duration=657ms 2026-10-09T13:17:00.375310-07:00 api-07 postgres[14433]: LOG: duration: 6889.314 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:00.494025-07:00 worker-12 haproxy[936]: 10.72.156.86:34745 [45705] http-in app/web-03 3358/0/423/423/3358 200 15586 - - ---- 614/614/15/15/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:17:00.667047-07:00 web-03 nginx[1209]: 192.252.174.178 - zoë "POST /login HTTP/1.1" 204 29247 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:00.751643-07:00 worker-12 app[30443]: WARN retrying upstream 172.100.158.54:40967 after timeout (8476 ms), attempt 2 of 3 2026-10-09T13:17:00.979779-07:00 web-03 app[30990]: INFO worker 18 finished job a690be23778561ba in 7299 ms 2026-10-09T13:17:01.003277-07:00 web-01 systemd[1]: Started Session 27994 of User priya. 2026-10-09T13:17:01.293439-07:00 web-02 sshd[58998]: Failed password for invalid user françois from 45.121.197.172 port 7874 ssh2 2026-10-09T13:17:01.515255-07:00 web-01 app[30717]: INFO order 53704 confirmed for sørensen in 6898 ms (region us-east-1, queue invoices) 2026-10-09T13:17:01.589688-07:00 api-08 app[30224]: INFO worker 65 picked job dc63bbf79e4e01f2 from queue webhooks 2026-10-09T13:17:01.643657-07:00 db-primary haproxy[912]: 192.160.179.176:14286 [14210] http-in app/api-08 1365/0/985/985/1365 204 12738 - - ---- 820/820/18/18/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:17:01.837119-07:00 db-replica systemd[1]: session-73673.scope: Deactivated successfully. 2026-10-09T13:17:01.931607-07:00 api-07 sshd[42456]: Accepted publickey for deploy from 45.249.239.226 port 7583 ssh2: ED25519 SHA256:2bebd0387a3b29a3 2026-10-09T13:17:02.086624-07:00 api-08 haproxy[922]: 172.240.35.152:37947 [85871] http-in app/db-replica 1383/0/11/11/1383 500 54474 - - ---- 119/119/87/87/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:02.322968-07:00 db-replica haproxy[919]: 192.70.255.188:43234 [21146] http-in app/cache-3 8047/0/448/448/8047 200 40651 - - ---- 795/795/25/25/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:17:02.403785-07:00 web-02 kubelet[800]: I1009 13:17:02.180885 1537 kubelet.go:1537] "Pod is terminating, skipping pod status update" pod="default/api-e4e569fd7d7bf215" 2026-10-09T13:17:02.547710-07:00 web-01 haproxy[927]: 10.255.181.172:57488 [41289] http-in app/worker-12 659/0/50/50/659 404 68099 - - ---- 823/823/84/84/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:02.620054-07:00 web-02 sshd[43700]: Connection closed by 172.72.199.49 port 59464 [preauth] 2026-10-09T13:17:02.871065-07:00 web-01 haproxy[945]: 10.233.171.47:4400 [48761] http-in app/edge-fr-1 2970/0/963/963/2970 301 37697 - - ---- 181/181/24/24/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:17:03.093299-07:00 db-primary app[30829]: DEBUG cache hit ratio 32% over the last minute (84775 lookups) 2026-10-09T13:17:03.123510-07:00 db-replica kernel: [91797.388864] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.182.221.169 DST=10.0.396.396 LEN=16 TOS=0x00 PREC=0x00 TTL=16 ID=91797 DF PROTO=TCP SPT=58567 DPT=58567 WINDOW=91797 RES=0x00 SYN URGP=0 2026-10-09T13:17:03.283180-07:00 bastion app[30183]: ERROR payment declined for order 30597: card_declined (code 46), customer notified 2026-10-09T13:17:03.442066-07:00 edge-fr-1 postgres[4740]: LOG: duration: 2654.886 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:03.697127-07:00 cache-3 app[30822]: INFO request_id=ed60dd67179faee1 method=GET path=/health status=204 duration=3063ms 2026-10-09T13:17:03.718475-07:00 api-07 dockerd[700]: time="2026-10-09T13:17:03.718475-07:00" level=warning msg="Health check for container 3d2f0c9a952d3f27 error: context deadline exceeded" 2026-10-09T13:17:03.767816-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577023.212:82653): pid=82653 uid=0 auid=3218 ses=302 msg='op=login id=3218 exe="/usr/sbin/sshd" hostname=? addr=45.241.37.31 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:03.811281-07:00 web-01 app[30505]: INFO health check ok: db 955 ms, cache 955 ms, queue depth 17 2026-10-09T13:17:03.875079-07:00 web-03 app[30476]: INFO worker 57 picked job e1c156d42a6898c9 from queue webhooks 2026-10-09T13:17:04.069342-07:00 edge-fr-1 app[30702]: INFO worker 19 picked job d2ad2cf3ea9f618a from queue webhooks 2026-10-09T13:17:04.086529-07:00 web-01 app[30173]: INFO order 40016 confirmed for zoë in 9381 ms (region us-east-1, queue emails) 2026-10-09T13:17:04.121995-07:00 api-08 app[30678]: INFO request_id=6e75848842fbd956 method=GET path=/login status=200 duration=1035ms 2026-10-09T13:17:04.164951-07:00 cache-3 app[30858]: INFO order 38865 confirmed for zoë in 6914 ms (region ap-northeast-1, queue orders) 2026-10-09T13:17:04.219720-07:00 web-01 cron[6461]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:17:04.455737-07:00 db-primary sshd[27024]: Received disconnect from 203.131.150.13 port 45373:11: Bye Bye [preauth] 2026-10-09T13:17:04.457901-07:00 worker-12 app[30802]: WARN retrying upstream 10.97.144.8:6793 after timeout (9731 ms), attempt 1 of 3 2026-10-09T13:17:04.489765-07:00 web-02 kernel: [69589.615252] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.39.181.46 DST=10.0.822.822 LEN=57 TOS=0x00 PREC=0x00 TTL=57 ID=69589 DF PROTO=TCP SPT=39964 DPT=39964 WINDOW=69589 RES=0x00 SYN URGP=0 2026-10-09T13:17:04.575778-07:00 db-replica app[30847]: INFO request_id=d67da851554382a5 method=GET path=/.env status=500 duration=124ms 2026-10-09T13:17:04.668745-07:00 web-01 app[30444]: ERROR payment declined for order 56499: card_declined (code 11), customer notified 2026-10-09T13:17:04.951799-07:00 web-02 app[30035]: ERROR cache miss storm: 7931 misses in 322 ms, key prefix session:ci 2026-10-09T13:17:04.998848-07:00 cache-3 app[30905]: INFO worker 47 finished job 87edecd285a09805 in 5403 ms 2026-10-09T13:17:05.062437-07:00 edge-fr-1 haproxy[921]: 192.100.68.78:48766 [46300] http-in app/web-02 3204/0/475/475/3204 404 37750 - - ---- 975/975/78/78/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:17:05.075219-07:00 edge-fr-1 app[30375]: INFO worker 54 picked job 51201406729c0288 from queue emails 2026-10-09T13:17:05.144307-07:00 api-07 nginx[1204]: 203.23.221.48 - sørensen "POST /metrics HTTP/1.1" 200 31353 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:05.230869-07:00 worker-12 nginx[1200]: 172.99.46.70 - - "GET /.env HTTP/1.1" 500 19324 "-" "kube-probe/1.31" 2026-10-09T13:17:05.395578-07:00 bastion kubelet[800]: I1009 13:17:05.141669 7115 kubelet.go:7115] "Pod is terminating, skipping pod status update" pod="default/api-efeaad7415e10e6a" 2026-10-09T13:17:05.505014-07:00 db-primary nginx[1209]: 91.22.186.56 - - "GET /.env HTTP/1.1" 502 70897 "-" "Go-http-client/1.1" 2026-10-09T13:17:05.589309-07:00 db-primary app[30495]: INFO request_id=3a5f552770c74a33 method=GET path=/static/main.css status=404 duration=9073ms 2026-10-09T13:17:05.661832-07:00 worker-12 app[30220]: INFO request_id=7d367d243bc5a2a2 method=GET path=/api/v2/orders status=500 duration=9133ms 2026-10-09T13:17:05.702515-07:00 web-02 app[30176]: INFO request_id=9ba5024ea27ce7df method=GET path=/.env status=502 duration=55ms 2026-10-09T13:17:05.875496-07:00 api-07 app[30556]: INFO order 28705 confirmed for françois in 2230 ms (region eu-west-1, queue webhooks) 2026-10-09T13:17:06.211134-07:00 worker-12 nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.131.115.176, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.242.242:8080/metrics" 2026-10-09T13:17:06.225709-07:00 web-01 nginx[1207]: 91.232.169.218 - - "GET /static/app.js HTTP/1.1" 301 22146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:06.284249-07:00 bastion sshd[4816]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:17:06.291525-07:00 bastion app[30567]: INFO order 50000 confirmed for root in 5547 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:06.342622-07:00 db-primary nginx[1207]: 192.227.157.6 - - "GET /.env HTTP/1.1" 204 15304 "-" "Go-http-client/1.1" 2026-10-09T13:17:06.429449-07:00 db-primary app[30788]: INFO worker 20 finished job 72e083c59c192bad in 5637 ms 2026-10-09T13:17:06.475677-07:00 web-01 sshd[32443]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:17:06.761017-07:00 api-08 sshd[32698]: Received disconnect from 45.235.150.64 port 56914:11: Bye Bye [preauth] 2026-10-09T13:17:06.761948-07:00 db-replica kernel: [61114.397335] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.111.133.87 DST=10.0.116.116 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=61114 DF PROTO=TCP SPT=5501 DPT=5501 WINDOW=61114 RES=0x00 SYN URGP=0 2026-10-09T13:17:06.871165-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577026.295:51457): pid=51457 uid=0 auid=7114 ses=469 msg='op=login id=7114 exe="/usr/sbin/sshd" hostname=? addr=10.230.92.176 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:07.243897-07:00 api-07 haproxy[923]: 45.244.7.144:60339 [58570] http-in app/cache-3 3226/0/703/703/3226 302 67574 - - ---- 717/717/12/12/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:17:07.324340-07:00 bastion app[30165]: INFO worker 70 finished job e9f8ca80efa0a33e in 708 ms 2026-10-09T13:17:07.329531-07:00 web-03 haproxy[916]: 45.221.93.210:59372 [59246] http-in app/edge-fr-1 6469/0/744/744/6469 302 56820 - - ---- 912/912/59/59/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:07.355732-07:00 api-08 nginx[1201]: 203.85.79.147 - - "GET /.env HTTP/1.1" 401 40081 "-" "python-requests/2.32.3" 2026-10-09T13:17:07.639700-07:00 web-01 app[30488]: INFO order 36381 confirmed for zoë in 5538 ms (region us-east-1, queue orders) 2026-10-09T13:17:07.646446-07:00 cache-3 app[30805]: INFO request_id=f64ba5239518ea4b method=GET path=/static/main.css status=200 duration=1862ms 2026-10-09T13:17:07.664321-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577027.444:83267): pid=83267 uid=0 auid=1019 ses=347 msg='op=login id=1019 exe="/usr/sbin/sshd" hostname=? addr=10.239.1.221 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:07.860297-07:00 web-02 sshd[53984]: Accepted publickey for deploy from 192.123.216.182 port 15700 ssh2: ED25519 SHA256:66e53a97ff88fa6d 2026-10-09T13:17:07.908499-07:00 web-03 kernel: [58776.431015] TCP: request_sock_TCP: Possible SYN flooding on port 47986. Sending cookies. Check SNMP counters. 2026-10-09T13:17:08.088562-07:00 web-01 nginx[1208]: 172.220.60.17 - - "GET /static/app.js HTTP/1.1" 500 7827 "-" "kube-probe/1.31" 2026-10-09T13:17:08.104322-07:00 cache-3 postgres[26828]: LOG: duration: 4153.97 ms statement: SELECT * FROM orders WHERE customer_id = 84758 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:08.180582-07:00 bastion sshd[17691]: Failed password for invalid user akira from 203.219.20.112 port 55006 ssh2 2026-10-09T13:17:08.584059-07:00 web-01 app[30831]: INFO request_id=8154f8b3085d08da method=GET path=/wp-login.php status=302 duration=1536ms 2026-10-09T13:17:08.711362-07:00 edge-fr-1 app[30324]: INFO request_id=3b452aef3251baab method=GET path=/api/v2/orders status=200 duration=6041ms 2026-10-09T13:17:08.783194-07:00 worker-12 app[30791]: INFO worker 36 finished job 7cad8368f6567391 in 6224 ms 2026-10-09T13:17:08.917906-07:00 edge-fr-1 nginx[1208]: 10.251.147.238 - - "GET /api/v2/users HTTP/1.1" 200 35265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:08.967913-07:00 cache-3 app[30412]: INFO worker 68 picked job 8d176456c58b077d from queue invoices 2026-10-09T13:17:09.039870-07:00 cache-3 postgres[31906]: LOG: duration: 2270.212 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:09.083116-07:00 edge-fr-1 sshd[33531]: Accepted publickey for deploy from 172.166.8.101 port 47726 ssh2: ED25519 SHA256:9fe5615c66023a1c 2026-10-09T13:17:09.324891-07:00 api-07 app[30991]: INFO request_id=9794f2b3dd8d3301 method=GET path=/metrics status=200 duration=157ms 2026-10-09T13:17:09.341415-07:00 api-08 app[30182]: INFO health check ok: db 224 ms, cache 224 ms, queue depth 68 2026-10-09T13:17:09.347969-07:00 web-03 sshd[2533]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:17:09.453938-07:00 edge-fr-1 app[30915]: INFO worker 48 picked job c809543bdd4a3841 from queue emails 2026-10-09T13:17:09.592577-07:00 web-01 app[30057]: ERROR payment declined for order 71827: card_declined (code 93), customer notified 2026-10-09T13:17:09.801797-07:00 api-07 haproxy[918]: 45.208.230.141:5555 [29578] http-in app/api-07 3056/0/831/831/3056 204 86929 - - ---- 371/371/45/45/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:17:09.844055-07:00 api-08 nginx[1205]: 10.92.225.247 - ci "POST /health HTTP/1.1" 200 28183 "-" "curl/8.4.0" 2026-10-09T13:17:10.127692-07:00 db-primary app[30984]: INFO request_id=75d91ee2e534b1a1 method=GET path=/static/main.css status=302 duration=7114ms 2026-10-09T13:17:10.196161-07:00 worker-12 nginx[1207]: 45.101.235.18 - - "GET /api/v2/users HTTP/1.1" 204 43073 "-" "Go-http-client/1.1" 2026-10-09T13:17:10.222753-07:00 web-03 nginx[1207]: 45.161.12.221 - deploy "POST /metrics HTTP/1.1" 200 25376 "-" "Go-http-client/1.1" 2026-10-09T13:17:10.285948-07:00 web-01 postgres[29835]: LOG: duration: 1727.445 ms statement: SELECT * FROM orders WHERE customer_id = 22253 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:10.296795-07:00 db-replica haproxy[947]: 172.102.47.54:3886 [73148] http-in app/db-primary 2230/0/817/817/2230 200 49455 - - ---- 823/823/51/51/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:17:10.337832-07:00 edge-fr-1 sshd[4340]: pam_unix(sshd:session): session opened for user zoë(uid=2224) by (uid=0) 2026-10-09T13:17:10.369212-07:00 db-primary kernel: [19147.977879] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.33.62.83 DST=10.0.197.197 LEN=16 TOS=0x00 PREC=0x00 TTL=16 ID=19147 DF PROTO=TCP SPT=43058 DPT=43058 WINDOW=19147 RES=0x00 SYN URGP=0 2026-10-09T13:17:10.432319-07:00 edge-fr-1 haproxy[924]: 91.2.220.81:61038 [46675] http-in app/bastion 2102/0/730/730/2102 404 13599 - - ---- 518/518/69/69/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:17:10.483852-07:00 worker-12 app[30597]: INFO worker 16 finished job 74f8c48b3d890291 in 606 ms 2026-10-09T13:17:10.593323-07:00 edge-fr-1 nginx[1210]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.3.187.77, server: app.example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.157.157:8080/favicon.ico" 2026-10-09T13:17:10.712626-07:00 api-08 sshd[32274]: Received disconnect from 45.112.251.1 port 55337:11: Bye Bye [preauth] 2026-10-09T13:17:10.737813-07:00 db-primary app[30240]: INFO request_id=84865305c352507b method=GET path=/wp-login.php status=200 duration=6306ms 2026-10-09T13:17:11.103316-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577031.547:53833): pid=53833 uid=0 auid=8925 ses=488 msg='op=login id=8925 exe="/usr/sbin/sshd" hostname=? addr=203.142.109.228 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:11.488145-07:00 db-primary app[30113]: INFO request_id=8d189b315b8754dc method=GET path=/favicon.ico status=200 duration=4728ms 2026-10-09T13:17:11.662556-07:00 api-07 dockerd[700]: time="2026-10-09T13:17:11.662556-07:00" level=info msg="Container e6ce32086551d335 exited with code 0" 2026-10-09T13:17:12.032743-07:00 web-01 nginx[1205]: 91.0.27.53 - - "GET /favicon.ico HTTP/1.1" 301 36429 "-" "python-requests/2.32.3" 2026-10-09T13:17:12.116110-07:00 web-02 sshd[13248]: Failed password for invalid user ci from 172.130.113.243 port 61990 ssh2 2026-10-09T13:17:12.129924-07:00 worker-12 nginx[1206]: 192.134.29.88 - - "GET /wp-login.php HTTP/1.1" 502 51131 "-" "python-requests/2.32.3" 2026-10-09T13:17:12.214491-07:00 web-02 app[30824]: INFO worker 71 picked job d8ed2068e6fcc67e from queue orders 2026-10-09T13:17:12.313888-07:00 web-01 app[30482]: INFO order 26470 confirmed for backup in 781 ms (region eu-west-1, queue orders) 2026-10-09T13:17:12.664779-07:00 api-08 app[30870]: INFO worker 75 picked job e92512122dce4150 from queue emails 2026-10-09T13:17:12.706754-07:00 bastion sshd[10157]: Connection closed by 45.0.146.59 port 25710 [preauth] 2026-10-09T13:17:12.931333-07:00 edge-fr-1 app[30850]: INFO request_id=5f4d83219c4eed6d method=GET path=/wp-login.php status=200 duration=9096ms 2026-10-09T13:17:12.974322-07:00 api-08 sshd[64220]: Connection closed by 91.128.64.148 port 20866 [preauth] 2026-10-09T13:17:13.105352-07:00 cache-3 app[30774]: INFO request_id=9875a573c21312d3 method=GET path=/admin status=401 duration=7002ms 2026-10-09T13:17:13.156022-07:00 worker-12 app[30442]: INFO worker 86 picked job 50bd4f4bc2c52d66 from queue emails 2026-10-09T13:17:13.224234-07:00 worker-12 nginx[1202]: 172.1.148.166 - - "GET /static/main.css HTTP/1.1" 301 21019 "-" "curl/8.4.0" 2026-10-09T13:17:13.366528-07:00 web-01 app[30518]: INFO worker 10 picked job e0b4dbe12ac59044 from queue webhooks 2026-10-09T13:17:13.370126-07:00 db-primary haproxy[915]: 45.64.43.188:51129 [26802] http-in app/db-primary 7895/0/718/718/7895 200 66074 - - ---- 395/395/41/41/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:17:13.970658-07:00 edge-fr-1 app[30513]: INFO request_id=1bcf18312b53ff48 method=GET path=/favicon.ico status=200 duration=3379ms 2026-10-09T13:17:14.051245-07:00 db-replica nginx[1205]: 10.60.135.197 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 2217 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:14.116383-07:00 api-08 postgres[9361]: LOG: duration: 1124.340 ms statement: SELECT * FROM orders WHERE customer_id = 17631 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:14.376019-07:00 db-replica kernel: [95470.142663] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.236.66.182 DST=10.0.559.559 LEN=85 TOS=0x00 PREC=0x00 TTL=85 ID=95470 DF PROTO=TCP SPT=23893 DPT=23893 WINDOW=95470 RES=0x00 SYN URGP=0 2026-10-09T13:17:14.639048-07:00 worker-12 sshd[31215]: Invalid user priya from 203.236.135.142 port 49638 2026-10-09T13:17:14.933736-07:00 api-07 app[30837]: INFO request_id=d1f3a3fe12d12cf3 method=GET path=/wp-login.php status=502 duration=1048ms 2026-10-09T13:17:15.099723-07:00 api-07 app[30631]: INFO request_id=cf74269d83be668e method=GET path=/static/main.css status=302 duration=366ms 2026-10-09T13:17:15.131448-07:00 api-07 nginx[1204]: 45.79.124.254 - - "GET /api/v2/users HTTP/1.1" 302 36118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:15.203627-07:00 web-01 app[30145]: INFO health check ok: db 515 ms, cache 515 ms, queue depth 53 2026-10-09T13:17:15.919917-07:00 api-08 sshd[20132]: Failed password for invalid user backup from 172.16.160.161 port 14251 ssh2 2026-10-09T13:17:16.025648-07:00 bastion haproxy[905]: 91.9.92.165:50211 [73704] http-in app/web-03 3783/0/502/502/3783 200 21773 - - ---- 571/571/22/22/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:17:16.552372-07:00 api-07 cron[13686]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:17:16.682832-07:00 worker-12 postgres[28281]: LOG: duration: 8436.823 ms statement: SELECT * FROM orders WHERE customer_id = 20265 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:16.744163-07:00 db-primary systemd[1]: Started Session 59073 of User müller. 2026-10-09T13:17:16.821002-07:00 worker-12 app[30023]: INFO request_id=43401ef42f26dfa1 method=GET path=/login status=200 duration=557ms 2026-10-09T13:17:16.834193-07:00 web-02 cron[8847]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:17:16.880663-07:00 cache-3 systemd[1]: Started Session 92763 of User priya. 2026-10-09T13:17:16.884549-07:00 web-01 app[30344]: INFO order 39540 confirmed for müller in 3593 ms (region ap-northeast-1, queue orders) 2026-10-09T13:17:16.929777-07:00 api-07 app[30157]: WARN slow query (1180 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '65 minutes' 2026-10-09T13:17:17.136431-07:00 web-01 app[30998]: INFO request_id=170e37f2f522d4a6 method=GET path=/static/main.css status=404 duration=3695ms 2026-10-09T13:17:17.256933-07:00 api-08 nginx[1204]: 10.57.173.108 - - "GET /admin HTTP/1.1" 404 3455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:17.327739-07:00 web-03 nginx[1210]: 91.214.156.200 - - "GET /static/app.js HTTP/1.1" 200 88223 "-" "python-requests/2.32.3" 2026-10-09T13:17:17.470461-07:00 worker-12 app[30254]: INFO request_id=d096108c69590c2a method=GET path=/health status=404 duration=184ms 2026-10-09T13:17:17.480123-07:00 web-01 app[30274]: INFO request_id=3c5038112c2ed940 method=GET path=/api/v2/search?q=invoice status=502 duration=5711ms 2026-10-09T13:17:17.785049-07:00 worker-12 app[30778]: INFO worker 39 picked job 2d511c886d9feaec from queue invoices 2026-10-09T13:17:17.791656-07:00 cache-3 nginx[1205]: 91.217.178.136 - - "GET /static/app.js HTTP/1.1" 301 1346 "-" "python-requests/2.32.3" 2026-10-09T13:17:17.836231-07:00 db-replica app[30157]: INFO request_id=abc7c60f97a31557 method=GET path=/wp-login.php status=404 duration=8176ms 2026-10-09T13:17:17.843168-07:00 edge-fr-1 nginx[1204]: 10.239.31.169 - deploy "POST /static/app.js HTTP/1.1" 200 8323 "-" "Go-http-client/1.1" 2026-10-09T13:17:18.194739-07:00 web-02 haproxy[938]: 10.239.89.11:56897 [40930] http-in app/db-primary 1392/0/359/359/1392 200 48396 - - ---- 915/915/83/83/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:17:18.194801-07:00 web-02 systemd[1]: session-57890.scope: Deactivated successfully. 2026-10-09T13:17:18.346251-07:00 api-08 nginx[1204]: 172.78.108.183 - - "GET /static/app.js HTTP/1.1" 502 386 "-" "python-requests/2.32.3" 2026-10-09T13:17:18.371187-07:00 db-replica app[30428]: INFO request_id=07e4fee3374421f8 method=GET path=/static/main.css status=404 duration=566ms 2026-10-09T13:17:18.539023-07:00 web-01 app[30526]: INFO worker 89 finished job b040538603da5816 in 2922 ms 2026-10-09T13:17:18.687477-07:00 web-03 postgres[11829]: LOG: duration: 4170.112 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:18.769535-07:00 api-07 haproxy[946]: 10.20.248.44:6122 [50325] http-in app/api-07 1026/0/277/277/1026 200 46587 - - ---- 443/443/63/63/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:17:18.771623-07:00 worker-12 nginx[1208]: 192.200.51.138 - backup "POST /api/v2/orders/8841 HTTP/1.1" 301 89463 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:19.036890-07:00 db-primary app[30535]: INFO request_id=70ef9dca7d0dad1d method=GET path=/api/v2/users status=404 duration=4550ms 2026-10-09T13:17:19.044592-07:00 db-primary app[30445]: INFO order 56697 confirmed for zoë in 1580 ms (region us-east-1, queue emails) 2026-10-09T13:17:19.053824-07:00 worker-12 nginx[1208]: 10.151.235.240 - deploy "POST /admin HTTP/1.1" 500 37435 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:19.055703-07:00 cache-3 haproxy[927]: 172.200.255.121:49807 [64257] http-in app/web-02 7700/0/691/691/7700 204 70641 - - ---- 462/462/90/90/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:19.675454-07:00 api-08 app[30494]: INFO worker 62 finished job d93d0cbbfba78409 in 1410 ms 2026-10-09T13:17:19.681262-07:00 api-08 app[30443]: INFO worker 17 picked job a84e1a97f99eb63e from queue invoices 2026-10-09T13:17:19.695724-07:00 worker-12 cron[40324]: (zoë) CMD (/usr/bin/backup --quiet --target /srv/zoë) 2026-10-09T13:17:19.705083-07:00 db-replica systemd[1]: Started Session 33165 of User priya. 2026-10-09T13:17:19.753512-07:00 api-07 nginx[1205]: 172.55.154.180 - - "GET /login HTTP/1.1" 200 84633 "-" "python-requests/2.32.3" 2026-10-09T13:17:19.959223-07:00 web-03 sshd[527]: Connection closed by 10.245.216.97 port 31810 [preauth] 2026-10-09T13:17:20.178836-07:00 edge-fr-1 app[30241]: INFO order 39166 confirmed for sørensen in 3721 ms (region eu-west-1, queue webhooks) 2026-10-09T13:17:20.325273-07:00 api-07 postgres[20712]: LOG: duration: 8764.263 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:20.334185-07:00 bastion app[30139]: INFO order 14326 confirmed for zoë in 2034 ms (region us-east-1, queue orders) 2026-10-09T13:17:20.512241-07:00 bastion sshd[3163]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:17:20.545919-07:00 web-03 postgres[14115]: LOG: duration: 5874.790 ms statement: SELECT * FROM orders WHERE customer_id = 55790 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:20.598364-07:00 bastion app[30324]: INFO order 30561 confirmed for müller in 8181 ms (region eu-west-1, queue invoices) 2026-10-09T13:17:20.649868-07:00 web-02 app[30822]: INFO worker 49 finished job 4c3adb6857d14728 in 2660 ms 2026-10-09T13:17:20.723732-07:00 db-primary sshd[50356]: Accepted publickey for priya from 45.178.23.114 port 61874 ssh2: ED25519 SHA256:0fad0d17ead27ffd 2026-10-09T13:17:20.746589-07:00 db-primary nginx[1204]: 10.87.81.228 - - "GET /static/app.js HTTP/1.1" 200 51363 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:20.805248-07:00 edge-fr-1 nginx[1207]: 45.237.127.94 - - "GET /health HTTP/1.1" 404 50315 "-" "python-requests/2.32.3" 2026-10-09T13:17:21.174479-07:00 cache-3 sshd[36717]: Connection closed by 45.23.109.27 port 36568 [preauth] 2026-10-09T13:17:21.266941-07:00 web-03 app[30905]: INFO worker 96 finished job b6eb20bf774440a8 in 4783 ms 2026-10-09T13:17:21.404283-07:00 api-08 dockerd[700]: time="2026-10-09T13:17:21.404283-07:00" level=warning msg="Health check for container bce9e925272e0450 error: context deadline exceeded" 2026-10-09T13:17:21.406082-07:00 cache-3 app[30165]: INFO order 60535 confirmed for müller in 7521 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:21.425183-07:00 web-01 sshd[20680]: Failed password for invalid user françois from 10.66.201.35 port 43682 ssh2 2026-10-09T13:17:21.451971-07:00 web-02 nginx[1202]: 45.0.200.245 - - "GET /wp-login.php HTTP/1.1" 200 27217 "-" "kube-probe/1.31" 2026-10-09T13:17:21.512381-07:00 api-07 haproxy[904]: 203.253.61.127:34675 [86856] http-in app/api-08 8406/0/481/481/8406 500 72578 - - ---- 822/822/21/21/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:17:21.533041-07:00 web-03 haproxy[936]: Server app/bastion is UP, reason: Layer7 check passed, code: 200, check duration: 217ms. 10 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:17:21.677618-07:00 api-08 sshd[35510]: Accepted publickey for müller from 10.5.185.158 port 48318 ssh2: ED25519 SHA256:41c4d132817aa65b 2026-10-09T13:17:21.715267-07:00 edge-fr-1 app[30237]: INFO order 53681 confirmed for sørensen in 2844 ms (region eu-west-1, queue invoices) 2026-10-09T13:17:21.912870-07:00 api-07 sshd[56185]: pam_unix(sshd:session): session opened for user zoë(uid=8888) by (uid=0) 2026-10-09T13:17:21.964216-07:00 web-03 postgres[31776]: LOG: duration: 1616.149 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:22.014594-07:00 db-primary app[30613]: INFO worker 64 picked job a4b194173d52510f from queue webhooks 2026-10-09T13:17:22.223011-07:00 db-primary app[30512]: INFO request_id=79aadc58a8ffea2b method=GET path=/api/v2/search?q=invoice status=404 duration=3696ms 2026-10-09T13:17:22.318415-07:00 edge-fr-1 nginx[1201]: 45.5.37.58 - - "GET /health HTTP/1.1" 401 36421 "-" "kube-probe/1.31" 2026-10-09T13:17:22.395423-07:00 db-primary app[30248]: DEBUG cache hit ratio 58% over the last minute (73831 lookups) 2026-10-09T13:17:22.510084-07:00 db-replica sshd[31040]: Invalid user deploy from 203.92.41.9 port 3774 2026-10-09T13:17:22.643528-07:00 edge-fr-1 app[30876]: INFO order 28201 confirmed for root in 8562 ms (region eu-west-1, queue emails) 2026-10-09T13:17:22.703135-07:00 api-07 postgres[22794]: LOG: duration: 7333.846 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:22.887856-07:00 web-01 haproxy[900]: 192.112.77.118:11979 [80474] http-in app/web-02 5062/0/402/402/5062 200 15309 - - ---- 182/182/83/83/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:17:22.927090-07:00 api-08 nginx[1208]: 192.9.83.252 - - "GET /favicon.ico HTTP/1.1" 200 30172 "-" "python-requests/2.32.3" 2026-10-09T13:17:23.014865-07:00 db-replica app[30113]: INFO order 65772 confirmed for root in 5239 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:17:23.025870-07:00 edge-fr-1 sshd[32234]: Accepted publickey for priya from 10.171.236.63 port 34477 ssh2: ED25519 SHA256:d1fd47d40a07c08f 2026-10-09T13:17:23.049638-07:00 cache-3 nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.164.134.188, server: app.example.com, request: "GET /wp-login.php HTTP/1.1", upstream: "http://10.0.154.154:8080/wp-login.php" 2026-10-09T13:17:23.059699-07:00 db-replica haproxy[922]: 10.240.17.201:47396 [91156] http-in app/db-replica 3798/0/299/299/3798 301 4374 - - ---- 568/568/39/39/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:23.112261-07:00 cache-3 app[30610]: INFO request_id=f171795c0aced46e method=GET path=/api/v2/orders/8841 status=200 duration=8064ms 2026-10-09T13:17:23.144173-07:00 db-primary app[30491]: INFO order 99239 confirmed for backup in 5751 ms (region us-east-1, queue invoices) 2026-10-09T13:17:23.335616-07:00 db-primary app[30120]: INFO health check ok: db 844 ms, cache 844 ms, queue depth 55 2026-10-09T13:17:24.012979-07:00 web-03 kernel: [40585.034611] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.45.71.55 DST=10.0.307.307 LEN=74 TOS=0x00 PREC=0x00 TTL=74 ID=40585 DF PROTO=TCP SPT=39539 DPT=39539 WINDOW=40585 RES=0x00 SYN URGP=0 2026-10-09T13:17:24.142028-07:00 bastion haproxy[917]: 192.235.15.43:33252 [48897] http-in app/web-02 3024/0/600/600/3024 401 49851 - - ---- 964/964/87/87/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:24.188170-07:00 cache-3 sshd[10454]: Failed password for invalid user zoë from 172.81.54.37 port 51488 ssh2 2026-10-09T13:17:24.395529-07:00 db-primary cron[49767]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:17:24.468856-07:00 cache-3 nginx[1203]: 45.189.245.111 - - "GET /wp-login.php HTTP/1.1" 302 9941 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:24.520119-07:00 worker-12 app[30322]: INFO request_id=771d43f5472c8fe5 method=GET path=/static/app.js status=200 duration=6911ms 2026-10-09T13:17:25.057527-07:00 edge-fr-1 postgres[2938]: ERROR: deadlock detected 2026-10-09T13:17:25.075314-07:00 db-primary app[30297]: INFO request_id=4db5e46560a2f9c4 method=GET path=/wp-login.php status=302 duration=7706ms 2026-10-09T13:17:25.097850-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577045.310:95407): pid=95407 uid=0 auid=1633 ses=431 msg='op=login id=1633 exe="/usr/sbin/sshd" hostname=? addr=172.154.24.170 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:25.130618-07:00 web-01 app[30434]: INFO worker 89 finished job 4089c4b343846772 in 4253 ms 2026-10-09T13:17:25.261906-07:00 web-02 app[30278]: INFO request_id=327d4e79686796f9 method=GET path=/api/v2/orders/8841 status=401 duration=3480ms 2026-10-09T13:17:25.403489-07:00 api-07 app[30499]: INFO request_id=8735c6c0786ed8ea method=GET path=/login status=200 duration=1332ms 2026-10-09T13:17:25.416543-07:00 edge-fr-1 nginx[1202]: 91.86.54.254 - - "GET /api/v2/orders HTTP/1.1" 204 77939 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:25.453547-07:00 bastion app[30190]: INFO request_id=605cd385df69b923 method=GET path=/api/v2/users status=200 duration=2584ms 2026-10-09T13:17:26.112771-07:00 web-01 sshd[585]: pam_unix(sshd:session): session opened for user root(uid=3120) by (uid=0) 2026-10-09T13:17:26.331016-07:00 db-replica postgres[24846]: LOG: duration: 6996.734 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:26.389323-07:00 edge-fr-1 app[30955]: INFO request_id=71f3df47f2342fa0 method=GET path=/static/main.css status=502 duration=57ms 2026-10-09T13:17:26.421840-07:00 db-replica sshd[33040]: Accepted publickey for root from 45.12.154.217 port 41553 ssh2: ED25519 SHA256:c28d8ac33edf9f65 2026-10-09T13:17:26.472896-07:00 bastion nginx[1201]: 192.181.87.161 - root "POST /.env HTTP/1.1" 301 18082 "-" "kube-probe/1.31" 2026-10-09T13:17:26.486535-07:00 cache-3 sshd[64496]: Connection closed by 45.11.85.220 port 64497 [preauth] 2026-10-09T13:17:26.560843-07:00 cache-3 nginx[1200]: 172.89.140.245 - - "GET /.env HTTP/1.1" 502 63312 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:26.623150-07:00 worker-12 app[30128]: INFO worker 95 finished job 08c6dfc2384bcc62 in 4101 ms 2026-10-09T13:17:26.723237-07:00 bastion app[30948]: INFO request_id=7958660df8ea7b99 method=GET path=/api/v2/orders/8841 status=302 duration=1757ms 2026-10-09T13:17:26.733108-07:00 db-primary sshd[58960]: Accepted publickey for akira from 91.186.53.96 port 20697 ssh2: ED25519 SHA256:6da1d345129be4cf 2026-10-09T13:17:27.229403-07:00 api-08 postgres[17051]: LOG: duration: 8223.811 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:27.253485-07:00 cache-3 app[30705]: INFO worker 67 finished job ca10f2b075cdb62a in 32 ms 2026-10-09T13:17:27.257677-07:00 db-replica app[30110]: INFO order 53348 confirmed for zoë in 3670 ms (region us-east-1, queue webhooks) 2026-10-09T13:17:27.265002-07:00 web-01 app[30489]: INFO request_id=a6afbb4dea77db67 method=GET path=/admin status=301 duration=5678ms 2026-10-09T13:17:27.373174-07:00 web-01 nginx[1204]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.148.183.234, server: app.example.com, request: "GET /health HTTP/1.1", upstream: "http://10.0.249.249:8080/health" 2026-10-09T13:17:27.401240-07:00 api-07 nginx[1201]: 203.44.100.208 - - "GET /static/app.js HTTP/1.1" 200 44268 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:27.440083-07:00 web-03 app[30827]: INFO request_id=de2f863eb7f59c6d method=GET path=/health status=500 duration=6877ms 2026-10-09T13:17:27.547848-07:00 api-07 app[30594]: INFO order 33096 confirmed for root in 7528 ms (region us-east-1, queue invoices) 2026-10-09T13:17:27.568125-07:00 api-08 app[30503]: DEBUG cache hit ratio 45% over the last minute (83455 lookups) 2026-10-09T13:17:27.724334-07:00 db-replica app[30638]: INFO request_id=f8814fc74da74a67 method=GET path=/api/v2/orders/8841 status=200 duration=2673ms 2026-10-09T13:17:27.728783-07:00 web-02 nginx[1210]: 10.188.90.235 - - "GET /api/v2/orders HTTP/1.1" 401 69890 "-" "python-requests/2.32.3" 2026-10-09T13:17:27.906870-07:00 worker-12 sshd[37372]: Failed password for invalid user zoë from 91.174.64.174 port 10088 ssh2 2026-10-09T13:17:27.974214-07:00 db-primary postgres[23125]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 42826 remain, 6816 scanned (91% of total) 2026-10-09T13:17:27.987848-07:00 api-07 nginx[1209]: 91.1.32.97 - deploy "POST /static/app.js HTTP/1.1" 302 82799 "-" "python-requests/2.32.3" 2026-10-09T13:17:28.057049-07:00 api-08 app[30254]: INFO request_id=c6ed34d2cbc06d9b method=GET path=/api/v2/orders status=200 duration=6597ms 2026-10-09T13:17:28.396210-07:00 bastion sshd[28786]: Connection closed by 172.62.102.69 port 36598 [preauth] 2026-10-09T13:17:28.534561-07:00 db-replica nginx[1207]: 10.171.79.201 - - "GET /metrics HTTP/1.1" 500 82620 "-" "python-requests/2.32.3" 2026-10-09T13:17:28.835191-07:00 edge-fr-1 app[30751]: WARN retrying upstream 45.178.83.62:24130 after timeout (3317 ms), attempt 1 of 3 2026-10-09T13:17:29.117105-07:00 edge-fr-1 app[30711]: INFO order 68930 confirmed for root in 9189 ms (region us-east-1, queue invoices) 2026-10-09T13:17:29.191532-07:00 db-replica sshd[55391]: Received disconnect from 45.8.58.40 port 58395:11: Bye Bye [preauth] 2026-10-09T13:17:29.266359-07:00 web-03 nginx[1201]: 91.110.193.72 - - "GET /static/app.js HTTP/1.1" 204 47530 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:29.332006-07:00 web-03 app[30894]: INFO request_id=15967c49a2527b2d method=GET path=/health status=404 duration=831ms 2026-10-09T13:17:29.362370-07:00 web-03 app[30082]: INFO worker 57 picked job 9218ba32e4884b06 from queue invoices 2026-10-09T13:17:29.371961-07:00 api-07 kernel: [20430.572760] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.233.125.38 DST=10.0.416.416 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=20430 DF PROTO=TCP SPT=41553 DPT=41553 WINDOW=20430 RES=0x00 SYN URGP=0 2026-10-09T13:17:29.434445-07:00 web-01 app[30613]: INFO order 51251 confirmed for akira in 5157 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:29.495033-07:00 api-07 nginx[1205]: 172.138.25.186 - - "GET /health HTTP/1.1" 200 9696 "-" "python-requests/2.32.3" 2026-10-09T13:17:29.516106-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577049.5:34064): pid=34064 uid=0 auid=2806 ses=856 msg='op=login id=2806 exe="/usr/sbin/sshd" hostname=? addr=203.152.57.53 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:29.621918-07:00 db-primary nginx[1205]: 91.76.95.183 - - "GET /wp-login.php HTTP/1.1" 200 85881 "-" "Go-http-client/1.1" 2026-10-09T13:17:29.733736-07:00 api-07 kernel: [96976.618809] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.77.84.179 DST=10.0.480.480 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=96976 DF PROTO=TCP SPT=19598 DPT=19598 WINDOW=96976 RES=0x00 SYN URGP=0 2026-10-09T13:17:29.832125-07:00 worker-12 systemd[1]: Started Session 82517 of User ci. 2026-10-09T13:17:29.845078-07:00 db-replica app[30835]: INFO request_id=b95b4ecf19270c12 method=GET path=/metrics status=302 duration=1782ms 2026-10-09T13:17:29.857921-07:00 cache-3 nginx[1204]: 10.5.27.191 - - "GET /static/app.js HTTP/1.1" 302 27272 "-" "python-requests/2.32.3" 2026-10-09T13:17:29.864741-07:00 cache-3 app[30117]: INFO request_id=a1180812c8146e03 method=GET path=/favicon.ico status=204 duration=1029ms 2026-10-09T13:17:30.151792-07:00 bastion app[30428]: INFO request_id=eb268293476dd025 method=GET path=/api/v2/users status=200 duration=1986ms 2026-10-09T13:17:30.267625-07:00 api-08 nginx[1210]: 192.30.239.1 - root "POST /login HTTP/1.1" 401 49257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:30.319721-07:00 db-primary postgres[25610]: LOG: duration: 6765.223 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:30.364693-07:00 cache-3 postgres[23645]: LOG: duration: 2157.967 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:30.377255-07:00 edge-fr-1 nginx[1209]: 203.37.246.57 - - "GET /api/v2/users HTTP/1.1" 301 83706 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:30.477369-07:00 db-replica cron[15391]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:17:30.497735-07:00 web-01 haproxy[921]: 192.111.82.14:42983 [75431] http-in app/web-03 1990/0/749/749/1990 502 51608 - - ---- 344/344/24/24/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:30.563109-07:00 api-07 nginx[1205]: 192.35.148.233 - - "GET /login HTTP/1.1" 302 74488 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:30.566440-07:00 db-primary app[30621]: INFO request_id=db972943e1a44998 method=GET path=/favicon.ico status=404 duration=5156ms 2026-10-09T13:17:30.880412-07:00 worker-12 systemd[1]: session-14356.scope: Deactivated successfully. 2026-10-09T13:17:30.954401-07:00 web-02 app[30844]: INFO request_id=3318038929d298a0 method=GET path=/api/v2/search?q=invoice status=404 duration=9086ms 2026-10-09T13:17:31.124171-07:00 bastion app[30822]: INFO request_id=5c6dac63d6045b07 method=GET path=/metrics status=401 duration=3947ms 2026-10-09T13:17:31.129228-07:00 edge-fr-1 sshd[8353]: Accepted publickey for akira from 172.88.43.133 port 8453 ssh2: ED25519 SHA256:14ce556a8cd2b273 2026-10-09T13:17:31.185606-07:00 web-02 app[30538]: INFO worker 35 finished job 7bfc0f44ec85a27f in 1591 ms 2026-10-09T13:17:31.544631-07:00 cache-3 sshd[46118]: Received disconnect from 172.251.23.102 port 36365:11: Bye Bye [preauth] 2026-10-09T13:17:31.722535-07:00 api-07 systemd[1]: session-85107.scope: Deactivated successfully. 2026-10-09T13:17:31.724223-07:00 edge-fr-1 nginx[1201]: 91.134.212.120 - - "GET /static/app.js HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:31.810218-07:00 edge-fr-1 haproxy[934]: 91.71.169.72:36626 [85271] http-in app/api-07 6164/0/218/218/6164 404 53715 - - ---- 596/596/41/41/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:17:31.864372-07:00 db-replica haproxy[927]: 203.129.156.122:39966 [64029] http-in app/edge-fr-1 7450/0/360/360/7450 302 24330 - - ---- 607/607/56/56/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:17:31.869634-07:00 web-03 nginx[1208]: 192.11.126.98 - root "POST /.env HTTP/1.1" 200 82241 "-" "kube-probe/1.31" 2026-10-09T13:17:32.024485-07:00 web-01 nginx[1201]: 91.135.167.76 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 165 "-" "curl/8.4.0" 2026-10-09T13:17:32.059897-07:00 db-replica postgres[19082]: LOG: duration: 8393.394 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:32.072303-07:00 web-03 nginx[1206]: 192.225.30.180 - - "GET /api/v2/orders HTTP/1.1" 200 4906 "-" "curl/8.4.0" 2026-10-09T13:17:32.119134-07:00 web-03 sshd[42689]: Received disconnect from 203.67.33.73 port 56075:11: Bye Bye [preauth] 2026-10-09T13:17:32.383612-07:00 edge-fr-1 nginx[1202]: 172.134.127.213 - - "GET /health HTTP/1.1" 200 61109 "-" "kube-probe/1.31" 2026-10-09T13:17:32.788785-07:00 db-replica postgres[22355]: LOG: duration: 1771.347 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:32.940605-07:00 cache-3 sshd[51549]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:17:33.020232-07:00 edge-fr-1 app[30923]: INFO request_id=4dbd99e757f094a4 method=GET path=/metrics status=404 duration=7953ms 2026-10-09T13:17:33.272095-07:00 bastion sshd[38614]: Invalid user sørensen from 172.21.228.15 port 45555 2026-10-09T13:17:33.298833-07:00 cache-3 app[30211]: INFO order 95939 confirmed for zoë in 6825 ms (region eu-west-1, queue orders) 2026-10-09T13:17:33.408306-07:00 cache-3 postgres[2432]: LOG: duration: 8476.968 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:33.458388-07:00 cache-3 app[30138]: INFO request_id=380bde38723f9349 method=GET path=/favicon.ico status=404 duration=3221ms 2026-10-09T13:17:33.511355-07:00 web-03 app[30487]: INFO health check ok: db 230 ms, cache 230 ms, queue depth 63 2026-10-09T13:17:33.572314-07:00 web-01 haproxy[937]: 45.159.71.145:16020 [96202] http-in app/worker-12 1690/0/383/383/1690 301 36778 - - ---- 429/429/44/44/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:33.681641-07:00 db-primary kernel: [96503.264128] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.15.188.224 DST=10.0.450.450 LEN=62 TOS=0x00 PREC=0x00 TTL=62 ID=96503 DF PROTO=TCP SPT=13537 DPT=13537 WINDOW=96503 RES=0x00 SYN URGP=0 2026-10-09T13:17:33.757251-07:00 web-02 app[30989]: INFO worker 31 picked job f7dd7f8ae7e7644a from queue orders 2026-10-09T13:17:33.821264-07:00 worker-12 nginx[1201]: 172.154.247.247 - françois "POST /metrics HTTP/1.1" 302 53668 "-" "python-requests/2.32.3" 2026-10-09T13:17:33.905287-07:00 worker-12 systemd[1]: session-66580.scope: Deactivated successfully. 2026-10-09T13:17:34.167794-07:00 db-primary nginx[1207]: 10.107.155.189 - ci "POST /api/v2/orders/8841 HTTP/1.1" 200 60899 "-" "Go-http-client/1.1" 2026-10-09T13:17:34.211629-07:00 api-07 postgres[7404]: LOG: duration: 3146.967 ms statement: SELECT * FROM orders WHERE customer_id = 55884 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:34.277536-07:00 api-07 app[30243]: INFO worker 18 finished job 1dc377e40a2bc3b0 in 8079 ms 2026-10-09T13:17:34.597045-07:00 bastion nginx[1208]: 203.255.232.161 - - "GET /wp-login.php HTTP/1.1" 401 47828 "-" "Go-http-client/1.1" 2026-10-09T13:17:34.608458-07:00 edge-fr-1 app[30406]: INFO order 30019 confirmed for zoë in 6209 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:17:34.638136-07:00 bastion haproxy[901]: 45.121.58.71:25088 [45641] http-in app/db-replica 1755/0/142/142/1755 500 20208 - - ---- 648/648/87/87/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:34.679199-07:00 web-03 nginx[1207]: 172.170.31.137 - - "GET /wp-login.php HTTP/1.1" 200 22464 "-" "Go-http-client/1.1" 2026-10-09T13:17:34.900359-07:00 db-replica sshd[55829]: Invalid user zoë from 91.44.243.24 port 18839 2026-10-09T13:17:34.984797-07:00 bastion sshd[40590]: Failed password for invalid user deploy from 91.51.175.110 port 50786 ssh2 2026-10-09T13:17:35.001660-07:00 web-03 nginx[1200]: 10.201.92.80 - sørensen "POST /static/main.css HTTP/1.1" 200 37296 "-" "python-requests/2.32.3" 2026-10-09T13:17:35.162520-07:00 bastion app[30487]: INFO worker 62 picked job aa09024979d360bf from queue invoices 2026-10-09T13:17:35.182645-07:00 web-02 app[30287]: INFO health check ok: db 585 ms, cache 585 ms, queue depth 25 2026-10-09T13:17:35.211414-07:00 web-01 kubelet[800]: I1009 13:17:35.568261 2015 kubelet.go:2015] "Pod is terminating, skipping pod status update" pod="default/api-2b9e8f709ed40c7e" 2026-10-09T13:17:35.312115-07:00 web-01 postgres[28774]: LOG: duration: 8639.910 ms statement: SELECT * FROM orders WHERE customer_id = 51053 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:35.650340-07:00 bastion systemd[1]: session-72230.scope: Deactivated successfully. 2026-10-09T13:17:35.747925-07:00 edge-fr-1 haproxy[908]: 203.134.236.89:11102 [37667] http-in app/web-03 1129/0/944/944/1129 200 30190 - - ---- 619/619/43/43/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:17:35.777110-07:00 edge-fr-1 app[30976]: INFO order 74359 confirmed for zoë in 4081 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:17:35.824508-07:00 db-replica systemd[1]: Started Session 33055 of User root. 2026-10-09T13:17:35.877277-07:00 web-03 postgres[26154]: LOG: duration: 6441.611 ms statement: SELECT * FROM orders WHERE customer_id = 13322 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:36.060447-07:00 web-03 sshd[61202]: Connection closed by 203.71.121.213 port 4176 [preauth] 2026-10-09T13:17:36.152535-07:00 web-03 nginx[1200]: 91.128.14.115 - françois "POST /api/v2/search?q=invoice HTTP/1.1" 301 22719 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:36.243758-07:00 web-02 sshd[2562]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:17:36.264668-07:00 web-01 app[30940]: INFO worker 72 picked job cbdd34ff8972d28e from queue invoices 2026-10-09T13:17:36.359434-07:00 edge-fr-1 app[30491]: INFO worker 71 picked job 072947826f361d5f from queue invoices 2026-10-09T13:17:36.830530-07:00 web-02 sshd[30547]: Failed password for invalid user françois from 203.90.251.130 port 17041 ssh2 2026-10-09T13:17:36.918407-07:00 edge-fr-1 nginx[1210]: 45.246.129.199 - zoë "POST /health HTTP/1.1" 302 13130 "-" "python-requests/2.32.3" 2026-10-09T13:17:37.128765-07:00 bastion nginx[1206]: 192.163.106.183 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 16347 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:37.207191-07:00 web-03 dockerd[700]: time="2026-10-09T13:17:37.207191-07:00" level=warning msg="Health check for container 7caaa94e13786a2e error: context deadline exceeded" 2026-10-09T13:17:37.328597-07:00 edge-fr-1 nginx[1208]: 45.133.30.146 - backup "POST /wp-login.php HTTP/1.1" 502 44325 "-" "python-requests/2.32.3" 2026-10-09T13:17:37.343761-07:00 db-replica dockerd[700]: time="2026-10-09T13:17:37.343761-07:00" level=info msg="Container 7828f266e9a2f44c exited with code 0" 2026-10-09T13:17:37.788647-07:00 web-02 sshd[51736]: Accepted publickey for françois from 192.196.25.104 port 59004 ssh2: ED25519 SHA256:f2c031d83aa3c3c2 2026-10-09T13:17:38.236377-07:00 bastion app[30814]: INFO worker 42 picked job fec0c7094b813db1 from queue webhooks 2026-10-09T13:17:38.292252-07:00 api-08 app[30072]: INFO request_id=92b3d6e81d072eaf method=GET path=/api/v2/orders/8841 status=301 duration=7923ms 2026-10-09T13:17:38.609153-07:00 db-replica app[30353]: INFO order 69259 confirmed for backup in 760 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:38.677322-07:00 cache-3 haproxy[932]: 172.63.237.160:44318 [60117] http-in app/edge-fr-1 555/0/402/402/555 500 47185 - - ---- 239/239/94/94/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:17:38.698035-07:00 web-01 nginx[1200]: 91.70.42.148 - - "GET /favicon.ico HTTP/1.1" 302 72584 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:38.881048-07:00 bastion sshd[33406]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:17:38.913377-07:00 db-primary app[30821]: DEBUG cache hit ratio 82% over the last minute (31379 lookups) 2026-10-09T13:17:38.926085-07:00 edge-fr-1 app[30005]: INFO health check ok: db 251 ms, cache 251 ms, queue depth 88 2026-10-09T13:17:39.092202-07:00 api-07 app[30130]: INFO request_id=1625ef8f9f1b2ad1 method=GET path=/api/v2/search?q=invoice status=204 duration=3287ms 2026-10-09T13:17:39.445700-07:00 db-primary nginx[1205]: 45.137.188.216 - - "GET /.env HTTP/1.1" 204 49721 "-" "kube-probe/1.31" 2026-10-09T13:17:39.501158-07:00 web-02 app[30193]: INFO order 86002 confirmed for root in 6114 ms (region ap-northeast-1, queue orders) 2026-10-09T13:17:39.553395-07:00 db-replica app[30189]: WARN slow query (5171 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '19 minutes' 2026-10-09T13:17:39.725547-07:00 db-replica nginx[1207]: 192.170.117.234 - akira "POST /static/main.css HTTP/1.1" 404 72427 "-" "curl/8.4.0" 2026-10-09T13:17:39.792124-07:00 bastion postgres[12199]: LOG: duration: 9044.556 ms statement: SELECT * FROM orders WHERE customer_id = 80343 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:39.892802-07:00 cache-3 app[30881]: INFO request_id=d5af3ce2ac1aaf9f method=GET path=/api/v2/orders status=200 duration=7696ms 2026-10-09T13:17:40.037712-07:00 bastion nginx[1203]: 172.201.182.76 - - "GET /login HTTP/1.1" 404 15171 "-" "Go-http-client/1.1" 2026-10-09T13:17:40.097064-07:00 worker-12 sshd[25956]: pam_unix(sshd:session): session opened for user root(uid=4911) by (uid=0) 2026-10-09T13:17:40.121433-07:00 db-replica haproxy[931]: 192.0.34.162:1314 [85519] http-in app/web-03 8222/0/456/456/8222 500 41359 - - ---- 149/149/95/95/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:17:40.124310-07:00 api-08 app[30086]: INFO request_id=f6fbaaa39b529883 method=GET path=/static/app.js status=500 duration=5223ms 2026-10-09T13:17:40.157233-07:00 web-01 app[30079]: INFO request_id=7089d2ec8d374bb2 method=GET path=/favicon.ico status=404 duration=3691ms 2026-10-09T13:17:40.298081-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577060.887:77936): pid=77936 uid=0 auid=4337 ses=294 msg='op=login id=4337 exe="/usr/sbin/sshd" hostname=? addr=91.205.166.239 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:40.420190-07:00 api-08 sshd[64959]: Received disconnect from 192.142.42.15 port 63933:11: Bye Bye [preauth] 2026-10-09T13:17:40.445783-07:00 db-replica app[30723]: INFO order 97720 confirmed for müller in 7152 ms (region eu-west-1, queue orders) 2026-10-09T13:17:40.668715-07:00 cache-3 sshd[43295]: Connection closed by 172.143.185.53 port 25629 [preauth] 2026-10-09T13:17:40.696056-07:00 worker-12 nginx[1204]: 203.68.242.120 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 3450 "-" "kube-probe/1.31" 2026-10-09T13:17:40.722912-07:00 cache-3 nginx[1201]: 10.177.236.254 - - "GET /.env HTTP/1.1" 302 45942 "-" "kube-probe/1.31" 2026-10-09T13:17:40.751675-07:00 web-02 postgres[27588]: LOG: duration: 5752.657 ms statement: SELECT * FROM orders WHERE customer_id = 52556 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:40.766752-07:00 web-03 nginx[1206]: 45.236.191.129 - - "GET /api/v2/users HTTP/1.1" 401 7611 "-" "curl/8.4.0" 2026-10-09T13:17:40.966552-07:00 api-08 postgres[18393]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 71932 remain, 2524 scanned (87% of total) 2026-10-09T13:17:41.016109-07:00 web-01 nginx[1209]: 10.228.190.235 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 9117 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:41.079196-07:00 web-02 postgres[25296]: LOG: duration: 856.614 ms statement: SELECT * FROM orders WHERE customer_id = 46628 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:41.183719-07:00 api-08 app[30681]: INFO worker 89 finished job 49d836a739e42cb6 in 2964 ms 2026-10-09T13:17:41.196505-07:00 web-02 nginx[1202]: 172.111.78.173 - - "GET /static/main.css HTTP/1.1" 200 44770 "-" "kube-probe/1.31" 2026-10-09T13:17:41.359791-07:00 bastion app[30565]: INFO worker 57 finished job 18453a7337eb015e in 7376 ms 2026-10-09T13:17:41.449085-07:00 db-primary postgres[14237]: LOG: duration: 8665.147 ms statement: SELECT * FROM orders WHERE customer_id = 15475 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:41.663365-07:00 api-07 kernel: [77079.901787] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.205.222.231 DST=10.0.426.426 LEN=62 TOS=0x00 PREC=0x00 TTL=62 ID=77079 DF PROTO=TCP SPT=4027 DPT=4027 WINDOW=77079 RES=0x00 SYN URGP=0 2026-10-09T13:17:41.683974-07:00 web-01 cron[55346]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:17:41.833203-07:00 api-07 sshd[13340]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:17:41.924575-07:00 api-08 sshd[34957]: Received disconnect from 45.169.182.136 port 44945:11: Bye Bye [preauth] 2026-10-09T13:17:42.064099-07:00 web-03 app[30005]: INFO worker 13 picked job f3bde15836d0af6b from queue webhooks 2026-10-09T13:17:42.337891-07:00 edge-fr-1 sshd[16042]: pam_unix(sshd:session): session opened for user priya(uid=7353) by (uid=0) 2026-10-09T13:17:42.365199-07:00 db-primary sshd[9577]: Connection closed by 203.49.100.65 port 56946 [preauth] 2026-10-09T13:17:42.439577-07:00 api-08 postgres[27275]: LOG: duration: 4287.193 ms statement: SELECT * FROM orders WHERE customer_id = 96049 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:42.688516-07:00 web-02 nginx[1209]: 10.194.122.45 - deploy "POST /api/v2/users HTTP/1.1" 500 73350 "-" "curl/8.4.0" 2026-10-09T13:17:42.954662-07:00 db-primary app[30841]: INFO request_id=ad7348691304445c method=GET path=/api/v2/orders status=404 duration=90ms 2026-10-09T13:17:43.105516-07:00 api-07 kernel: [74844.288053] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.102.116.201 DST=10.0.541.541 LEN=94 TOS=0x00 PREC=0x00 TTL=94 ID=74844 DF PROTO=TCP SPT=8597 DPT=8597 WINDOW=74844 RES=0x00 SYN URGP=0 2026-10-09T13:17:43.148988-07:00 api-07 systemd[1]: session-92101.scope: Deactivated successfully. 2026-10-09T13:17:43.293070-07:00 web-03 sshd[47447]: Accepted publickey for akira from 203.2.176.168 port 19116 ssh2: ED25519 SHA256:bbb52f3650a47ea5 2026-10-09T13:17:43.343905-07:00 worker-12 haproxy[911]: 203.35.30.102:40512 [34325] http-in app/worker-12 447/0/49/49/447 200 61565 - - ---- 210/210/90/90/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:17:43.422357-07:00 api-07 haproxy[915]: 172.184.149.73:18148 [31798] http-in app/worker-12 3235/0/665/665/3235 200 1148 - - ---- 136/136/28/28/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:17:43.447906-07:00 web-02 app[30128]: INFO request_id=a813e8d0ae663557 method=GET path=/api/v2/search?q=invoice status=200 duration=9452ms 2026-10-09T13:17:43.461947-07:00 web-02 haproxy[935]: 203.30.69.143:50011 [89951] http-in app/db-replica 4340/0/567/567/4340 301 9425 - - ---- 249/249/26/26/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:43.533157-07:00 edge-fr-1 cron[590]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:17:43.552170-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577063.186:16168): pid=16168 uid=0 auid=1054 ses=970 msg='op=login id=1054 exe="/usr/sbin/sshd" hostname=? addr=91.152.193.25 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:43.726478-07:00 web-03 nginx[1200]: 203.85.116.240 - - "GET /static/app.js HTTP/1.1" 200 857 "-" "python-requests/2.32.3" 2026-10-09T13:17:43.806678-07:00 db-primary app[30617]: INFO worker 48 finished job 813b0b37d82db17d in 5462 ms 2026-10-09T13:17:43.889509-07:00 api-08 postgres[8600]: LOG: duration: 9677.501 ms statement: SELECT * FROM orders WHERE customer_id = 36513 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:43.959979-07:00 api-07 app[30185]: INFO worker 33 finished job 368c14d38869ae00 in 3693 ms 2026-10-09T13:17:44.035034-07:00 web-02 nginx[1203]: 203.22.38.32 - root "POST /.env HTTP/1.1" 200 28076 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:44.202374-07:00 web-03 sshd[36138]: Accepted publickey for backup from 203.119.27.96 port 13975 ssh2: ED25519 SHA256:8be7b1a7dfbd90f1 2026-10-09T13:17:44.339176-07:00 worker-12 app[30626]: INFO request_id=1804553bbae24510 method=GET path=/api/v2/search?q=invoice status=404 duration=3626ms 2026-10-09T13:17:44.395647-07:00 edge-fr-1 app[30016]: INFO order 62012 confirmed for akira in 7851 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:44.399709-07:00 web-01 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:17:44.641999-07:00 web-03 systemd[1]: Started Session 78965 of User sørensen. 2026-10-09T13:17:44.688647-07:00 api-07 haproxy[924]: 45.151.36.45:24388 [36370] http-in app/bastion 4598/0/743/743/4598 404 78422 - - ---- 150/150/99/99/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:17:44.723145-07:00 web-01 app[30735]: INFO order 80984 confirmed for françois in 6402 ms (region eu-west-1, queue invoices) 2026-10-09T13:17:44.805646-07:00 api-07 postgres[29533]: LOG: duration: 3457.354 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:44.822970-07:00 edge-fr-1 nginx[1204]: 203.173.221.112 - - "GET /static/app.js HTTP/1.1" 401 23083 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:45.530403-07:00 edge-fr-1 app[30156]: INFO order 82367 confirmed for françois in 6305 ms (region eu-west-1, queue emails) 2026-10-09T13:17:45.620110-07:00 bastion kubelet[800]: I1009 13:17:45.314773 6610 kubelet.go:6610] "Pod is terminating, skipping pod status update" pod="default/api-ef53f7e89dca2f7a" 2026-10-09T13:17:45.686419-07:00 db-replica app[30426]: INFO order 58635 confirmed for françois in 1723 ms (region ap-northeast-1, queue emails) 2026-10-09T13:17:45.880782-07:00 web-03 sshd[32069]: Connection closed by 172.121.206.6 port 53270 [preauth] 2026-10-09T13:17:46.133919-07:00 bastion app[30731]: INFO worker 10 finished job 11b31b155dc30944 in 5991 ms 2026-10-09T13:17:46.137637-07:00 db-replica cron[23225]: (root) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:17:46.226656-07:00 db-replica cron[4256]: (ci) CMD (/usr/bin/backup --quiet --target /srv/ci) 2026-10-09T13:17:46.296382-07:00 web-01 nginx[1208]: 203.164.106.125 - - "GET /metrics HTTP/1.1" 404 12059 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:46.481367-07:00 cache-3 postgres[16062]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 10520 remain, 3237 scanned (91% of total) 2026-10-09T13:17:46.548908-07:00 web-01 app[30642]: INFO request_id=e7eb537a7ae3cbf7 method=GET path=/login status=404 duration=6370ms 2026-10-09T13:17:46.668972-07:00 edge-fr-1 haproxy[919]: 172.226.201.90:49668 [44242] http-in app/edge-fr-1 492/0/651/651/492 401 4680 - - ---- 779/779/51/51/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:17:46.774490-07:00 bastion systemd[1]: session-50595.scope: Deactivated successfully. 2026-10-09T13:17:46.849300-07:00 edge-fr-1 haproxy[933]: Server app/web-02 is UP, reason: Layer7 check passed, code: 200, check duration: 400ms. 61 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:17:47.133923-07:00 cache-3 app[30630]: INFO request_id=b4857745cafc1f0c method=GET path=/static/app.js status=401 duration=8791ms 2026-10-09T13:17:47.174623-07:00 web-03 postgres[31407]: LOG: duration: 4706.254 ms statement: SELECT * FROM orders WHERE customer_id = 12833 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:47.540884-07:00 edge-fr-1 nginx[1202]: 45.107.107.181 - ci "POST /favicon.ico HTTP/1.1" 200 6466 "-" "curl/8.4.0" 2026-10-09T13:17:47.715111-07:00 cache-3 sshd[19707]: Connection closed by 192.226.216.126 port 8277 [preauth] 2026-10-09T13:17:47.836206-07:00 worker-12 kernel: [32480.423759] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.56.184.32 DST=10.0.334.334 LEN=12 TOS=0x00 PREC=0x00 TTL=12 ID=32480 DF PROTO=TCP SPT=17314 DPT=17314 WINDOW=32480 RES=0x00 SYN URGP=0 2026-10-09T13:17:47.929025-07:00 db-primary nginx[1204]: 192.43.13.75 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 34873 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:47.979857-07:00 db-primary sshd[59071]: Received disconnect from 10.187.121.227 port 18935:11: Bye Bye [preauth] 2026-10-09T13:17:48.038283-07:00 edge-fr-1 haproxy[916]: 91.136.112.124:23710 [15881] http-in app/db-replica 1319/0/514/514/1319 302 88637 - - ---- 761/761/15/15/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:17:48.156974-07:00 api-08 nginx[1207]: 172.0.205.220 - root "POST /health HTTP/1.1" 204 88086 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:48.341898-07:00 api-07 nginx[1204]: 192.74.206.247 - - "GET /favicon.ico HTTP/1.1" 500 53793 "-" "Go-http-client/1.1" 2026-10-09T13:17:48.551951-07:00 bastion app[30323]: INFO health check ok: db 447 ms, cache 447 ms, queue depth 40 2026-10-09T13:17:48.708713-07:00 api-08 app[30372]: ERROR payment declined for order 40156: card_declined (code 13), customer notified 2026-10-09T13:17:48.871003-07:00 web-03 systemd[1]: Started Session 87351 of User backup. 2026-10-09T13:17:49.123541-07:00 cache-3 haproxy[940]: 172.88.99.88:6798 [30512] http-in app/db-primary 7159/0/879/879/7159 500 53992 - - ---- 465/465/50/50/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:17:49.357057-07:00 web-01 nginx[1202]: 45.183.245.134 - backup "POST /favicon.ico HTTP/1.1" 200 49277 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:49.371983-07:00 worker-12 app[30746]: DEBUG cache hit ratio 5% over the last minute (79329 lookups) 2026-10-09T13:17:49.466375-07:00 api-08 app[30414]: INFO order 27613 confirmed for müller in 9490 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:17:49.497524-07:00 web-02 app[30832]: INFO health check ok: db 600 ms, cache 600 ms, queue depth 76 2026-10-09T13:17:49.670723-07:00 api-08 nginx[1200]: 203.225.53.133 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 3165 "-" "Go-http-client/1.1" 2026-10-09T13:17:49.705344-07:00 db-replica haproxy[929]: 172.106.179.13:10765 [78431] http-in app/bastion 1183/0/183/183/1183 200 41218 - - ---- 614/614/89/89/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:17:49.951787-07:00 edge-fr-1 app[30066]: INFO health check ok: db 858 ms, cache 858 ms, queue depth 72 2026-10-09T13:17:49.959962-07:00 web-01 nginx[1208]: 10.201.249.159 - - "GET /wp-login.php HTTP/1.1" 302 73356 "-" "python-requests/2.32.3" 2026-10-09T13:17:50.003315-07:00 worker-12 nginx[1206]: 192.142.1.160 - zoë "POST /static/main.css HTTP/1.1" 200 64149 "-" "python-requests/2.32.3" 2026-10-09T13:17:50.058513-07:00 edge-fr-1 kernel: [87540.865929] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.210.151.182 DST=10.0.124.124 LEN=63 TOS=0x00 PREC=0x00 TTL=63 ID=87540 DF PROTO=TCP SPT=33684 DPT=33684 WINDOW=87540 RES=0x00 SYN URGP=0 2026-10-09T13:17:50.138082-07:00 edge-fr-1 systemd[1]: Started Session 35693 of User akira. 2026-10-09T13:17:50.271137-07:00 web-02 app[30293]: INFO request_id=4f092592c1c456c4 method=GET path=/login status=404 duration=3001ms 2026-10-09T13:17:50.301178-07:00 cache-3 sshd[31404]: Connection closed by 192.225.26.202 port 3456 [preauth] 2026-10-09T13:17:50.469137-07:00 db-replica sshd[29490]: Connection closed by 10.133.204.72 port 62274 [preauth] 2026-10-09T13:17:50.500398-07:00 api-08 haproxy[945]: 10.30.153.67:2901 [44874] http-in app/db-primary 6107/0/102/102/6107 200 18281 - - ---- 582/582/39/39/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:17:50.669100-07:00 api-07 sshd[40498]: Accepted publickey for sørensen from 10.96.135.195 port 30422 ssh2: ED25519 SHA256:1d0bdd7f46331ec2 2026-10-09T13:17:50.766396-07:00 db-replica nginx[1207]: 192.174.155.136 - françois "POST /login HTTP/1.1" 500 45395 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:50.904725-07:00 web-01 haproxy[924]: 91.1.151.138:43689 [91081] http-in app/web-01 7167/0/881/881/7167 301 25233 - - ---- 335/335/97/97/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:17:51.107753-07:00 db-replica nginx[1209]: 45.162.220.107 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 73515 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:51.353059-07:00 api-08 haproxy[926]: 10.167.155.210:20714 [82400] http-in app/db-primary 4121/0/583/583/4121 200 52391 - - ---- 199/199/87/87/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:17:51.379227-07:00 web-03 app[30371]: WARN retrying upstream 91.176.13.46:35728 after timeout (3542 ms), attempt 2 of 3 2026-10-09T13:17:51.541506-07:00 worker-12 app[30870]: INFO request_id=59e38fbd994138b1 method=GET path=/api/v2/search?q=invoice status=200 duration=9935ms 2026-10-09T13:17:51.551628-07:00 web-01 app[30361]: INFO request_id=8c955436e8b43a54 method=GET path=/static/main.css status=500 duration=4902ms 2026-10-09T13:17:51.650278-07:00 web-03 app[30356]: INFO worker 42 picked job eb603b79e2068140 from queue invoices 2026-10-09T13:17:51.774750-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791577071.103:98617): pid=98617 uid=0 auid=7832 ses=736 msg='op=login id=7832 exe="/usr/sbin/sshd" hostname=? addr=203.25.223.187 terminal=/dev/pts/0 res=success' 2026-10-09T13:17:51.903560-07:00 web-02 app[30129]: INFO worker 10 picked job ee8002f4f1c54a51 from queue webhooks 2026-10-09T13:17:51.966491-07:00 db-primary sshd[1307]: Connection closed by 192.78.185.3 port 32358 [preauth] 2026-10-09T13:17:52.008213-07:00 web-01 sshd[47274]: Connection closed by 192.228.23.250 port 50486 [preauth] 2026-10-09T13:17:52.172248-07:00 web-03 app[30391]: INFO worker 11 finished job d4d4eb122818cfa4 in 6118 ms 2026-10-09T13:17:52.306804-07:00 cache-3 sshd[36476]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:17:52.472832-07:00 edge-fr-1 app[30273]: INFO request_id=0b287ee0b376f980 method=GET path=/wp-login.php status=502 duration=9539ms 2026-10-09T13:17:52.537701-07:00 web-01 app[30011]: INFO order 55478 confirmed for zoë in 1620 ms (region us-east-1, queue webhooks) 2026-10-09T13:17:52.543802-07:00 api-07 app[30374]: INFO worker 37 picked job dce7377a938042b2 from queue emails 2026-10-09T13:17:52.928169-07:00 web-01 haproxy[906]: 172.130.21.164:44163 [70001] http-in app/edge-fr-1 2514/0/993/993/2514 200 86586 - - ---- 469/469/25/25/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:52.928593-07:00 web-02 systemd[1]: Started Session 80953 of User deploy. 2026-10-09T13:17:53.074446-07:00 db-primary systemd[1]: Started Session 98915 of User zoë. 2026-10-09T13:17:53.316305-07:00 api-08 nginx[1209]: 192.254.146.209 - - "GET /static/app.js HTTP/1.1" 204 53286 "-" "Go-http-client/1.1" 2026-10-09T13:17:53.848143-07:00 db-primary nginx[1208]: 192.238.192.122 - - "GET /login HTTP/1.1" 200 8578 "-" "Go-http-client/1.1" 2026-10-09T13:17:54.053982-07:00 cache-3 postgres[23141]: LOG: duration: 3136.28 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:54.217594-07:00 worker-12 app[30660]: INFO request_id=94978fcfc47d7847 method=GET path=/api/v2/orders status=200 duration=1590ms 2026-10-09T13:17:54.232588-07:00 edge-fr-1 app[30319]: INFO order 30799 confirmed for backup in 4514 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:17:54.438737-07:00 api-07 app[30089]: INFO request_id=85f28fc83a8162d9 method=GET path=/health status=200 duration=2470ms 2026-10-09T13:17:54.463625-07:00 db-primary systemd[1]: session-53636.scope: Deactivated successfully. 2026-10-09T13:17:54.497451-07:00 worker-12 sshd[49100]: Received disconnect from 192.27.147.169 port 16661:11: Bye Bye [preauth] 2026-10-09T13:17:54.772888-07:00 cache-3 haproxy[909]: 192.12.87.65:41276 [45151] http-in app/bastion 2344/0/7/7/2344 200 31438 - - ---- 114/114/70/70/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:17:54.789442-07:00 worker-12 app[30404]: INFO request_id=554046fa833bac2b method=GET path=/static/app.js status=200 duration=7336ms 2026-10-09T13:17:54.822112-07:00 edge-fr-1 sshd[29500]: Connection closed by 172.62.201.63 port 26299 [preauth] 2026-10-09T13:17:55.138203-07:00 web-03 app[30310]: INFO request_id=ff55c4c0a7faaedb method=GET path=/api/v2/search?q=invoice status=401 duration=9086ms 2026-10-09T13:17:55.140476-07:00 db-primary postgres[25879]: LOG: duration: 5159.962 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:55.180540-07:00 bastion nginx[1208]: 203.157.181.19 - - "GET /admin HTTP/1.1" 301 75224 "-" "curl/8.4.0" 2026-10-09T13:17:55.292381-07:00 web-03 postgres[21154]: LOG: duration: 6110.407 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:17:55.316316-07:00 db-replica sshd[11496]: Connection closed by 45.29.27.121 port 15344 [preauth] 2026-10-09T13:17:55.828517-07:00 web-03 nginx[1203]: 91.96.38.250 - - "GET /static/main.css HTTP/1.1" 500 89878 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:17:55.839688-07:00 web-02 app[30564]: INFO order 70759 confirmed for sørensen in 734 ms (region eu-west-1, queue webhooks) 2026-10-09T13:17:55.934135-07:00 web-03 app[30421]: INFO order 50676 confirmed for ci in 1631 ms (region eu-west-1, queue orders) 2026-10-09T13:17:55.989380-07:00 bastion nginx[1201]: 192.207.164.89 - - "GET /api/v2/users HTTP/1.1" 502 53152 "-" "Go-http-client/1.1" 2026-10-09T13:17:56.061133-07:00 worker-12 app[30311]: WARN retrying upstream 192.33.9.235:28108 after timeout (2241 ms), attempt 1 of 3 2026-10-09T13:17:56.086202-07:00 edge-fr-1 haproxy[906]: 10.25.188.141:63490 [41357] http-in app/worker-12 9651/0/215/215/9651 204 60782 - - ---- 823/823/53/53/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:17:56.471252-07:00 bastion app[30273]: INFO worker 34 finished job c83aaf9b32594a56 in 1659 ms 2026-10-09T13:17:56.493233-07:00 db-primary nginx[1209]: 45.99.221.149 - - "GET /metrics HTTP/1.1" 200 57261 "-" "Go-http-client/1.1" 2026-10-09T13:17:56.669256-07:00 worker-12 app[30054]: INFO worker 66 finished job 009eace7506c3a0d in 7003 ms 2026-10-09T13:17:56.670699-07:00 edge-fr-1 nginx[1208]: 91.190.108.61 - - "GET /.env HTTP/1.1" 302 38447 "-" "python-requests/2.32.3" 2026-10-09T13:17:56.937699-07:00 api-08 app[30410]: INFO request_id=d6a0cd6b90f1e79f method=GET path=/metrics status=401 duration=7623ms 2026-10-09T13:17:57.068241-07:00 edge-fr-1 postgres[13560]: LOG: duration: 3819.894 ms statement: SELECT * FROM orders WHERE customer_id = 12409 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:17:57.480481-07:00 edge-fr-1 kernel: [60571.984277] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.253.188.201 DST=10.0.586.586 LEN=83 TOS=0x00 PREC=0x00 TTL=83 ID=60571 DF PROTO=TCP SPT=58911 DPT=58911 WINDOW=60571 RES=0x00 SYN URGP=0 2026-10-09T13:17:57.556024-07:00 db-replica app[30907]: INFO worker 27 picked job 70e668da27dea8ef from queue orders 2026-10-09T13:17:57.643337-07:00 db-replica haproxy[911]: 10.95.19.149:63749 [95032] http-in app/web-02 5122/0/625/625/5122 204 79893 - - ---- 766/766/20/20/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:17:57.669446-07:00 web-01 nginx[1201]: 172.25.149.112 - - "GET /metrics HTTP/1.1" 204 28156 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:57.704567-07:00 web-03 nginx[1206]: 192.120.240.82 - - "GET /health HTTP/1.1" 404 44898 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:17:57.711085-07:00 web-03 nginx[1209]: 91.242.48.239 - - "GET /static/app.js HTTP/1.1" 200 6339 "-" "kube-probe/1.31" 2026-10-09T13:17:57.901069-07:00 db-primary app[30112]: INFO order 90745 confirmed for deploy in 5322 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:17:57.910778-07:00 api-07 nginx[1206]: 10.62.217.170 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 27737 "-" "python-requests/2.32.3" 2026-10-09T13:17:57.991299-07:00 edge-fr-1 app[30536]: INFO worker 61 finished job 0d40e26cbe36290e in 5786 ms 2026-10-09T13:17:58.149168-07:00 cache-3 app[30222]: INFO worker 41 finished job 160010b80a34430a in 154 ms 2026-10-09T13:17:58.180377-07:00 api-08 app[30532]: INFO worker 66 picked job ebe1acd4a1e625fc from queue orders 2026-10-09T13:17:58.215142-07:00 db-primary app[30139]: INFO request_id=d3c2381ed2e14f57 method=GET path=/api/v2/search?q=invoice status=302 duration=862ms 2026-10-09T13:17:58.235268-07:00 db-primary haproxy[932]: 172.152.2.254:19017 [30483] http-in app/worker-12 9298/0/665/665/9298 204 36730 - - ---- 267/267/50/50/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:17:58.263655-07:00 api-07 nginx[1204]: 10.18.48.74 - - "GET /admin HTTP/1.1" 404 40030 "-" "curl/8.4.0" 2026-10-09T13:17:58.320715-07:00 api-07 haproxy[945]: 10.14.124.185:52676 [75440] http-in app/api-07 1304/0/916/916/1304 500 73149 - - ---- 284/284/25/25/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:17:58.362366-07:00 worker-12 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.39.105.115, server: app.example.com, request: "GET /api/v2/users HTTP/1.1", upstream: "http://10.0.298.298:8080/api/v2/users" 2026-10-09T13:17:58.965173-07:00 bastion app[30492]: INFO request_id=fafbc7b6a2fe0d57 method=GET path=/.env status=404 duration=36ms 2026-10-09T13:17:58.967017-07:00 cache-3 nginx[1207]: 172.248.64.2 - - "GET /.env HTTP/1.1" 200 6162 "-" "kube-probe/1.31" 2026-10-09T13:17:59.010978-07:00 db-primary sshd[23354]: Accepted publickey for backup from 172.240.149.227 port 48855 ssh2: ED25519 SHA256:a478d9af7a3e4211 2026-10-09T13:17:59.020600-07:00 web-02 app[30941]: INFO order 16208 confirmed for deploy in 4134 ms (region us-east-1, queue webhooks) 2026-10-09T13:17:59.149165-07:00 web-03 app[30288]: INFO request_id=4ae2f82296783270 method=GET path=/metrics status=200 duration=9194ms 2026-10-09T13:17:59.159402-07:00 web-02 kernel: [76766.109647] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.20.192.32 DST=10.0.285.285 LEN=11 TOS=0x00 PREC=0x00 TTL=11 ID=76766 DF PROTO=TCP SPT=2714 DPT=2714 WINDOW=76766 RES=0x00 SYN URGP=0 2026-10-09T13:17:59.207009-07:00 web-03 sshd[32748]: Failed password for invalid user müller from 91.206.239.79 port 29063 ssh2 2026-10-09T13:17:59.464038-07:00 web-02 sshd[34510]: Failed password for invalid user deploy from 172.59.74.32 port 60228 ssh2 2026-10-09T13:17:59.509164-07:00 api-07 app[30199]: INFO worker 17 finished job e08a3346ddffb160 in 2083 ms 2026-10-09T13:17:59.577480-07:00 cache-3 app[30102]: INFO worker 15 picked job de8e334788c931d2 from queue orders 2026-10-09T13:17:59.606334-07:00 edge-fr-1 app[30564]: INFO health check ok: db 706 ms, cache 706 ms, queue depth 52 2026-10-09T13:17:59.939397-07:00 bastion haproxy[938]: 192.252.90.99:55925 [53833] http-in app/api-08 107/0/518/518/107 301 30586 - - ---- 338/338/91/91/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:18:00.190962-07:00 web-02 haproxy[929]: 172.192.165.184:13324 [40104] http-in app/db-primary 1352/0/998/998/1352 404 8798 - - ---- 879/879/60/60/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:18:00.708453-07:00 db-replica sshd[4580]: Connection closed by 172.31.44.214 port 27916 [preauth] 2026-10-09T13:18:00.750212-07:00 api-08 app[30503]: INFO worker 13 finished job 31a133e85f23bfd7 in 7050 ms 2026-10-09T13:18:00.761218-07:00 web-02 app[30359]: WARN retrying upstream 192.5.91.92:6722 after timeout (2548 ms), attempt 2 of 3 2026-10-09T13:18:01.040544-07:00 web-02 app[30500]: ERROR payment declined for order 77951: card_declined (code 75), customer notified 2026-10-09T13:18:01.053887-07:00 cache-3 sshd[14585]: pam_unix(sshd:session): session opened for user deploy(uid=2213) by (uid=0) 2026-10-09T13:18:01.068215-07:00 db-replica postgres[4010]: LOG: duration: 899.329 ms statement: SELECT * FROM orders WHERE customer_id = 60612 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:01.135063-07:00 db-replica postgres[19810]: LOG: duration: 1497.743 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:01.275054-07:00 worker-12 haproxy[910]: 45.251.33.122:43043 [89215] http-in app/web-03 6246/0/266/266/6246 200 75086 - - ---- 994/994/45/45/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:01.411994-07:00 web-02 app[30367]: INFO worker 59 finished job c4eb12416e701884 in 3428 ms 2026-10-09T13:18:01.444348-07:00 web-03 nginx[1200]: 45.101.229.114 - - "GET /metrics HTTP/1.1" 404 79723 "-" "kube-probe/1.31" 2026-10-09T13:18:01.559608-07:00 web-01 nginx[1201]: 91.34.123.215 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 4088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:01.603176-07:00 edge-fr-1 app[30831]: INFO order 12059 confirmed for ci in 162 ms (region eu-west-1, queue invoices) 2026-10-09T13:18:01.683312-07:00 edge-fr-1 nginx[1210]: 91.86.68.65 - müller "POST /static/main.css HTTP/1.1" 401 35248 "-" "curl/8.4.0" 2026-10-09T13:18:01.920006-07:00 worker-12 app[30209]: INFO request_id=a4195ca5055ae3d7 method=GET path=/static/main.css status=204 duration=3379ms 2026-10-09T13:18:02.074160-07:00 web-01 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:18:02.267828-07:00 web-01 app[30619]: INFO request_id=472d1e57984d5ec6 method=GET path=/api/v2/users status=200 duration=1918ms 2026-10-09T13:18:02.359545-07:00 web-01 nginx[1208]: 45.1.112.183 - - "GET /login HTTP/1.1" 302 23419 "-" "curl/8.4.0" 2026-10-09T13:18:02.477722-07:00 web-03 app[30723]: INFO worker 13 picked job e2a1c161997c224f from queue emails 2026-10-09T13:18:02.756368-07:00 db-replica haproxy[937]: 192.65.24.254:63036 [22004] http-in app/worker-12 5166/0/999/999/5166 302 8229 - - ---- 470/470/23/23/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:18:02.783795-07:00 cache-3 app[30456]: INFO request_id=f7dbbbec93e9c4ee method=GET path=/api/v2/orders status=200 duration=4364ms 2026-10-09T13:18:02.824271-07:00 edge-fr-1 kubelet[800]: I1009 13:18:02.035825 6287 kubelet.go:6287] "Pod is terminating, skipping pod status update" pod="default/api-092bb7d3a16f4dff" 2026-10-09T13:18:02.988090-07:00 api-07 haproxy[912]: 203.44.111.131:32807 [35375] http-in app/worker-12 4971/0/822/822/4971 204 70672 - - ---- 312/312/10/10/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:03.076328-07:00 api-07 app[30740]: INFO order 68719 confirmed for sørensen in 9720 ms (region eu-west-1, queue invoices) 2026-10-09T13:18:03.087358-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577083.122:11409): pid=11409 uid=0 auid=6649 ses=529 msg='op=login id=6649 exe="/usr/sbin/sshd" hostname=? addr=203.57.128.173 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:03.232410-07:00 web-02 sshd[51358]: Failed password for invalid user sørensen from 91.7.59.188 port 12240 ssh2 2026-10-09T13:18:03.234202-07:00 edge-fr-1 nginx[1208]: 91.178.92.7 - - "GET /static/app.js HTTP/1.1" 200 51813 "-" "curl/8.4.0" 2026-10-09T13:18:03.301323-07:00 edge-fr-1 app[30738]: INFO order 53664 confirmed for backup in 2861 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:03.309280-07:00 web-02 app[30384]: WARN slow query (4975 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '83 minutes' 2026-10-09T13:18:03.320706-07:00 worker-12 nginx[1210]: 192.217.26.124 - - "GET /static/main.css HTTP/1.1" 401 8180 "-" "kube-probe/1.31" 2026-10-09T13:18:03.600179-07:00 web-01 sshd[21407]: Failed password for invalid user ci from 45.28.128.156 port 23299 ssh2 2026-10-09T13:18:03.683641-07:00 worker-12 nginx[1210]: 192.179.115.103 - root "POST /api/v2/search?q=invoice HTTP/1.1" 401 59778 "-" "kube-probe/1.31" 2026-10-09T13:18:03.786744-07:00 web-02 sshd[24966]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:18:04.091557-07:00 db-primary app[30778]: INFO request_id=b7508c52a42dc355 method=GET path=/static/app.js status=401 duration=9508ms 2026-10-09T13:18:04.179891-07:00 db-replica systemd[1]: Started Session 30252 of User müller. 2026-10-09T13:18:04.223219-07:00 db-replica app[30415]: INFO worker 13 picked job 2bc044942289b3d9 from queue webhooks 2026-10-09T13:18:04.260740-07:00 edge-fr-1 nginx[1204]: 45.30.223.235 - - "GET /static/app.js HTTP/1.1" 404 82541 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:04.271118-07:00 edge-fr-1 sshd[17565]: Invalid user deploy from 192.84.139.119 port 55243 2026-10-09T13:18:04.470115-07:00 bastion app[30054]: INFO request_id=0cc32e03d7ffb46c method=GET path=/api/v2/users status=302 duration=4792ms 2026-10-09T13:18:04.517762-07:00 web-02 app[30426]: INFO request_id=3170d48c6a844eb3 method=GET path=/api/v2/search?q=invoice status=404 duration=7280ms 2026-10-09T13:18:04.534192-07:00 edge-fr-1 nginx[1202]: 91.244.81.39 - - "GET /wp-login.php HTTP/1.1" 401 74867 "-" "Go-http-client/1.1" 2026-10-09T13:18:04.980936-07:00 api-08 haproxy[941]: 192.200.125.97:57135 [24460] http-in app/api-08 7975/0/903/903/7975 200 78226 - - ---- 917/917/34/34/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:05.048495-07:00 web-03 nginx[1209]: 172.6.101.83 - ci "POST /favicon.ico HTTP/1.1" 404 61068 "-" "python-requests/2.32.3" 2026-10-09T13:18:05.091602-07:00 web-01 nginx[1201]: 203.202.170.162 - - "GET /login HTTP/1.1" 200 55235 "-" "kube-probe/1.31" 2026-10-09T13:18:05.121943-07:00 db-replica haproxy[910]: 10.76.11.61:49556 [65738] http-in app/db-replica 6851/0/171/171/6851 502 24801 - - ---- 156/156/71/71/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:18:05.374556-07:00 cache-3 nginx[1207]: 172.111.73.122 - - "GET /health HTTP/1.1" 401 80984 "-" "Go-http-client/1.1" 2026-10-09T13:18:05.456283-07:00 db-replica app[30794]: INFO order 66207 confirmed for backup in 3345 ms (region eu-west-1, queue emails) 2026-10-09T13:18:05.501322-07:00 db-primary nginx[1203]: 10.24.49.24 - - "GET /static/main.css HTTP/1.1" 404 51580 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:05.808255-07:00 api-07 haproxy[929]: 172.145.232.167:8674 [70942] http-in app/web-03 478/0/444/444/478 302 17857 - - ---- 760/760/34/34/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:18:05.860731-07:00 worker-12 app[30130]: INFO request_id=1a33accbdfb82f14 method=GET path=/static/main.css status=301 duration=5947ms 2026-10-09T13:18:05.923253-07:00 db-primary app[30101]: INFO order 39660 confirmed for priya in 2035 ms (region ap-northeast-1, queue orders) 2026-10-09T13:18:05.935854-07:00 bastion kernel: [51478.458387] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.108.233.253 DST=10.0.363.363 LEN=89 TOS=0x00 PREC=0x00 TTL=89 ID=51478 DF PROTO=TCP SPT=22497 DPT=22497 WINDOW=51478 RES=0x00 SYN URGP=0 2026-10-09T13:18:06.103166-07:00 db-replica app[30824]: INFO request_id=cf42738ea7b17962 method=GET path=/health status=200 duration=2185ms 2026-10-09T13:18:06.311784-07:00 db-replica app[30619]: INFO request_id=614e9613a07b9677 method=GET path=/wp-login.php status=301 duration=6198ms 2026-10-09T13:18:06.342215-07:00 db-primary nginx[1208]: 10.98.45.5 - - "GET /wp-login.php HTTP/1.1" 502 85724 "-" "Go-http-client/1.1" 2026-10-09T13:18:06.342411-07:00 api-07 haproxy[914]: 45.134.190.218:57107 [57844] http-in app/cache-3 1040/0/736/736/1040 502 66617 - - ---- 537/537/82/82/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:06.469632-07:00 edge-fr-1 app[30538]: INFO health check ok: db 794 ms, cache 794 ms, queue depth 44 2026-10-09T13:18:06.647634-07:00 db-replica app[30248]: INFO request_id=02d5277a423a6a09 method=GET path=/wp-login.php status=404 duration=2239ms 2026-10-09T13:18:06.844818-07:00 bastion app[30977]: INFO request_id=ed6f312d68337648 method=GET path=/login status=200 duration=6017ms 2026-10-09T13:18:07.056435-07:00 edge-fr-1 app[30669]: INFO worker 15 finished job fdcc55efeb3fb99e in 3763 ms 2026-10-09T13:18:07.084981-07:00 web-02 app[30947]: INFO health check ok: db 827 ms, cache 827 ms, queue depth 94 2026-10-09T13:18:07.125551-07:00 web-01 app[30926]: INFO worker 67 picked job 63ca247ca4e7d7a4 from queue emails 2026-10-09T13:18:07.234635-07:00 web-03 sshd[36506]: Connection closed by 172.169.136.122 port 20950 [preauth] 2026-10-09T13:18:07.264836-07:00 worker-12 nginx[1206]: 203.119.179.177 - - "GET /admin HTTP/1.1" 200 64898 "-" "python-requests/2.32.3" 2026-10-09T13:18:07.274331-07:00 api-08 nginx[1206]: 203.2.201.46 - deploy "POST /api/v2/orders HTTP/1.1" 204 39183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:07.339658-07:00 worker-12 haproxy[930]: 45.43.160.81:39069 [76105] http-in app/web-01 260/0/799/799/260 200 75402 - - ---- 929/929/48/48/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:07.416002-07:00 cache-3 app[30295]: INFO request_id=3a26e8417a66d571 method=GET path=/api/v2/search?q=invoice status=301 duration=9499ms 2026-10-09T13:18:07.475566-07:00 worker-12 app[30657]: INFO order 34263 confirmed for deploy in 4591 ms (region eu-west-1, queue emails) 2026-10-09T13:18:07.531302-07:00 api-08 app[30860]: INFO request_id=c973498162516574 method=GET path=/login status=500 duration=5692ms 2026-10-09T13:18:07.724429-07:00 web-01 app[30228]: INFO request_id=516c995011c3bf3a method=GET path=/.env status=500 duration=5075ms 2026-10-09T13:18:07.802179-07:00 api-07 kernel: [86013.432022] TCP: request_sock_TCP: Possible SYN flooding on port 5739. Sending cookies. Check SNMP counters. 2026-10-09T13:18:07.838956-07:00 web-01 sshd[25467]: Failed password for invalid user backup from 172.186.130.6 port 8382 ssh2 2026-10-09T13:18:08.011824-07:00 worker-12 systemd[1]: Started Session 44798 of User root. 2026-10-09T13:18:08.108741-07:00 worker-12 nginx[1201]: 45.47.231.119 - deploy "POST /.env HTTP/1.1" 301 14073 "-" "Go-http-client/1.1" 2026-10-09T13:18:08.256436-07:00 web-03 app[30221]: INFO order 60989 confirmed for zoë in 8702 ms (region eu-west-1, queue webhooks) 2026-10-09T13:18:08.310999-07:00 db-replica app[30846]: INFO health check ok: db 1 ms, cache 1 ms, queue depth 61 2026-10-09T13:18:08.380037-07:00 web-03 app[30300]: DEBUG cache hit ratio 44% over the last minute (26602 lookups) 2026-10-09T13:18:08.507307-07:00 worker-12 nginx[1205]: 45.224.42.71 - - "GET /static/main.css HTTP/1.1" 404 71873 "-" "Go-http-client/1.1" 2026-10-09T13:18:08.922366-07:00 db-replica app[30346]: INFO request_id=f0d77ba8257368aa method=GET path=/metrics status=302 duration=4408ms 2026-10-09T13:18:09.032328-07:00 bastion nginx[1202]: 91.237.45.203 - - "GET /health HTTP/1.1" 500 65943 "-" "Go-http-client/1.1" 2026-10-09T13:18:09.089618-07:00 edge-fr-1 app[30129]: INFO request_id=0b291e335ed9c196 method=GET path=/favicon.ico status=401 duration=5525ms 2026-10-09T13:18:09.132364-07:00 worker-12 sshd[64620]: Failed password for invalid user françois from 45.184.25.18 port 10210 ssh2 2026-10-09T13:18:09.148755-07:00 api-07 haproxy[900]: 91.171.36.142:17822 [51743] http-in app/bastion 3587/0/559/559/3587 301 6431 - - ---- 540/540/87/87/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:18:09.158225-07:00 api-07 haproxy[906]: 45.4.251.142:34958 [93508] http-in app/db-replica 8037/0/196/196/8037 500 49245 - - ---- 450/450/36/36/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:09.168333-07:00 worker-12 sshd[5595]: Connection closed by 10.62.103.10 port 49203 [preauth] 2026-10-09T13:18:09.204873-07:00 web-01 app[30393]: INFO request_id=3a3dda64c7262418 method=GET path=/admin status=200 duration=2667ms 2026-10-09T13:18:09.231144-07:00 api-07 systemd[1]: session-66627.scope: Deactivated successfully. 2026-10-09T13:18:09.244467-07:00 bastion nginx[1205]: 10.51.239.169 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 44504 "-" "python-requests/2.32.3" 2026-10-09T13:18:09.673914-07:00 api-08 app[30766]: INFO request_id=f7d649f98be8a95d method=GET path=/login status=200 duration=6311ms 2026-10-09T13:18:10.051725-07:00 api-08 sshd[44804]: Connection closed by 203.54.203.76 port 55633 [preauth] 2026-10-09T13:18:10.121087-07:00 web-02 nginx[1207]: 10.34.147.134 - - "GET /api/v2/orders HTTP/1.1" 200 62800 "-" "curl/8.4.0" 2026-10-09T13:18:10.134585-07:00 api-08 nginx[1208]: 203.38.184.228 - - "GET /wp-login.php HTTP/1.1" 401 59487 "-" "python-requests/2.32.3" 2026-10-09T13:18:10.192445-07:00 db-replica app[30658]: INFO order 76801 confirmed for françois in 3177 ms (region us-east-1, queue emails) 2026-10-09T13:18:10.372389-07:00 edge-fr-1 sshd[49400]: Accepted publickey for akira from 10.150.135.116 port 4446 ssh2: ED25519 SHA256:3109c776db014241 2026-10-09T13:18:10.383597-07:00 worker-12 nginx[1203]: 91.48.50.41 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 85438 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:10.400866-07:00 db-primary sshd[58411]: Failed password for invalid user akira from 10.61.196.1 port 35529 ssh2 2026-10-09T13:18:10.761976-07:00 worker-12 nginx[1206]: 45.122.98.73 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 1175 "-" "curl/8.4.0" 2026-10-09T13:18:10.805753-07:00 api-08 cron[57563]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:18:10.972277-07:00 db-replica sshd[12403]: Connection closed by 45.6.34.36 port 53284 [preauth] 2026-10-09T13:18:11.207245-07:00 web-02 postgres[12380]: LOG: duration: 1286.863 ms statement: SELECT * FROM orders WHERE customer_id = 68222 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:11.233360-07:00 edge-fr-1 app[30509]: INFO order 19542 confirmed for deploy in 2186 ms (region us-east-1, queue emails) 2026-10-09T13:18:11.447004-07:00 cache-3 nginx[1203]: 10.45.71.73 - root "POST /health HTTP/1.1" 404 88511 "-" "curl/8.4.0" 2026-10-09T13:18:11.462706-07:00 cache-3 nginx[1209]: 203.11.127.116 - françois "POST /login HTTP/1.1" 502 21842 "-" "kube-probe/1.31" 2026-10-09T13:18:11.703177-07:00 web-01 sshd[25522]: Connection closed by 192.189.128.163 port 32051 [preauth] 2026-10-09T13:18:11.764616-07:00 web-03 app[30234]: INFO worker 95 finished job 5042419761f72d6b in 3740 ms 2026-10-09T13:18:11.918163-07:00 bastion app[30901]: INFO order 55964 confirmed for deploy in 3686 ms (region eu-west-1, queue emails) 2026-10-09T13:18:11.930046-07:00 api-07 sshd[45315]: Failed password for invalid user françois from 91.21.222.15 port 54502 ssh2 2026-10-09T13:18:11.955812-07:00 api-07 kernel: [69369.965914] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.166.15.126 DST=10.0.400.400 LEN=57 TOS=0x00 PREC=0x00 TTL=57 ID=69369 DF PROTO=TCP SPT=35372 DPT=35372 WINDOW=69369 RES=0x00 SYN URGP=0 2026-10-09T13:18:12.013388-07:00 api-08 haproxy[948]: 10.132.3.48:39193 [76302] http-in app/worker-12 2394/0/311/311/2394 502 54355 - - ---- 612/612/37/37/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:18:12.026747-07:00 web-03 nginx[1207]: 203.163.155.31 - zoë "POST /static/main.css HTTP/1.1" 200 61153 "-" "python-requests/2.32.3" 2026-10-09T13:18:12.036451-07:00 edge-fr-1 kernel: [26474.842903] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.0.93.47 DST=10.0.315.315 LEN=30 TOS=0x00 PREC=0x00 TTL=30 ID=26474 DF PROTO=TCP SPT=57864 DPT=57864 WINDOW=26474 RES=0x00 SYN URGP=0 2026-10-09T13:18:12.142677-07:00 worker-12 haproxy[935]: 10.148.72.48:65436 [12955] http-in app/web-02 648/0/946/946/648 200 30541 - - ---- 759/759/81/81/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:12.218487-07:00 web-03 sshd[52574]: Accepted publickey for françois from 10.34.184.15 port 58863 ssh2: ED25519 SHA256:a3b7a1d75a02d25d 2026-10-09T13:18:12.324988-07:00 api-08 app[30318]: WARN retrying upstream 45.121.6.1:28625 after timeout (8388 ms), attempt 3 of 3 2026-10-09T13:18:12.361351-07:00 web-02 app[30995]: INFO worker 79 finished job c03c1a532f18d32b in 4241 ms 2026-10-09T13:18:12.542808-07:00 web-03 app[30259]: INFO order 38619 confirmed for sørensen in 5971 ms (region us-east-1, queue emails) 2026-10-09T13:18:12.560605-07:00 worker-12 sshd[10036]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:18:12.614387-07:00 api-07 kernel: [38154.366334] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.43.14.142 DST=10.0.681.681 LEN=24 TOS=0x00 PREC=0x00 TTL=24 ID=38154 DF PROTO=TCP SPT=26035 DPT=26035 WINDOW=38154 RES=0x00 SYN URGP=0 2026-10-09T13:18:12.633625-07:00 api-08 app[30156]: INFO worker 48 picked job 7ddebc374419a42b from queue orders 2026-10-09T13:18:12.674323-07:00 web-01 nginx[1209]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.145.120.23, server: app.example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.565.565:8080/favicon.ico" 2026-10-09T13:18:12.762869-07:00 web-03 systemd[1]: Started Session 45863 of User deploy. 2026-10-09T13:18:12.886038-07:00 db-replica sshd[59778]: Accepted publickey for sørensen from 172.134.130.245 port 23889 ssh2: ED25519 SHA256:ad2fb33a17575e75 2026-10-09T13:18:12.993365-07:00 edge-fr-1 kernel: [75901.845021] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.18.77.238 DST=10.0.531.531 LEN=91 TOS=0x00 PREC=0x00 TTL=91 ID=75901 DF PROTO=TCP SPT=39498 DPT=39498 WINDOW=75901 RES=0x00 SYN URGP=0 2026-10-09T13:18:13.231238-07:00 api-08 nginx[1202]: 91.186.73.137 - ci "POST /api/v2/orders HTTP/1.1" 500 63623 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:13.248959-07:00 cache-3 sshd[52927]: Accepted publickey for zoë from 10.153.133.155 port 5605 ssh2: ED25519 SHA256:f7af89b0272f69a5 2026-10-09T13:18:13.346492-07:00 web-02 app[30505]: INFO order 98544 confirmed for akira in 4360 ms (region eu-west-1, queue invoices) 2026-10-09T13:18:13.441773-07:00 api-08 nginx[1200]: 45.206.135.70 - - "GET /wp-login.php HTTP/1.1" 200 31550 "-" "Go-http-client/1.1" 2026-10-09T13:18:13.556831-07:00 db-replica app[30348]: INFO worker 56 finished job 1638a1d32f594758 in 8254 ms 2026-10-09T13:18:13.802347-07:00 web-02 sshd[10966]: Connection closed by 91.70.63.170 port 7320 [preauth] 2026-10-09T13:18:13.820010-07:00 cache-3 app[30564]: INFO request_id=f3f86cbbae224c3d method=GET path=/api/v2/orders status=404 duration=7183ms 2026-10-09T13:18:13.842278-07:00 api-07 postgres[2277]: LOG: duration: 3940.17 ms statement: SELECT * FROM orders WHERE customer_id = 43407 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:13.936964-07:00 web-01 app[30742]: INFO worker 15 picked job 7025919cf926c770 from queue emails 2026-10-09T13:18:13.952629-07:00 edge-fr-1 app[30836]: WARN slow query (8575 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '94 minutes' 2026-10-09T13:18:14.075687-07:00 web-02 sshd[27090]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:18:14.077049-07:00 db-replica nginx[1209]: 45.157.236.68 - - "GET /wp-login.php HTTP/1.1" 301 76526 "-" "curl/8.4.0" 2026-10-09T13:18:14.101664-07:00 db-replica app[30696]: INFO worker 13 finished job a4e59107531fb35f in 6671 ms 2026-10-09T13:18:14.182890-07:00 web-01 nginx[1205]: 45.36.146.68 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 72787 "-" "python-requests/2.32.3" 2026-10-09T13:18:14.206626-07:00 bastion app[30185]: INFO order 47515 confirmed for zoë in 4400 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:14.523992-07:00 worker-12 haproxy[914]: 91.85.151.101:41930 [59885] http-in app/bastion 7829/0/655/655/7829 502 29173 - - ---- 140/140/98/98/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:18:14.561356-07:00 edge-fr-1 cron[7634]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:18:14.629499-07:00 api-07 app[30222]: INFO request_id=c8295f29f8660207 method=GET path=/health status=200 duration=407ms 2026-10-09T13:18:14.705370-07:00 db-primary haproxy[936]: 192.133.129.151:62991 [91118] http-in app/db-replica 7305/0/677/677/7305 404 84801 - - ---- 191/191/68/68/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:14.843369-07:00 web-02 systemd[1]: session-11266.scope: Deactivated successfully. 2026-10-09T13:18:14.866670-07:00 db-primary sshd[35177]: Received disconnect from 45.8.168.63 port 25689:11: Bye Bye [preauth] 2026-10-09T13:18:15.119781-07:00 worker-12 nginx[1202]: 91.135.138.115 - - "GET /static/main.css HTTP/1.1" 404 60407 "-" "kube-probe/1.31" 2026-10-09T13:18:15.239375-07:00 web-01 sshd[12771]: Received disconnect from 192.182.55.53 port 6189:11: Bye Bye [preauth] 2026-10-09T13:18:15.252872-07:00 api-08 sshd[5053]: Connection closed by 192.27.213.149 port 1416 [preauth] 2026-10-09T13:18:15.311703-07:00 edge-fr-1 postgres[31617]: LOG: duration: 894.333 ms statement: SELECT * FROM orders WHERE customer_id = 15954 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:15.330981-07:00 cache-3 sshd[31501]: Connection closed by 10.96.91.138 port 52076 [preauth] 2026-10-09T13:18:15.542472-07:00 api-07 haproxy[940]: 203.52.186.128:40027 [35069] http-in app/web-03 5552/0/140/140/5552 404 7743 - - ---- 469/469/85/85/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:18:15.774085-07:00 db-primary systemd[1]: Started Session 20177 of User root. 2026-10-09T13:18:15.790495-07:00 db-primary nginx[1201]: 10.247.45.161 - - "GET /login HTTP/1.1" 302 26241 "-" "curl/8.4.0" 2026-10-09T13:18:15.796099-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577095.614:94942): pid=94942 uid=0 auid=2072 ses=925 msg='op=login id=2072 exe="/usr/sbin/sshd" hostname=? addr=203.174.240.109 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:16.055078-07:00 bastion cron[15004]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:18:16.150675-07:00 worker-12 sshd[12531]: Failed password for invalid user deploy from 10.233.14.200 port 39693 ssh2 2026-10-09T13:18:16.205067-07:00 bastion sshd[4091]: Connection closed by 192.0.189.49 port 36221 [preauth] 2026-10-09T13:18:16.426203-07:00 web-01 nginx[1203]: 203.221.184.92 - - "GET /api/v2/users HTTP/1.1" 404 45260 "-" "kube-probe/1.31" 2026-10-09T13:18:16.434657-07:00 db-replica app[30814]: INFO request_id=24fb9a02e8a1dacc method=GET path=/login status=500 duration=1267ms 2026-10-09T13:18:16.881399-07:00 worker-12 nginx[1202]: 172.114.103.212 - - "GET /metrics HTTP/1.1" 302 29299 "-" "python-requests/2.32.3" 2026-10-09T13:18:16.897935-07:00 cache-3 app[30083]: INFO worker 22 picked job ebbff05c4df8c993 from queue emails 2026-10-09T13:18:16.978138-07:00 edge-fr-1 kernel: [70408.784120] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.113.113.49 DST=10.0.183.183 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=70408 DF PROTO=TCP SPT=23263 DPT=23263 WINDOW=70408 RES=0x00 SYN URGP=0 2026-10-09T13:18:16.983204-07:00 db-primary nginx[1208]: 45.242.45.65 - backup "POST /static/app.js HTTP/1.1" 404 14833 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:17.001388-07:00 db-replica app[30320]: INFO worker 27 picked job 7ea9ef9b1dbcce82 from queue emails 2026-10-09T13:18:17.012503-07:00 web-03 sshd[23612]: Connection closed by 192.252.95.75 port 33744 [preauth] 2026-10-09T13:18:17.076722-07:00 db-primary nginx[1207]: 203.240.30.74 - - "GET /metrics HTTP/1.1" 200 37151 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:17.108410-07:00 api-08 postgres[10395]: LOG: checkpoint complete: wrote 6165 buffers (45%); 0 WAL file(s) added, 0 removed, 24 recycled; write=8840.724 s, sync=0.724 s, total=8840.724 s 2026-10-09T13:18:17.110543-07:00 db-replica haproxy[921]: 172.212.210.205:43480 [51229] http-in app/db-replica 2777/0/106/106/2777 401 46301 - - ---- 720/720/83/83/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:18:17.117083-07:00 worker-12 kernel: [97313.587381] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.77.42.201 DST=10.0.742.742 LEN=99 TOS=0x00 PREC=0x00 TTL=99 ID=97313 DF PROTO=TCP SPT=59499 DPT=59499 WINDOW=97313 RES=0x00 SYN URGP=0 2026-10-09T13:18:17.121291-07:00 db-primary app[30473]: INFO worker 24 picked job e88b2cef5f975f47 from queue orders 2026-10-09T13:18:17.583012-07:00 edge-fr-1 kernel: [95362.506961] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.236.34.166 DST=10.0.400.400 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=95362 DF PROTO=TCP SPT=20073 DPT=20073 WINDOW=95362 RES=0x00 SYN URGP=0 2026-10-09T13:18:17.586747-07:00 cache-3 app[30521]: INFO request_id=5f833df5d11d22f6 method=GET path=/.env status=404 duration=1252ms 2026-10-09T13:18:17.831257-07:00 api-07 app[30074]: INFO worker 84 finished job 774713d725c683a5 in 3678 ms 2026-10-09T13:18:17.904795-07:00 api-08 haproxy[908]: 203.140.117.236:38606 [94524] http-in app/api-08 4984/0/714/714/4984 200 77944 - - ---- 128/128/82/82/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:18:17.983388-07:00 bastion app[30522]: INFO worker 49 finished job 023697172906a695 in 4630 ms 2026-10-09T13:18:18.148636-07:00 cache-3 systemd[1]: session-25644.scope: Deactivated successfully. 2026-10-09T13:18:18.298984-07:00 edge-fr-1 app[30586]: INFO worker 99 finished job 364dce32b37d2145 in 9578 ms 2026-10-09T13:18:18.682455-07:00 cache-3 app[30022]: INFO request_id=0a381af3ab48fd81 method=GET path=/api/v2/users status=404 duration=5034ms 2026-10-09T13:18:18.791879-07:00 db-replica haproxy[917]: 203.58.121.157:13036 [47024] http-in app/web-02 9029/0/792/792/9029 502 65035 - - ---- 460/460/90/90/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:18:18.815403-07:00 web-02 nginx[1210]: 203.100.86.70 - - "GET /static/main.css HTTP/1.1" 200 49747 "-" "Go-http-client/1.1" 2026-10-09T13:18:18.907920-07:00 edge-fr-1 postgres[20828]: LOG: duration: 6363.593 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:19.273358-07:00 bastion nginx[1207]: 45.48.229.43 - deploy "POST /static/main.css HTTP/1.1" 404 60950 "-" "curl/8.4.0" 2026-10-09T13:18:19.548684-07:00 db-replica app[30371]: INFO order 16206 confirmed for müller in 20 ms (region us-east-1, queue invoices) 2026-10-09T13:18:19.674801-07:00 api-07 nginx[1201]: 10.193.102.106 - - "GET /health HTTP/1.1" 200 60433 "-" "python-requests/2.32.3" 2026-10-09T13:18:19.725442-07:00 web-03 postgres[29051]: LOG: duration: 5949.560 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:19.853180-07:00 cache-3 nginx[1207]: 10.43.229.165 - - "GET /health HTTP/1.1" 204 83970 "-" "python-requests/2.32.3" 2026-10-09T13:18:19.864608-07:00 web-02 app[30857]: INFO health check ok: db 622 ms, cache 622 ms, queue depth 84 2026-10-09T13:18:19.931393-07:00 cache-3 nginx[1207]: 91.24.252.230 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 38713 "-" "curl/8.4.0" 2026-10-09T13:18:19.985144-07:00 cache-3 nginx[1208]: 192.2.4.198 - - "GET /api/v2/users HTTP/1.1" 404 3657 "-" "curl/8.4.0" 2026-10-09T13:18:20.008198-07:00 db-replica kernel: [89865.024931] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.97.160.63 DST=10.0.654.654 LEN=24 TOS=0x00 PREC=0x00 TTL=24 ID=89865 DF PROTO=TCP SPT=13050 DPT=13050 WINDOW=89865 RES=0x00 SYN URGP=0 2026-10-09T13:18:20.020262-07:00 api-07 app[30862]: INFO request_id=f7bbf2c44ae92585 method=GET path=/static/app.js status=200 duration=9174ms 2026-10-09T13:18:20.089425-07:00 db-replica nginx[1202]: 203.208.101.74 - müller "POST /health HTTP/1.1" 502 35086 "-" "Go-http-client/1.1" 2026-10-09T13:18:20.161130-07:00 api-08 app[30948]: INFO worker 88 picked job 4aa5d1b64c328a82 from queue orders 2026-10-09T13:18:20.202310-07:00 db-replica nginx[1209]: 192.3.185.253 - - "GET /admin HTTP/1.1" 200 23091 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:20.454422-07:00 db-replica haproxy[917]: 192.141.106.124:36615 [77525] http-in app/db-replica 6638/0/378/378/6638 200 24175 - - ---- 954/954/64/64/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:20.522096-07:00 web-01 nginx[1202]: 203.188.25.150 - - "GET /static/main.css HTTP/1.1" 500 81731 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:20.682701-07:00 api-07 app[30366]: INFO order 28820 confirmed for zoë in 9425 ms (region ap-northeast-1, queue orders) 2026-10-09T13:18:20.740103-07:00 web-02 sshd[26760]: Invalid user root from 172.50.47.235 port 10708 2026-10-09T13:18:20.756906-07:00 api-08 systemd[1]: session-14904.scope: Deactivated successfully. 2026-10-09T13:18:21.010509-07:00 worker-12 haproxy[940]: 45.184.5.143:60708 [33167] http-in app/cache-3 5699/0/483/483/5699 301 48513 - - ---- 173/173/53/53/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:18:21.106657-07:00 db-primary app[30283]: ERROR cache miss storm: 3378 misses in 9290 ms, key prefix session:akira 2026-10-09T13:18:21.128124-07:00 api-07 app[30595]: INFO worker 30 finished job 5fe4c520d027064e in 3150 ms 2026-10-09T13:18:21.183712-07:00 bastion sshd[20741]: Failed password for invalid user priya from 192.86.15.142 port 8799 ssh2 2026-10-09T13:18:21.192792-07:00 worker-12 app[30728]: INFO worker 24 finished job c05fd64da2279aa6 in 4269 ms 2026-10-09T13:18:21.579308-07:00 cache-3 nginx[1209]: 91.205.151.221 - root "POST /wp-login.php HTTP/1.1" 302 32035 "-" "curl/8.4.0" 2026-10-09T13:18:21.600421-07:00 db-primary app[30374]: INFO worker 77 picked job 03727b30753c5eb3 from queue invoices 2026-10-09T13:18:21.786751-07:00 web-01 app[30987]: INFO health check ok: db 950 ms, cache 950 ms, queue depth 28 2026-10-09T13:18:22.339722-07:00 cache-3 sshd[12980]: Accepted publickey for zoë from 192.169.164.225 port 44540 ssh2: ED25519 SHA256:42130ffd2b1c5562 2026-10-09T13:18:22.636054-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577102.854:14428): pid=14428 uid=0 auid=4660 ses=514 msg='op=login id=4660 exe="/usr/sbin/sshd" hostname=? addr=172.162.118.7 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:22.657039-07:00 web-02 sshd[47681]: Received disconnect from 203.217.126.46 port 53225:11: Bye Bye [preauth] 2026-10-09T13:18:22.676242-07:00 cache-3 app[30300]: INFO request_id=73df559ef0709d64 method=GET path=/login status=200 duration=7834ms 2026-10-09T13:18:22.717086-07:00 web-01 kernel: [75624.417906] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.200.12.156 DST=10.0.557.557 LEN=45 TOS=0x00 PREC=0x00 TTL=45 ID=75624 DF PROTO=TCP SPT=5770 DPT=5770 WINDOW=75624 RES=0x00 SYN URGP=0 2026-10-09T13:18:22.789885-07:00 edge-fr-1 app[30136]: INFO request_id=889240669121497b method=GET path=/metrics status=200 duration=346ms 2026-10-09T13:18:22.832929-07:00 edge-fr-1 app[30600]: INFO order 50232 confirmed for zoë in 8552 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:23.011640-07:00 web-03 app[30272]: INFO request_id=3c9d64fd7ed9e1d5 method=GET path=/static/app.js status=200 duration=2807ms 2026-10-09T13:18:23.408885-07:00 cache-3 sshd[16716]: Invalid user françois from 91.248.53.191 port 36002 2026-10-09T13:18:23.443282-07:00 worker-12 sshd[31255]: Connection closed by 45.52.226.110 port 15957 [preauth] 2026-10-09T13:18:23.446649-07:00 db-replica postgres[31824]: LOG: duration: 4443.857 ms statement: SELECT * FROM orders WHERE customer_id = 22280 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:23.642950-07:00 api-07 postgres[18450]: LOG: duration: 3606.521 ms statement: SELECT * FROM orders WHERE customer_id = 12270 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:23.691943-07:00 worker-12 cron[23940]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:18:23.693235-07:00 edge-fr-1 sudo: sørensen : TTY=pts/0 ; PWD=/home/sørensen ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:18:23.749669-07:00 worker-12 sshd[22709]: Accepted publickey for sørensen from 203.218.6.3 port 12197 ssh2: ED25519 SHA256:a1c51034d432d3e2 2026-10-09T13:18:24.272468-07:00 worker-12 postgres[23634]: LOG: checkpoint complete: wrote 6508 buffers (80%); 0 WAL file(s) added, 0 removed, 84 recycled; write=9758.253 s, sync=0.253 s, total=9758.253 s 2026-10-09T13:18:24.276492-07:00 worker-12 systemd[1]: Started Session 56433 of User françois. 2026-10-09T13:18:24.310303-07:00 worker-12 nginx[1207]: 10.10.158.59 - - "GET /metrics HTTP/1.1" 200 42210 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:24.325377-07:00 web-01 app[30528]: INFO request_id=527a27937315c704 method=GET path=/api/v2/orders status=200 duration=1095ms 2026-10-09T13:18:24.686921-07:00 db-primary app[30720]: INFO request_id=58014934d5fddfe3 method=GET path=/api/v2/users status=200 duration=1132ms 2026-10-09T13:18:24.760958-07:00 db-primary kernel: [11307.473886] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.18.34.132 DST=10.0.950.950 LEN=38 TOS=0x00 PREC=0x00 TTL=38 ID=11307 DF PROTO=TCP SPT=60970 DPT=60970 WINDOW=11307 RES=0x00 SYN URGP=0 2026-10-09T13:18:24.907965-07:00 db-replica sshd[31916]: Failed password for invalid user müller from 45.29.221.189 port 37974 ssh2 2026-10-09T13:18:25.246285-07:00 worker-12 app[30854]: INFO health check ok: db 251 ms, cache 251 ms, queue depth 23 2026-10-09T13:18:25.373646-07:00 web-01 app[30465]: INFO worker 90 finished job ecb10c1d546910be in 7251 ms 2026-10-09T13:18:25.514530-07:00 bastion haproxy[950]: 192.186.93.169:63535 [79232] http-in app/api-07 6543/0/713/713/6543 204 78241 - - ---- 135/135/55/55/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:25.541102-07:00 bastion app[30716]: INFO worker 58 finished job 4a8abaf9df160139 in 3175 ms 2026-10-09T13:18:25.541808-07:00 web-03 sshd[48582]: pam_unix(sshd:session): session opened for user deploy(uid=4639) by (uid=0) 2026-10-09T13:18:25.693609-07:00 api-08 sshd[2096]: Received disconnect from 172.54.220.58 port 60179:11: Bye Bye [preauth] 2026-10-09T13:18:25.719112-07:00 cache-3 app[30315]: INFO worker 35 picked job 90b421113fd728e7 from queue orders 2026-10-09T13:18:25.728862-07:00 web-03 kernel: [54666.709353] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.216.129.165 DST=10.0.652.652 LEN=66 TOS=0x00 PREC=0x00 TTL=66 ID=54666 DF PROTO=TCP SPT=49503 DPT=49503 WINDOW=54666 RES=0x00 SYN URGP=0 2026-10-09T13:18:25.829075-07:00 api-08 nginx[1206]: 203.246.118.133 - - "GET /api/v2/orders HTTP/1.1" 200 50589 "-" "python-requests/2.32.3" 2026-10-09T13:18:25.858085-07:00 api-08 sshd[61859]: Failed password for invalid user akira from 192.73.68.204 port 14486 ssh2 2026-10-09T13:18:25.905353-07:00 web-02 haproxy[948]: 10.144.237.120:38166 [60646] http-in app/cache-3 2384/0/729/729/2384 200 6558 - - ---- 421/421/88/88/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:18:25.947073-07:00 web-01 nginx[1209]: 91.19.96.73 - - "GET /.env HTTP/1.1" 200 9742 "-" "kube-probe/1.31" 2026-10-09T13:18:26.144563-07:00 bastion nginx[1203]: 203.90.211.89 - - "GET /admin HTTP/1.1" 401 50427 "-" "Go-http-client/1.1" 2026-10-09T13:18:26.222145-07:00 cache-3 nginx[1209]: 10.148.151.121 - - "GET /admin HTTP/1.1" 204 6116 "-" "kube-probe/1.31" 2026-10-09T13:18:26.225777-07:00 cache-3 app[30437]: INFO worker 39 finished job 6441cfa40d05298d in 5187 ms 2026-10-09T13:18:26.514824-07:00 bastion app[30163]: INFO request_id=d26d075c0220df55 method=GET path=/wp-login.php status=200 duration=3393ms 2026-10-09T13:18:26.695077-07:00 worker-12 nginx[1202]: 45.172.169.132 - - "GET /wp-login.php HTTP/1.1" 200 58328 "-" "python-requests/2.32.3" 2026-10-09T13:18:26.931312-07:00 api-07 postgres[8607]: LOG: duration: 1711.691 ms statement: SELECT * FROM orders WHERE customer_id = 77976 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:26.933574-07:00 bastion sshd[9575]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:18:27.044602-07:00 db-replica haproxy[901]: 91.103.222.87:35625 [51080] http-in app/edge-fr-1 5576/0/4/4/5576 302 51955 - - ---- 868/868/35/35/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:18:27.242138-07:00 bastion nginx[1206]: 10.102.67.197 - priya "POST /favicon.ico HTTP/1.1" 401 35437 "-" "python-requests/2.32.3" 2026-10-09T13:18:27.329132-07:00 worker-12 nginx[1210]: 203.48.25.220 - backup "POST /metrics HTTP/1.1" 204 85807 "-" "curl/8.4.0" 2026-10-09T13:18:27.349978-07:00 worker-12 app[30732]: INFO request_id=3abb159af01d071e method=GET path=/wp-login.php status=200 duration=9878ms 2026-10-09T13:18:27.441173-07:00 api-08 postgres[3375]: LOG: duration: 4542.937 ms statement: SELECT * FROM orders WHERE customer_id = 15241 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:27.530921-07:00 web-02 sshd[11174]: Accepted publickey for backup from 91.249.220.10 port 60413 ssh2: ED25519 SHA256:8b8cc75c7ec61e7d 2026-10-09T13:18:27.562306-07:00 db-replica kernel: [31846.642864] TCP: request_sock_TCP: Possible SYN flooding on port 35353. Sending cookies. Check SNMP counters. 2026-10-09T13:18:27.666336-07:00 web-02 app[30256]: INFO request_id=94de5ce253ebe5f8 method=GET path=/api/v2/orders/8841 status=401 duration=8197ms 2026-10-09T13:18:27.891541-07:00 api-07 sshd[34211]: Invalid user backup from 91.68.144.195 port 49025 2026-10-09T13:18:27.892729-07:00 db-primary nginx[1201]: 203.83.213.41 - - "GET /api/v2/orders HTTP/1.1" 204 28204 "-" "python-requests/2.32.3" 2026-10-09T13:18:27.917146-07:00 web-02 sshd[38640]: pam_unix(sshd:session): session opened for user akira(uid=4288) by (uid=0) 2026-10-09T13:18:27.926868-07:00 api-08 app[30286]: INFO request_id=5c6d09f5f10162b8 method=GET path=/wp-login.php status=502 duration=7356ms 2026-10-09T13:18:27.963745-07:00 api-08 app[30384]: WARN retrying upstream 172.219.66.96:48723 after timeout (2646 ms), attempt 3 of 3 2026-10-09T13:18:28.097054-07:00 api-07 systemd[1]: session-43847.scope: Deactivated successfully. 2026-10-09T13:18:28.097998-07:00 worker-12 app[30967]: INFO worker 11 picked job 18223a41f07baae0 from queue emails 2026-10-09T13:18:28.131049-07:00 api-08 haproxy[933]: 91.41.174.235:50156 [58687] http-in app/api-07 3807/0/405/405/3807 200 52245 - - ---- 292/292/21/21/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:18:28.260044-07:00 db-replica kernel: [18466.267052] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.249.197.43 DST=10.0.481.481 LEN=48 TOS=0x00 PREC=0x00 TTL=48 ID=18466 DF PROTO=TCP SPT=17662 DPT=17662 WINDOW=18466 RES=0x00 SYN URGP=0 2026-10-09T13:18:28.283479-07:00 bastion nginx[1204]: 91.254.167.200 - zoë "POST /login HTTP/1.1" 500 39584 "-" "kube-probe/1.31" 2026-10-09T13:18:28.483845-07:00 bastion app[30196]: INFO request_id=32b55af0fcd63909 method=GET path=/static/main.css status=500 duration=4037ms 2026-10-09T13:18:28.615255-07:00 web-03 haproxy[922]: 91.183.198.183:32785 [80869] http-in app/web-03 8427/0/967/967/8427 500 30749 - - ---- 181/181/33/33/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:18:28.670633-07:00 web-01 nginx[1205]: 45.19.181.95 - - "GET /favicon.ico HTTP/1.1" 200 66830 "-" "kube-probe/1.31" 2026-10-09T13:18:28.752173-07:00 web-03 nginx[1200]: 10.180.110.67 - deploy "POST /api/v2/users HTTP/1.1" 500 67673 "-" "Go-http-client/1.1" 2026-10-09T13:18:28.939821-07:00 api-08 app[30037]: INFO request_id=2b16a460980ad5a0 method=GET path=/admin status=200 duration=470ms 2026-10-09T13:18:29.172785-07:00 api-07 app[30701]: INFO order 69612 confirmed for ci in 4521 ms (region eu-west-1, queue webhooks) 2026-10-09T13:18:29.406404-07:00 api-07 sshd[36887]: Accepted publickey for backup from 192.11.41.235 port 27429 ssh2: ED25519 SHA256:d48afddee6edf1d9 2026-10-09T13:18:29.619031-07:00 web-02 app[30257]: INFO worker 20 finished job c4f84b6a9c3bca42 in 9862 ms 2026-10-09T13:18:29.747401-07:00 api-08 app[30954]: INFO worker 96 picked job dc96b6a44151ab6e from queue emails 2026-10-09T13:18:29.834937-07:00 bastion systemd[1]: Started Session 84432 of User françois. 2026-10-09T13:18:30.078737-07:00 bastion systemd[1]: session-91518.scope: Deactivated successfully. 2026-10-09T13:18:30.079186-07:00 api-08 sshd[62606]: Accepted publickey for priya from 10.82.11.43 port 5456 ssh2: ED25519 SHA256:ede6d68067ae3e07 2026-10-09T13:18:30.195466-07:00 db-replica systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:18:30.205585-07:00 worker-12 app[30302]: INFO worker 55 picked job d5f858925d529801 from queue webhooks 2026-10-09T13:18:30.238916-07:00 api-07 app[30890]: INFO worker 16 picked job 588129de01429aef from queue emails 2026-10-09T13:18:30.255025-07:00 api-07 app[30471]: INFO worker 25 finished job 2c8ad9d97d2e6617 in 5425 ms 2026-10-09T13:18:30.330999-07:00 worker-12 postgres[13339]: LOG: checkpoint complete: wrote 8747 buffers (69%); 0 WAL file(s) added, 0 removed, 92 recycled; write=2538.875 s, sync=0.875 s, total=2538.875 s 2026-10-09T13:18:30.600491-07:00 web-01 sshd[52498]: pam_unix(sshd:session): session opened for user ci(uid=4048) by (uid=0) 2026-10-09T13:18:30.615759-07:00 cache-3 app[30819]: INFO worker 37 picked job f4825f20ae2724ae from queue invoices 2026-10-09T13:18:30.685091-07:00 db-replica nginx[1207]: 203.158.186.105 - - "GET /metrics HTTP/1.1" 404 69966 "-" "python-requests/2.32.3" 2026-10-09T13:18:30.926237-07:00 web-03 nginx[1202]: 10.98.139.140 - - "GET /metrics HTTP/1.1" 200 73690 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:31.052139-07:00 web-02 app[30101]: INFO request_id=a1f003c0bc46a78d method=GET path=/health status=200 duration=9637ms 2026-10-09T13:18:31.151613-07:00 api-07 kernel: [87442.536477] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.57.107.147 DST=10.0.573.573 LEN=88 TOS=0x00 PREC=0x00 TTL=88 ID=87442 DF PROTO=TCP SPT=55650 DPT=55650 WINDOW=87442 RES=0x00 SYN URGP=0 2026-10-09T13:18:31.324323-07:00 db-replica app[30348]: INFO request_id=8a8443b6a7c0c3e0 method=GET path=/health status=204 duration=7981ms 2026-10-09T13:18:31.465603-07:00 db-primary postgres[24463]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 35296 remain, 9277 scanned (28% of total) 2026-10-09T13:18:31.514223-07:00 web-02 app[30279]: INFO request_id=d92e2b63e45cd451 method=GET path=/api/v2/users status=502 duration=8019ms 2026-10-09T13:18:31.546501-07:00 worker-12 app[30371]: INFO worker 13 picked job a8449542500b15e0 from queue emails 2026-10-09T13:18:31.578057-07:00 web-03 postgres[29048]: LOG: duration: 7527.218 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:31.651024-07:00 api-07 app[30384]: INFO request_id=339165bf97a18c1d method=GET path=/static/app.js status=301 duration=7434ms 2026-10-09T13:18:31.955445-07:00 api-07 sshd[16536]: Invalid user root from 10.26.109.159 port 37920 2026-10-09T13:18:31.963887-07:00 worker-12 app[30253]: INFO worker 43 picked job 70ebccc882a5c9c0 from queue invoices 2026-10-09T13:18:32.208538-07:00 api-08 app[30614]: INFO worker 28 finished job 66f7d2311323ae05 in 888 ms 2026-10-09T13:18:32.214597-07:00 web-01 app[30529]: INFO order 91793 confirmed for akira in 1835 ms (region ap-northeast-1, queue emails) 2026-10-09T13:18:32.315863-07:00 web-03 nginx[1207]: 203.34.183.53 - - "GET /.env HTTP/1.1" 200 13446 "-" "python-requests/2.32.3" 2026-10-09T13:18:32.337381-07:00 api-08 sshd[44650]: Failed password for invalid user ci from 172.195.150.232 port 13083 ssh2 2026-10-09T13:18:32.491827-07:00 api-07 haproxy[906]: Server app/api-07 is DOWN, reason: Layer4 timeout, check duration: 4007ms. 59 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:18:32.512088-07:00 api-07 app[30116]: INFO worker 28 picked job c86737907c5fb240 from queue emails 2026-10-09T13:18:32.521464-07:00 cache-3 systemd[1]: session-82424.scope: Deactivated successfully. 2026-10-09T13:18:32.524323-07:00 api-07 sshd[30671]: Invalid user zoë from 172.10.69.172 port 8251 2026-10-09T13:18:32.750937-07:00 api-07 nginx[1202]: 10.102.187.223 - zoë "POST /api/v2/search?q=invoice HTTP/1.1" 200 5795 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:32.905674-07:00 api-08 app[30097]: INFO worker 52 picked job 68ceda0d92167a8d from queue invoices 2026-10-09T13:18:32.971113-07:00 edge-fr-1 postgres[23346]: LOG: checkpoint complete: wrote 6364 buffers (74%); 0 WAL file(s) added, 0 removed, 58 recycled; write=2203.910 s, sync=0.910 s, total=2203.910 s 2026-10-09T13:18:33.056124-07:00 web-03 app[30038]: INFO worker 20 picked job e5fb19b2f861e757 from queue webhooks 2026-10-09T13:18:33.149402-07:00 cache-3 app[30860]: INFO request_id=aef0782b76325573 method=GET path=/favicon.ico status=404 duration=1727ms 2026-10-09T13:18:33.351245-07:00 worker-12 app[30215]: INFO request_id=05df2c94bb27fe37 method=GET path=/metrics status=200 duration=963ms 2026-10-09T13:18:33.524129-07:00 db-replica nginx[1209]: 10.206.33.148 - - "GET /api/v2/users HTTP/1.1" 204 14106 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:33.591791-07:00 web-02 app[30886]: INFO request_id=44527a467c897b6f method=GET path=/health status=404 duration=1981ms 2026-10-09T13:18:33.647871-07:00 web-01 sshd[13602]: Failed password for invalid user deploy from 203.190.113.32 port 8513 ssh2 2026-10-09T13:18:33.763958-07:00 db-replica haproxy[911]: 45.80.106.54:24637 [22248] http-in app/api-08 755/0/353/353/755 404 31781 - - ---- 725/725/85/85/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:33.810794-07:00 web-01 app[30502]: INFO order 57672 confirmed for zoë in 3155 ms (region us-east-1, queue emails) 2026-10-09T13:18:33.917671-07:00 db-replica app[30036]: INFO request_id=d346a820643c2eb3 method=GET path=/metrics status=301 duration=455ms 2026-10-09T13:18:33.927057-07:00 bastion nginx[1204]: 45.139.185.175 - - "GET /static/main.css HTTP/1.1" 502 81681 "-" "python-requests/2.32.3" 2026-10-09T13:18:33.961790-07:00 api-08 app[30268]: INFO order 65268 confirmed for deploy in 1950 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:34.082661-07:00 edge-fr-1 sshd[42912]: Connection closed by 45.212.247.219 port 35137 [preauth] 2026-10-09T13:18:34.104992-07:00 db-primary nginx[1209]: 45.26.62.196 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 3804 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:34.116356-07:00 cache-3 systemd[1]: session-67484.scope: Deactivated successfully. 2026-10-09T13:18:34.273438-07:00 bastion nginx[1209]: 10.246.77.184 - ci "POST /static/app.js HTTP/1.1" 502 15368 "-" "curl/8.4.0" 2026-10-09T13:18:34.363736-07:00 web-01 nginx[1202]: 91.36.26.200 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 75516 "-" "curl/8.4.0" 2026-10-09T13:18:34.457912-07:00 web-03 haproxy[923]: 45.200.176.198:57392 [68967] http-in app/db-replica 6415/0/939/939/6415 500 46263 - - ---- 130/130/39/39/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:34.495338-07:00 edge-fr-1 app[30451]: INFO health check ok: db 220 ms, cache 220 ms, queue depth 41 2026-10-09T13:18:34.559774-07:00 web-03 nginx[1206]: 45.79.66.216 - root "POST /favicon.ico HTTP/1.1" 302 43105 "-" "Go-http-client/1.1" 2026-10-09T13:18:34.657071-07:00 db-primary systemd[1]: session-76563.scope: Deactivated successfully. 2026-10-09T13:18:34.919581-07:00 web-03 sshd[32815]: Invalid user backup from 45.215.1.100 port 14913 2026-10-09T13:18:34.928106-07:00 worker-12 kernel: [68449.035162] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.99.42.227 DST=10.0.795.795 LEN=11 TOS=0x00 PREC=0x00 TTL=11 ID=68449 DF PROTO=TCP SPT=55204 DPT=55204 WINDOW=68449 RES=0x00 SYN URGP=0 2026-10-09T13:18:34.981100-07:00 worker-12 app[30382]: INFO request_id=bdfb4ccf548b7446 method=GET path=/api/v2/orders status=200 duration=4324ms 2026-10-09T13:18:35.060122-07:00 edge-fr-1 nginx[1200]: 203.133.56.109 - - "GET /favicon.ico HTTP/1.1" 204 85674 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:35.270999-07:00 web-02 sshd[26869]: Connection closed by 172.34.69.157 port 30157 [preauth] 2026-10-09T13:18:35.871993-07:00 worker-12 app[30682]: INFO worker 15 picked job 48cad89bd436c19c from queue emails 2026-10-09T13:18:35.876607-07:00 db-replica systemd[1]: Started Session 66791 of User françois. 2026-10-09T13:18:36.024581-07:00 edge-fr-1 systemd[1]: session-33701.scope: Deactivated successfully. 2026-10-09T13:18:36.061839-07:00 api-07 postgres[21725]: LOG: duration: 1494.132 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:36.073723-07:00 worker-12 app[30410]: INFO worker 37 picked job 2beffae94f9737d5 from queue webhooks 2026-10-09T13:18:36.130291-07:00 worker-12 sshd[46270]: Invalid user akira from 91.243.245.164 port 33653 2026-10-09T13:18:36.313810-07:00 cache-3 app[30927]: INFO request_id=a7ee0517e6754003 method=GET path=/.env status=502 duration=7981ms 2026-10-09T13:18:36.363499-07:00 api-07 postgres[22524]: LOG: duration: 2308.311 ms statement: SELECT * FROM orders WHERE customer_id = 85617 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:36.638267-07:00 worker-12 cron[29254]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:18:36.749877-07:00 db-replica app[30878]: INFO request_id=1e32c76351690800 method=GET path=/metrics status=200 duration=2058ms 2026-10-09T13:18:36.827112-07:00 worker-12 sshd[6039]: Received disconnect from 10.211.124.187 port 16277:11: Bye Bye [preauth] 2026-10-09T13:18:36.850517-07:00 worker-12 dockerd[700]: time="2026-10-09T13:18:36.850517-07:00" level=info msg="Container bdb7d7a1672ca65a exited with code 0" 2026-10-09T13:18:36.895468-07:00 bastion nginx[1205]: 203.141.95.110 - - "GET /metrics HTTP/1.1" 404 17936 "-" "curl/8.4.0" 2026-10-09T13:18:36.950626-07:00 web-03 app[30354]: INFO request_id=fb626d80cdbb892e method=GET path=/health status=404 duration=8225ms 2026-10-09T13:18:37.161471-07:00 web-01 kubelet[800]: I1009 13:18:37.618753 7140 kubelet.go:7140] "Pod is terminating, skipping pod status update" pod="default/api-584fbc76dc8d0886" 2026-10-09T13:18:37.164045-07:00 web-03 nginx[1203]: 172.236.136.165 - - "GET /metrics HTTP/1.1" 204 63899 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:37.546957-07:00 bastion app[30609]: INFO order 80707 confirmed for deploy in 2542 ms (region eu-west-1, queue webhooks) 2026-10-09T13:18:37.564766-07:00 db-primary app[30503]: INFO order 43494 confirmed for müller in 9541 ms (region eu-west-1, queue orders) 2026-10-09T13:18:37.618481-07:00 db-primary app[30308]: INFO request_id=396f8e054532de88 method=GET path=/static/app.js status=302 duration=5462ms 2026-10-09T13:18:37.713468-07:00 web-01 app[30525]: INFO request_id=f248f7157e0c7d34 method=GET path=/login status=200 duration=9473ms 2026-10-09T13:18:37.891831-07:00 web-02 kernel: [32040.752885] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.176.130.37 DST=10.0.589.589 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=32040 DF PROTO=TCP SPT=56016 DPT=56016 WINDOW=32040 RES=0x00 SYN URGP=0 2026-10-09T13:18:38.407508-07:00 web-02 nginx[1210]: 192.59.93.23 - - "GET /api/v2/orders HTTP/1.1" 200 71715 "-" "curl/8.4.0" 2026-10-09T13:18:38.568772-07:00 web-01 nginx[1207]: 192.47.135.242 - - "GET /api/v2/users HTTP/1.1" 404 89715 "-" "Go-http-client/1.1" 2026-10-09T13:18:38.802081-07:00 worker-12 app[30142]: INFO request_id=40283cde0c125e39 method=GET path=/wp-login.php status=500 duration=7626ms 2026-10-09T13:18:38.821130-07:00 bastion app[30523]: INFO health check ok: db 318 ms, cache 318 ms, queue depth 31 2026-10-09T13:18:39.019117-07:00 db-replica nginx[1201]: 45.146.117.161 - - "GET /.env HTTP/1.1" 200 81804 "-" "Go-http-client/1.1" 2026-10-09T13:18:39.070974-07:00 worker-12 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:18:39.267169-07:00 bastion app[30064]: INFO request_id=b90091480ad60f09 method=GET path=/.env status=204 duration=5071ms 2026-10-09T13:18:39.462409-07:00 api-07 nginx[1200]: 172.6.243.53 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 21106 "-" "python-requests/2.32.3" 2026-10-09T13:18:39.521767-07:00 web-02 app[30836]: INFO worker 20 picked job d87d71766b8d368f from queue orders 2026-10-09T13:18:39.541755-07:00 api-07 app[30583]: INFO order 86657 confirmed for priya in 6376 ms (region eu-west-1, queue invoices) 2026-10-09T13:18:39.727776-07:00 api-07 sshd[38347]: Connection closed by 172.165.213.247 port 20250 [preauth] 2026-10-09T13:18:40.084912-07:00 api-07 nginx[1204]: 203.247.100.7 - - "GET /admin HTTP/1.1" 200 31031 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:40.120601-07:00 db-replica systemd[1]: Started Session 38253 of User backup. 2026-10-09T13:18:40.224140-07:00 db-replica postgres[31331]: LOG: duration: 6168.551 ms statement: SELECT * FROM orders WHERE customer_id = 41953 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:40.256593-07:00 db-replica app[30900]: INFO order 84295 confirmed for root in 5913 ms (region eu-west-1, queue webhooks) 2026-10-09T13:18:40.282375-07:00 api-08 systemd[1]: Started Session 70277 of User françois. 2026-10-09T13:18:40.299550-07:00 bastion systemd[1]: session-31509.scope: Deactivated successfully. 2026-10-09T13:18:40.306834-07:00 api-07 app[30208]: INFO health check ok: db 364 ms, cache 364 ms, queue depth 79 2026-10-09T13:18:40.339015-07:00 db-primary dockerd[700]: time="2026-10-09T13:18:40.339015-07:00" level=warning msg="Health check for container f89d2e13462ca5ed error: context deadline exceeded" 2026-10-09T13:18:40.541237-07:00 web-03 app[30155]: INFO request_id=07a7bf8ba18f8214 method=GET path=/metrics status=200 duration=8692ms 2026-10-09T13:18:40.560857-07:00 db-primary sshd[52441]: Failed password for invalid user müller from 45.77.38.2 port 55383 ssh2 2026-10-09T13:18:40.653676-07:00 db-primary postgres[14099]: LOG: duration: 9793.880 ms statement: SELECT * FROM orders WHERE customer_id = 38582 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:40.734889-07:00 web-03 app[30280]: INFO request_id=2d5eaafd77174b2b method=GET path=/metrics status=401 duration=4876ms 2026-10-09T13:18:40.860184-07:00 cache-3 nginx[1205]: 91.3.134.189 - - "GET /admin HTTP/1.1" 502 21723 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:41.141072-07:00 web-01 sshd[52361]: Connection closed by 192.64.132.109 port 58814 [preauth] 2026-10-09T13:18:41.162591-07:00 api-08 app[30211]: INFO worker 43 picked job 10ccb1609768660a from queue emails 2026-10-09T13:18:41.278376-07:00 api-08 nginx[1202]: 172.0.220.82 - - "GET /static/app.js HTTP/1.1" 204 21074 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:41.355532-07:00 api-07 app[30570]: INFO request_id=3124fa6472a0ac8e method=GET path=/wp-login.php status=200 duration=4775ms 2026-10-09T13:18:41.382901-07:00 web-02 app[30464]: INFO request_id=1f214ed83be48465 method=GET path=/api/v2/orders status=200 duration=4546ms 2026-10-09T13:18:41.702599-07:00 edge-fr-1 app[30115]: INFO worker 66 finished job c5b27e5b78899b68 in 2964 ms 2026-10-09T13:18:41.814729-07:00 db-primary nginx[1204]: 192.203.237.5 - priya "POST /static/main.css HTTP/1.1" 302 57810 "-" "python-requests/2.32.3" 2026-10-09T13:18:41.905293-07:00 db-primary systemd[1]: Started Session 42085 of User deploy. 2026-10-09T13:18:42.098091-07:00 api-07 sshd[60384]: Received disconnect from 192.149.37.119 port 63910:11: Bye Bye [preauth] 2026-10-09T13:18:42.178460-07:00 db-primary sshd[32947]: Accepted publickey for sørensen from 91.107.174.207 port 62459 ssh2: ED25519 SHA256:caf8a34c1db1d221 2026-10-09T13:18:42.524222-07:00 web-01 app[30362]: INFO worker 63 picked job 212caef070786cca from queue invoices 2026-10-09T13:18:42.597842-07:00 web-03 app[30033]: INFO request_id=957b2315ba5c3b44 method=GET path=/.env status=301 duration=8613ms 2026-10-09T13:18:42.704024-07:00 api-07 haproxy[926]: 192.227.33.197:49430 [35794] http-in app/api-08 3704/0/625/625/3704 404 9119 - - ---- 980/980/58/58/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:18:42.807212-07:00 cache-3 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:18:42.884919-07:00 db-primary postgres[10414]: LOG: duration: 3217.215 ms statement: SELECT * FROM orders WHERE customer_id = 74740 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:43.106123-07:00 api-07 nginx[1205]: 10.47.176.134 - - "GET /.env HTTP/1.1" 404 43807 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:43.126004-07:00 edge-fr-1 sshd[43676]: Received disconnect from 172.78.197.174 port 48369:11: Bye Bye [preauth] 2026-10-09T13:18:43.430615-07:00 worker-12 kernel: [22476.746328] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.27.184.54 DST=10.0.188.188 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=22476 DF PROTO=TCP SPT=18921 DPT=18921 WINDOW=22476 RES=0x00 SYN URGP=0 2026-10-09T13:18:43.576063-07:00 db-replica nginx[1205]: 192.201.84.58 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 74811 "-" "Go-http-client/1.1" 2026-10-09T13:18:43.592638-07:00 bastion sshd[39490]: Failed password for invalid user root from 192.196.77.86 port 48874 ssh2 2026-10-09T13:18:43.990241-07:00 edge-fr-1 nginx[1200]: 172.21.83.172 - - "GET /favicon.ico HTTP/1.1" 200 21955 "-" "kube-probe/1.31" 2026-10-09T13:18:44.107539-07:00 bastion sshd[6715]: Failed password for invalid user akira from 192.110.135.83 port 16655 ssh2 2026-10-09T13:18:44.139642-07:00 edge-fr-1 app[30127]: INFO worker 47 finished job f49b90adb7ffa92c in 6953 ms 2026-10-09T13:18:44.198309-07:00 cache-3 nginx[1205]: 172.124.35.37 - - "GET /static/app.js HTTP/1.1" 200 29102 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:44.243156-07:00 edge-fr-1 app[30250]: WARN retrying upstream 91.188.118.30:43654 after timeout (4960 ms), attempt 3 of 3 2026-10-09T13:18:44.270730-07:00 bastion kubelet[800]: I1009 13:18:44.257666 5314 kubelet.go:5314] "Pod is terminating, skipping pod status update" pod="default/api-54b3bee079a24fa1" 2026-10-09T13:18:44.379089-07:00 api-08 app[30463]: INFO worker 53 picked job d4e9c20991e01764 from queue invoices 2026-10-09T13:18:44.557394-07:00 api-08 app[30597]: INFO order 95165 confirmed for backup in 2970 ms (region us-east-1, queue orders) 2026-10-09T13:18:44.739395-07:00 api-07 app[30276]: INFO worker 61 picked job d58dd06bca062f3d from queue invoices 2026-10-09T13:18:44.783975-07:00 worker-12 haproxy[922]: 172.163.76.83:22007 [53023] http-in app/db-replica 8967/0/153/153/8967 404 3042 - - ---- 467/467/71/71/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:44.791021-07:00 cache-3 nginx[1209]: 203.170.143.111 - deploy "POST /api/v2/orders/8841 HTTP/1.1" 200 37906 "-" "Go-http-client/1.1" 2026-10-09T13:18:44.823292-07:00 worker-12 app[30609]: WARN retrying upstream 45.32.245.45:41412 after timeout (8809 ms), attempt 2 of 3 2026-10-09T13:18:44.930768-07:00 api-07 app[30160]: INFO order 48092 confirmed for françois in 8806 ms (region us-east-1, queue emails) 2026-10-09T13:18:44.968993-07:00 web-03 app[30876]: INFO worker 51 picked job da3b5925e8b5838e from queue webhooks 2026-10-09T13:18:44.971195-07:00 db-replica sshd[64992]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:18:45.012193-07:00 web-03 sshd[43067]: Connection closed by 45.155.214.159 port 2819 [preauth] 2026-10-09T13:18:45.109158-07:00 db-primary app[30145]: INFO order 11241 confirmed for françois in 3806 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:45.228363-07:00 bastion kernel: [92114.183931] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.223.56.86 DST=10.0.981.981 LEN=71 TOS=0x00 PREC=0x00 TTL=71 ID=92114 DF PROTO=TCP SPT=1835 DPT=1835 WINDOW=92114 RES=0x00 SYN URGP=0 2026-10-09T13:18:45.273507-07:00 cache-3 app[30004]: INFO health check ok: db 362 ms, cache 362 ms, queue depth 22 2026-10-09T13:18:45.292458-07:00 web-01 app[30096]: INFO request_id=628eb926036e6530 method=GET path=/favicon.ico status=502 duration=9014ms 2026-10-09T13:18:45.373083-07:00 web-01 sshd[9358]: Accepted publickey for backup from 45.109.100.151 port 1157 ssh2: ED25519 SHA256:456a399ee326f56c 2026-10-09T13:18:45.658693-07:00 cache-3 nginx[1208]: 172.90.36.25 - - "GET /login HTTP/1.1" 301 36483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:45.797056-07:00 web-03 nginx[1200]: 91.2.87.39 - - "GET /.env HTTP/1.1" 200 80549 "-" "Go-http-client/1.1" 2026-10-09T13:18:45.818861-07:00 web-01 nginx[1206]: 45.241.72.141 - - "GET /admin HTTP/1.1" 401 24952 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:45.892515-07:00 web-02 nginx[1204]: 192.154.190.150 - - "GET /static/app.js HTTP/1.1" 502 68611 "-" "Go-http-client/1.1" 2026-10-09T13:18:46.175060-07:00 worker-12 app[30621]: INFO worker 54 picked job 45a2dce6e5e818a7 from queue emails 2026-10-09T13:18:46.222284-07:00 edge-fr-1 systemd[1]: Started Session 17213 of User backup. 2026-10-09T13:18:46.240690-07:00 web-02 sshd[57041]: Connection closed by 45.168.252.47 port 63798 [preauth] 2026-10-09T13:18:46.314772-07:00 bastion app[30764]: INFO worker 90 picked job 349bc0dc84b7df24 from queue invoices 2026-10-09T13:18:46.470210-07:00 edge-fr-1 sshd[50058]: pam_unix(sshd:session): session opened for user akira(uid=7120) by (uid=0) 2026-10-09T13:18:46.512990-07:00 web-03 app[30225]: INFO worker 89 picked job 9e1be57823f0a718 from queue webhooks 2026-10-09T13:18:46.536371-07:00 worker-12 app[30519]: WARN slow query (4714 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '82 minutes' 2026-10-09T13:18:46.579881-07:00 cache-3 haproxy[901]: 91.102.170.1:22473 [84344] http-in app/bastion 9006/0/48/48/9006 404 80930 - - ---- 939/939/68/68/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:46.666284-07:00 edge-fr-1 systemd[1]: session-28294.scope: Deactivated successfully. 2026-10-09T13:18:46.730161-07:00 db-replica sshd[11886]: Accepted publickey for priya from 91.101.161.50 port 33222 ssh2: ED25519 SHA256:19a008f14bc698f5 2026-10-09T13:18:46.765933-07:00 bastion sshd[37352]: Failed password for invalid user müller from 203.102.8.162 port 59180 ssh2 2026-10-09T13:18:46.888478-07:00 api-08 nginx[1204]: 192.39.217.42 - backup "POST /metrics HTTP/1.1" 301 43408 "-" "Go-http-client/1.1" 2026-10-09T13:18:46.919502-07:00 web-02 nginx[1210]: 203.6.235.76 - - "GET /static/main.css HTTP/1.1" 500 77283 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:46.933703-07:00 db-primary sshd[1428]: Failed password for invalid user sørensen from 172.239.84.156 port 16541 ssh2 2026-10-09T13:18:46.944068-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577126.267:90920): pid=90920 uid=0 auid=2217 ses=320 msg='op=login id=2217 exe="/usr/sbin/sshd" hostname=? addr=10.153.234.187 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:47.380216-07:00 api-07 sshd[13137]: Accepted publickey for françois from 91.198.12.66 port 33260 ssh2: ED25519 SHA256:68ec25fd029bb3f1 2026-10-09T13:18:47.723433-07:00 db-primary nginx[1205]: 91.72.39.254 - - "GET /login HTTP/1.1" 200 83604 "-" "kube-probe/1.31" 2026-10-09T13:18:47.748531-07:00 api-08 kernel: [81805.874576] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.164.137.136 DST=10.0.854.854 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=81805 DF PROTO=TCP SPT=47770 DPT=47770 WINDOW=81805 RES=0x00 SYN URGP=0 2026-10-09T13:18:47.795145-07:00 api-08 app[30294]: INFO request_id=b67297b7a040ea2d method=GET path=/static/main.css status=200 duration=5360ms 2026-10-09T13:18:47.955166-07:00 bastion postgres[17855]: LOG: duration: 7549.370 ms statement: SELECT * FROM orders WHERE customer_id = 48272 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:48.023760-07:00 db-replica kernel: [62733.576399] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.137.168.90 DST=10.0.639.639 LEN=82 TOS=0x00 PREC=0x00 TTL=82 ID=62733 DF PROTO=TCP SPT=16091 DPT=16091 WINDOW=62733 RES=0x00 SYN URGP=0 2026-10-09T13:18:48.173833-07:00 db-replica nginx[1203]: 203.37.78.120 - root "POST /favicon.ico HTTP/1.1" 200 45087 "-" "kube-probe/1.31" 2026-10-09T13:18:48.243582-07:00 web-02 app[30483]: INFO request_id=d289dc0b9ca1e328 method=GET path=/wp-login.php status=301 duration=4777ms 2026-10-09T13:18:48.300447-07:00 edge-fr-1 haproxy[940]: 172.190.204.216:23086 [45803] http-in app/cache-3 2636/0/183/183/2636 502 40927 - - ---- 157/157/44/44/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:48.585574-07:00 web-02 app[30176]: INFO worker 13 picked job 65895554478a036e from queue orders 2026-10-09T13:18:48.697189-07:00 edge-fr-1 kernel: [74714.150943] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.12.181.51 DST=10.0.396.396 LEN=38 TOS=0x00 PREC=0x00 TTL=38 ID=74714 DF PROTO=TCP SPT=3935 DPT=3935 WINDOW=74714 RES=0x00 SYN URGP=0 2026-10-09T13:18:48.861847-07:00 db-primary systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:18:48.941096-07:00 db-primary app[30566]: WARN retrying upstream 192.244.153.156:52639 after timeout (3896 ms), attempt 2 of 3 2026-10-09T13:18:48.958838-07:00 db-replica nginx[1210]: 45.135.114.156 - root "POST /.env HTTP/1.1" 500 54006 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:49.057198-07:00 db-primary nginx[1201]: 10.217.38.241 - - "GET /login HTTP/1.1" 200 7272 "-" "curl/8.4.0" 2026-10-09T13:18:49.173066-07:00 web-01 app[30960]: INFO request_id=5a8d17d0cb1ae226 method=GET path=/favicon.ico status=401 duration=3814ms 2026-10-09T13:18:49.512833-07:00 api-07 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:18:49.980762-07:00 web-02 cron[27320]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:18:50.065303-07:00 bastion app[30131]: INFO worker 82 finished job 8688a29a8c528715 in 9270 ms 2026-10-09T13:18:50.070103-07:00 worker-12 sshd[2902]: Received disconnect from 172.175.41.212 port 65219:11: Bye Bye [preauth] 2026-10-09T13:18:50.298715-07:00 db-primary app[30165]: INFO request_id=bd0a50d43bf9612a method=GET path=/metrics status=500 duration=3078ms 2026-10-09T13:18:50.299988-07:00 cache-3 app[30979]: INFO request_id=ae270f790ddb3ca5 method=GET path=/wp-login.php status=204 duration=7041ms 2026-10-09T13:18:50.326037-07:00 web-01 haproxy[921]: 172.228.90.106:58142 [51037] http-in app/web-03 6418/0/928/928/6418 404 46184 - - ---- 159/159/42/42/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:18:50.347984-07:00 db-replica app[30318]: INFO request_id=2a9c33e4715a9801 method=GET path=/login status=200 duration=4187ms 2026-10-09T13:18:50.450133-07:00 bastion haproxy[931]: 10.207.63.40:20095 [58231] http-in app/db-primary 1036/0/243/243/1036 200 63858 - - ---- 662/662/17/17/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:50.779221-07:00 web-01 sshd[4669]: Failed password for invalid user müller from 203.150.157.40 port 60716 ssh2 2026-10-09T13:18:50.845770-07:00 cache-3 app[30610]: INFO request_id=f6ecaff434d7fa3b method=GET path=/login status=200 duration=2045ms 2026-10-09T13:18:50.861323-07:00 api-07 systemd[1]: Started Session 45270 of User sørensen. 2026-10-09T13:18:50.893531-07:00 bastion sshd[12837]: Invalid user sørensen from 10.234.254.236 port 52917 2026-10-09T13:18:51.024777-07:00 api-07 nginx[1209]: 10.75.247.200 - - "GET /static/main.css HTTP/1.1" 502 65087 "-" "curl/8.4.0" 2026-10-09T13:18:51.096114-07:00 api-08 app[30982]: INFO order 82695 confirmed for müller in 1768 ms (region eu-west-1, queue orders) 2026-10-09T13:18:51.158190-07:00 web-02 app[30052]: INFO request_id=f027951be5dd4238 method=GET path=/admin status=200 duration=7529ms 2026-10-09T13:18:51.169993-07:00 web-03 haproxy[935]: 172.133.37.29:51960 [65446] http-in app/web-01 1054/0/101/101/1054 200 44951 - - ---- 951/951/66/66/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:18:51.170896-07:00 cache-3 postgres[6359]: LOG: duration: 3624.919 ms statement: SELECT * FROM orders WHERE customer_id = 31510 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:51.202289-07:00 cache-3 haproxy[911]: 45.42.32.124:1201 [69165] http-in app/api-07 5626/0/129/129/5626 200 83272 - - ---- 947/947/76/76/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:18:51.204244-07:00 web-03 app[30594]: INFO worker 40 finished job 7a49e34dd8c61de7 in 8661 ms 2026-10-09T13:18:51.384399-07:00 web-03 nginx[1202]: 91.217.169.67 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 46515 "-" "kube-probe/1.31" 2026-10-09T13:18:51.507130-07:00 worker-12 nginx[1208]: 91.31.244.248 - akira "POST /wp-login.php HTTP/1.1" 404 72450 "-" "Go-http-client/1.1" 2026-10-09T13:18:51.613190-07:00 db-primary app[30973]: INFO worker 30 picked job 12edbabd0900bcfc from queue emails 2026-10-09T13:18:51.786138-07:00 api-07 postgres[29860]: LOG: duration: 4805.308 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:18:52.018666-07:00 cache-3 kernel: [20440.771790] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.109.103.9 DST=10.0.676.676 LEN=27 TOS=0x00 PREC=0x00 TTL=27 ID=20440 DF PROTO=TCP SPT=6735 DPT=6735 WINDOW=20440 RES=0x00 SYN URGP=0 2026-10-09T13:18:52.210220-07:00 web-03 sshd[53428]: Received disconnect from 10.156.247.38 port 25797:11: Bye Bye [preauth] 2026-10-09T13:18:52.283909-07:00 bastion nginx[1202]: 91.57.188.17 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 70813 "-" "kube-probe/1.31" 2026-10-09T13:18:52.382463-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577132.127:59304): pid=59304 uid=0 auid=5099 ses=492 msg='op=login id=5099 exe="/usr/sbin/sshd" hostname=? addr=45.232.43.19 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:52.450818-07:00 worker-12 haproxy[948]: 45.145.56.180:46337 [51313] http-in app/worker-12 5474/0/945/945/5474 301 59704 - - ---- 276/276/52/52/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:18:52.560938-07:00 web-03 app[30559]: INFO order 36050 confirmed for priya in 9060 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:18:52.820643-07:00 worker-12 app[30309]: INFO request_id=d98a36b788eeb8f2 method=GET path=/static/main.css status=301 duration=9175ms 2026-10-09T13:18:52.933363-07:00 cache-3 sshd[9688]: Accepted publickey for françois from 172.147.36.214 port 35406 ssh2: ED25519 SHA256:da25e7785bf973e0 2026-10-09T13:18:52.991649-07:00 db-primary postgres[13294]: LOG: duration: 1976.700 ms statement: SELECT * FROM orders WHERE customer_id = 66739 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:53.037167-07:00 edge-fr-1 kernel: [44262.351081] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.155.133.224 DST=10.0.456.456 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=44262 DF PROTO=TCP SPT=40238 DPT=40238 WINDOW=44262 RES=0x00 SYN URGP=0 2026-10-09T13:18:53.060578-07:00 bastion nginx[1207]: 172.182.73.118 - ci "POST /api/v2/search?q=invoice HTTP/1.1" 404 28621 "-" "python-requests/2.32.3" 2026-10-09T13:18:53.233398-07:00 web-03 sshd[34933]: Connection closed by 192.135.101.228 port 49907 [preauth] 2026-10-09T13:18:53.263222-07:00 db-primary systemd[1]: session-92689.scope: Deactivated successfully. 2026-10-09T13:18:53.361894-07:00 db-replica haproxy[911]: 91.243.2.44:35014 [35145] http-in app/web-01 5941/0/911/911/5941 200 9762 - - ---- 192/192/12/12/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:18:53.481588-07:00 web-02 postgres[23675]: LOG: duration: 9652.960 ms statement: SELECT * FROM orders WHERE customer_id = 20966 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:18:53.622963-07:00 api-07 app[30495]: DEBUG cache hit ratio 46% over the last minute (79649 lookups) 2026-10-09T13:18:53.689666-07:00 web-03 sshd[11930]: pam_unix(sshd:session): session opened for user priya(uid=8262) by (uid=0) 2026-10-09T13:18:53.970904-07:00 cache-3 systemd[1]: session-31470.scope: Deactivated successfully. 2026-10-09T13:18:54.227815-07:00 api-07 haproxy[945]: 203.194.144.175:7688 [27091] http-in app/web-03 6961/0/60/60/6961 200 29992 - - ---- 125/125/86/86/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:18:54.319647-07:00 db-replica app[30857]: INFO worker 35 picked job 3df087923cd01c49 from queue orders 2026-10-09T13:18:54.808747-07:00 web-03 app[30231]: WARN retrying upstream 91.145.69.191:55493 after timeout (3746 ms), attempt 1 of 3 2026-10-09T13:18:54.815912-07:00 cache-3 sshd[19036]: Invalid user deploy from 91.128.225.187 port 17689 2026-10-09T13:18:54.991249-07:00 bastion systemd[1]: Started Session 60825 of User françois. 2026-10-09T13:18:55.003033-07:00 web-01 app[30307]: INFO worker 61 picked job fc9c4cf3471e5edd from queue webhooks 2026-10-09T13:18:55.063278-07:00 db-replica nginx[1204]: 10.47.179.74 - - "GET /api/v2/orders HTTP/1.1" 200 44399 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:55.254536-07:00 bastion app[30655]: INFO worker 28 finished job a5a23cd78c3fd2b9 in 3924 ms 2026-10-09T13:18:55.469218-07:00 cache-3 sshd[28015]: Invalid user akira from 10.154.99.96 port 29336 2026-10-09T13:18:55.593003-07:00 web-02 app[30316]: INFO request_id=2145c1a5113b7d61 method=GET path=/api/v2/orders/8841 status=502 duration=672ms 2026-10-09T13:18:55.622165-07:00 web-02 kernel: [55961.145629] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.56.135.228 DST=10.0.370.370 LEN=53 TOS=0x00 PREC=0x00 TTL=53 ID=55961 DF PROTO=TCP SPT=62739 DPT=62739 WINDOW=55961 RES=0x00 SYN URGP=0 2026-10-09T13:18:55.627477-07:00 web-03 app[30944]: INFO worker 97 finished job ed36b92d1b206cdd in 3058 ms 2026-10-09T13:18:56.011262-07:00 cache-3 haproxy[925]: 203.242.149.19:24187 [82783] http-in app/edge-fr-1 642/0/606/606/642 301 635 - - ---- 351/351/96/96/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:18:56.217618-07:00 db-replica nginx[1202]: 91.169.200.35 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 35908 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:56.356643-07:00 api-07 kernel: [66307.132894] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.66.199.63 DST=10.0.332.332 LEN=95 TOS=0x00 PREC=0x00 TTL=95 ID=66307 DF PROTO=TCP SPT=64231 DPT=64231 WINDOW=66307 RES=0x00 SYN URGP=0 2026-10-09T13:18:56.426959-07:00 worker-12 haproxy[939]: 91.152.136.162:38890 [42746] http-in app/api-07 1821/0/647/647/1821 200 41524 - - ---- 672/672/47/47/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:56.456205-07:00 web-02 haproxy[939]: 10.20.130.196:45652 [36919] http-in app/web-03 9325/0/79/79/9325 200 63901 - - ---- 507/507/94/94/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:18:56.692083-07:00 cache-3 kernel: [14750.551045] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.225.3.146 DST=10.0.366.366 LEN=29 TOS=0x00 PREC=0x00 TTL=29 ID=14750 DF PROTO=TCP SPT=9909 DPT=9909 WINDOW=14750 RES=0x00 SYN URGP=0 2026-10-09T13:18:56.756024-07:00 bastion nginx[1203]: 203.24.160.94 - - "GET /wp-login.php HTTP/1.1" 404 53940 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:18:56.763203-07:00 web-01 app[30968]: WARN slow query (4189 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '94 minutes' 2026-10-09T13:18:56.781771-07:00 web-02 haproxy[947]: Server app/edge-fr-1 is UP, reason: Layer7 check passed, code: 200, check duration: 920ms. 11 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:18:57.008086-07:00 db-primary sshd[40211]: Accepted publickey for müller from 91.49.75.114 port 22971 ssh2: ED25519 SHA256:276a0711bbdce832 2026-10-09T13:18:57.246155-07:00 api-07 sshd[23193]: Accepted publickey for sørensen from 45.132.146.169 port 29023 ssh2: ED25519 SHA256:677522b4bd34a5d8 2026-10-09T13:18:57.652237-07:00 db-primary nginx[1207]: 10.149.4.23 - - "GET /metrics HTTP/1.1" 401 67954 "-" "Go-http-client/1.1" 2026-10-09T13:18:57.743773-07:00 api-07 app[30225]: INFO health check ok: db 4 ms, cache 4 ms, queue depth 95 2026-10-09T13:18:57.911368-07:00 cache-3 sshd[52360]: Accepted publickey for zoë from 10.125.99.68 port 62652 ssh2: ED25519 SHA256:9022eaa6219eb4ff 2026-10-09T13:18:58.154211-07:00 web-02 app[30508]: INFO worker 38 picked job f3a6c314541dbbbf from queue invoices 2026-10-09T13:18:58.236548-07:00 cache-3 nginx[1200]: 10.20.91.190 - - "GET /health HTTP/1.1" 200 12114 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:18:58.283224-07:00 cache-3 app[30698]: INFO order 48205 confirmed for backup in 5136 ms (region eu-west-1, queue invoices) 2026-10-09T13:18:58.334674-07:00 web-03 cron[41656]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:18:58.671706-07:00 web-02 app[30375]: INFO worker 11 picked job 79582413de9cd970 from queue invoices 2026-10-09T13:18:58.724136-07:00 db-primary sshd[25202]: Invalid user akira from 203.182.172.90 port 53336 2026-10-09T13:18:58.808262-07:00 api-07 nginx[1206]: 91.231.4.211 - priya "POST /metrics HTTP/1.1" 500 48522 "-" "python-requests/2.32.3" 2026-10-09T13:18:58.883985-07:00 edge-fr-1 nginx[1207]: 172.156.188.60 - - "GET /favicon.ico HTTP/1.1" 200 60213 "-" "curl/8.4.0" 2026-10-09T13:18:58.972618-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577138.159:42236): pid=42236 uid=0 auid=4421 ses=629 msg='op=login id=4421 exe="/usr/sbin/sshd" hostname=? addr=10.231.141.26 terminal=/dev/pts/0 res=success' 2026-10-09T13:18:59.006376-07:00 web-02 app[30416]: INFO request_id=7b021e596953a1c6 method=GET path=/.env status=502 duration=8662ms 2026-10-09T13:18:59.013509-07:00 web-03 app[30949]: INFO request_id=8f751e0a361bad25 method=GET path=/login status=200 duration=8521ms 2026-10-09T13:18:59.022701-07:00 db-replica nginx[1208]: 45.192.171.218 - - "GET /static/app.js HTTP/1.1" 502 937 "-" "kube-probe/1.31" 2026-10-09T13:18:59.064411-07:00 db-replica nginx[1209]: 10.21.47.11 - sørensen "POST /wp-login.php HTTP/1.1" 301 86534 "-" "Go-http-client/1.1" 2026-10-09T13:18:59.270879-07:00 web-02 systemd[1]: session-82305.scope: Deactivated successfully. 2026-10-09T13:18:59.675102-07:00 api-07 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.138.180.122, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.968.968:8080/metrics" 2026-10-09T13:18:59.694629-07:00 edge-fr-1 sshd[34309]: Connection closed by 192.234.48.86 port 57287 [preauth] 2026-10-09T13:18:59.731210-07:00 api-07 haproxy[922]: 203.111.83.157:2714 [81286] http-in app/db-replica 9108/0/873/873/9108 302 42068 - - ---- 440/440/31/31/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:18:59.770124-07:00 worker-12 app[30149]: INFO order 38457 confirmed for akira in 4185 ms (region us-east-1, queue emails) 2026-10-09T13:18:59.773890-07:00 api-08 kernel: [81554.867912] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.38.191.156 DST=10.0.145.145 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=81554 DF PROTO=TCP SPT=44448 DPT=44448 WINDOW=81554 RES=0x00 SYN URGP=0 2026-10-09T13:18:59.835789-07:00 web-02 app[30493]: INFO order 23869 confirmed for ci in 7321 ms (region ap-northeast-1, queue emails) 2026-10-09T13:18:59.853611-07:00 web-01 dockerd[700]: time="2026-10-09T13:18:59.853611-07:00" level=info msg="Container 5beeaab5e2c3dbc9 exited with code 0" 2026-10-09T13:19:00.638736-07:00 worker-12 sshd[20817]: Received disconnect from 45.145.22.30 port 59014:11: Bye Bye [preauth] 2026-10-09T13:19:00.743213-07:00 web-01 sshd[1240]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:19:00.756824-07:00 cache-3 app[30320]: INFO worker 81 finished job 500e47aaabcb4d40 in 9656 ms 2026-10-09T13:19:00.815510-07:00 db-primary app[30698]: INFO order 76569 confirmed for deploy in 4376 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:19:01.028950-07:00 web-03 nginx[1207]: 203.254.169.189 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 22484 "-" "curl/8.4.0" 2026-10-09T13:19:01.233958-07:00 api-07 app[30823]: INFO worker 89 finished job a033061598679c8e in 2547 ms 2026-10-09T13:19:01.282333-07:00 bastion nginx[1206]: 192.239.239.63 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 67069 "-" "python-requests/2.32.3" 2026-10-09T13:19:01.416528-07:00 worker-12 kernel: [76473.257554] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.22.105.75 DST=10.0.987.987 LEN=65 TOS=0x00 PREC=0x00 TTL=65 ID=76473 DF PROTO=TCP SPT=20136 DPT=20136 WINDOW=76473 RES=0x00 SYN URGP=0 2026-10-09T13:19:01.452670-07:00 edge-fr-1 nginx[1201]: 10.199.134.183 - - "GET /.env HTTP/1.1" 404 2598 "-" "python-requests/2.32.3" 2026-10-09T13:19:01.460695-07:00 db-primary app[30729]: INFO request_id=c7991e07b70ef92d method=GET path=/api/v2/orders/8841 status=200 duration=9087ms 2026-10-09T13:19:01.761905-07:00 cache-3 systemd[1]: Started Session 73936 of User backup. 2026-10-09T13:19:01.829076-07:00 api-07 sshd[21728]: Failed password for invalid user zoë from 91.206.15.29 port 2648 ssh2 2026-10-09T13:19:01.865989-07:00 db-replica dockerd[700]: time="2026-10-09T13:19:01.865989-07:00" level=info msg="Container e356a5b8c6c6f0a3 exited with code 0" 2026-10-09T13:19:01.871932-07:00 db-primary app[30301]: INFO worker 97 finished job 55989ce8293eff2f in 9356 ms 2026-10-09T13:19:01.947358-07:00 db-primary systemd[1]: session-69560.scope: Deactivated successfully. 2026-10-09T13:19:02.190119-07:00 web-03 systemd[1]: session-57723.scope: Deactivated successfully. 2026-10-09T13:19:02.306327-07:00 api-08 app[30479]: INFO worker 86 finished job bdbe9471fc2e01e2 in 4595 ms 2026-10-09T13:19:02.369360-07:00 web-02 sshd[57418]: Received disconnect from 203.115.194.51 port 18559:11: Bye Bye [preauth] 2026-10-09T13:19:02.376152-07:00 bastion nginx[1201]: 203.33.72.254 - - "GET /static/main.css HTTP/1.1" 200 88180 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:02.436838-07:00 db-replica app[30770]: INFO request_id=03165865711b4221 method=GET path=/.env status=404 duration=9329ms 2026-10-09T13:19:02.454728-07:00 db-replica nginx[1204]: 203.87.183.254 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 64924 "-" "curl/8.4.0" 2026-10-09T13:19:02.473041-07:00 cache-3 app[30975]: INFO request_id=7ef54db0b7a6d204 method=GET path=/static/main.css status=200 duration=3518ms 2026-10-09T13:19:02.567360-07:00 db-replica nginx[1204]: 91.195.235.135 - - "GET /login HTTP/1.1" 200 67138 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:02.590384-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577142.873:83299): pid=83299 uid=0 auid=5065 ses=532 msg='op=login id=5065 exe="/usr/sbin/sshd" hostname=? addr=192.241.165.9 terminal=/dev/pts/0 res=success' 2026-10-09T13:19:02.591505-07:00 worker-12 nginx[1201]: 172.1.111.195 - - "GET /api/v2/orders HTTP/1.1" 200 20134 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:02.623641-07:00 api-08 nginx[1202]: 172.217.70.131 - - "GET /api/v2/users HTTP/1.1" 200 83444 "-" "python-requests/2.32.3" 2026-10-09T13:19:02.766038-07:00 api-07 haproxy[924]: 45.10.58.198:19257 [38223] http-in app/db-replica 8978/0/201/201/8978 404 58104 - - ---- 291/291/86/86/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:19:02.802678-07:00 bastion sshd[42512]: Invalid user deploy from 45.98.20.70 port 8591 2026-10-09T13:19:02.836557-07:00 api-08 nginx[1204]: 10.29.140.113 - - "GET /static/app.js HTTP/1.1" 200 52585 "-" "curl/8.4.0" 2026-10-09T13:19:03.008763-07:00 db-replica sshd[51694]: Failed password for invalid user müller from 203.143.8.49 port 25581 ssh2 2026-10-09T13:19:03.141051-07:00 api-07 nginx[1200]: 10.138.199.237 - - "GET /static/app.js HTTP/1.1" 401 70848 "-" "python-requests/2.32.3" 2026-10-09T13:19:03.347356-07:00 web-01 kernel: [33527.902235] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.1.3.161 DST=10.0.449.449 LEN=11 TOS=0x00 PREC=0x00 TTL=11 ID=33527 DF PROTO=TCP SPT=61393 DPT=61393 WINDOW=33527 RES=0x00 SYN URGP=0 2026-10-09T13:19:03.359275-07:00 bastion nginx[1207]: 91.80.9.85 - - "GET /api/v2/users HTTP/1.1" 204 19543 "-" "Go-http-client/1.1" 2026-10-09T13:19:03.439641-07:00 api-07 kernel: [60951.220281] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.11.17.128 DST=10.0.818.818 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=60951 DF PROTO=TCP SPT=50189 DPT=50189 WINDOW=60951 RES=0x00 SYN URGP=0 2026-10-09T13:19:03.566775-07:00 db-replica haproxy[905]: 172.173.128.39:22104 [61305] http-in app/api-07 8640/0/905/905/8640 502 41065 - - ---- 793/793/93/93/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:03.745496-07:00 db-primary haproxy[947]: 172.220.240.7:22441 [45314] http-in app/web-02 9351/0/350/350/9351 502 30951 - - ---- 414/414/46/46/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:19:03.927719-07:00 bastion nginx[1201]: 203.123.242.118 - priya "POST /static/app.js HTTP/1.1" 200 15134 "-" "Go-http-client/1.1" 2026-10-09T13:19:04.185043-07:00 web-01 app[30739]: WARN slow query (3966 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '79 minutes' 2026-10-09T13:19:04.206812-07:00 bastion sshd[43673]: pam_unix(sshd:session): session opened for user sørensen(uid=6242) by (uid=0) 2026-10-09T13:19:04.257763-07:00 api-07 sshd[63466]: pam_unix(sshd:session): session opened for user müller(uid=1554) by (uid=0) 2026-10-09T13:19:04.288237-07:00 bastion nginx[1203]: 10.203.16.165 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 38363 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:04.288832-07:00 db-replica app[30844]: INFO request_id=e9657a5365f0145e method=GET path=/wp-login.php status=502 duration=3444ms 2026-10-09T13:19:04.322223-07:00 api-08 nginx[1202]: 10.117.190.25 - - "GET /login HTTP/1.1" 200 59665 "-" "python-requests/2.32.3" 2026-10-09T13:19:04.334192-07:00 web-03 app[30962]: INFO worker 76 picked job 9ca4e11d88bafb14 from queue orders 2026-10-09T13:19:04.353159-07:00 worker-12 app[30002]: INFO order 76685 confirmed for müller in 3226 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:19:04.428302-07:00 cache-3 systemd[1]: session-22777.scope: Deactivated successfully. 2026-10-09T13:19:04.435978-07:00 bastion nginx[1210]: 91.0.235.221 - - "GET /wp-login.php HTTP/1.1" 200 23721 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:04.450089-07:00 bastion app[30553]: DEBUG cache hit ratio 43% over the last minute (20016 lookups) 2026-10-09T13:19:04.943958-07:00 bastion nginx[1202]: 192.9.121.118 - - "GET /api/v2/orders HTTP/1.1" 404 57835 "-" "kube-probe/1.31" 2026-10-09T13:19:05.043328-07:00 worker-12 systemd[1]: session-55472.scope: Deactivated successfully. 2026-10-09T13:19:05.121140-07:00 api-07 app[30018]: INFO order 55224 confirmed for ci in 1805 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:19:05.124138-07:00 web-01 app[30085]: INFO request_id=a55f554d11d0b8d7 method=GET path=/health status=200 duration=3943ms 2026-10-09T13:19:05.400557-07:00 web-03 sshd[25324]: Connection closed by 172.173.81.73 port 36748 [preauth] 2026-10-09T13:19:05.539566-07:00 edge-fr-1 kernel: [50174.102958] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/app.service,task=java,pid=50174,uid=4601 2026-10-09T13:19:05.706175-07:00 api-08 haproxy[906]: 10.85.101.201:56006 [65005] http-in app/worker-12 6111/0/543/543/6111 401 61115 - - ---- 460/460/33/33/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:19:05.884651-07:00 web-01 nginx[1201]: 45.190.55.98 - - "GET /api/v2/orders HTTP/1.1" 301 42510 "-" "kube-probe/1.31" 2026-10-09T13:19:06.062011-07:00 web-03 app[30170]: INFO order 99399 confirmed for zoë in 4894 ms (region eu-west-1, queue emails) 2026-10-09T13:19:06.216861-07:00 bastion haproxy[915]: 203.11.147.236:32649 [68957] http-in app/web-02 5251/0/750/750/5251 200 20988 - - ---- 546/546/65/65/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:06.276484-07:00 db-replica kernel: [39458.694396] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.68.27.27 DST=10.0.876.876 LEN=43 TOS=0x00 PREC=0x00 TTL=43 ID=39458 DF PROTO=TCP SPT=52298 DPT=52298 WINDOW=39458 RES=0x00 SYN URGP=0 2026-10-09T13:19:06.448261-07:00 web-03 nginx[1202]: 203.178.86.150 - zoë "POST /static/app.js HTTP/1.1" 200 1791 "-" "kube-probe/1.31" 2026-10-09T13:19:06.707052-07:00 edge-fr-1 haproxy[940]: 10.218.224.203:2422 [69395] http-in app/web-02 3867/0/214/214/3867 502 72059 - - ---- 992/992/93/93/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:19:06.725974-07:00 bastion sshd[52557]: Accepted publickey for françois from 203.170.91.9 port 9555 ssh2: ED25519 SHA256:3e1c4ee89944cdee 2026-10-09T13:19:06.760661-07:00 web-02 nginx[1208]: 91.146.208.145 - sørensen "POST /login HTTP/1.1" 302 20021 "-" "python-requests/2.32.3" 2026-10-09T13:19:06.773817-07:00 api-07 app[30381]: INFO request_id=0bb22ee3aea281db method=GET path=/api/v2/orders status=200 duration=6816ms 2026-10-09T13:19:06.941935-07:00 web-02 app[30138]: WARN slow query (61 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '63 minutes' 2026-10-09T13:19:07.199497-07:00 db-replica nginx[1209]: 203.241.14.76 - - "GET /api/v2/orders HTTP/1.1" 200 18996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:07.577989-07:00 db-primary nginx[1204]: 45.184.127.149 - - "GET /health HTTP/1.1" 500 35402 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:07.621106-07:00 db-primary sshd[23003]: Received disconnect from 203.29.195.32 port 9183:11: Bye Bye [preauth] 2026-10-09T13:19:07.714487-07:00 db-replica nginx[1209]: 45.158.232.207 - - "GET /.env HTTP/1.1" 301 79234 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:07.813795-07:00 web-01 kernel: [19820.718314] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.32.247.232 DST=10.0.266.266 LEN=37 TOS=0x00 PREC=0x00 TTL=37 ID=19820 DF PROTO=TCP SPT=5987 DPT=5987 WINDOW=19820 RES=0x00 SYN URGP=0 2026-10-09T13:19:07.891736-07:00 db-primary nginx[1204]: 203.161.217.120 - müller "POST /admin HTTP/1.1" 200 18549 "-" "python-requests/2.32.3" 2026-10-09T13:19:07.958491-07:00 web-01 app[30093]: INFO worker 21 picked job 3944261c24ae5085 from queue webhooks 2026-10-09T13:19:08.069167-07:00 db-replica app[30374]: INFO request_id=9e9564462192467a method=GET path=/api/v2/orders status=404 duration=6685ms 2026-10-09T13:19:08.165501-07:00 api-07 app[30486]: INFO order 46836 confirmed for ci in 5348 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:19:08.225525-07:00 api-07 app[30913]: INFO worker 14 finished job 7e2e9991c5188688 in 236 ms 2026-10-09T13:19:08.279019-07:00 db-primary app[30907]: INFO worker 64 finished job 0a31bc59a71e00d5 in 2316 ms 2026-10-09T13:19:08.302058-07:00 cache-3 app[30236]: ERROR cache miss storm: 4604 misses in 8709 ms, key prefix session:müller 2026-10-09T13:19:08.393535-07:00 web-03 app[30265]: DEBUG cache hit ratio 72% over the last minute (13353 lookups) 2026-10-09T13:19:08.850423-07:00 edge-fr-1 nginx[1200]: 192.84.123.99 - - "GET /metrics HTTP/1.1" 200 66000 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:09.243679-07:00 web-01 app[30225]: INFO request_id=9b86cecd780adaa8 method=GET path=/api/v2/search?q=invoice status=200 duration=4429ms 2026-10-09T13:19:09.278986-07:00 web-03 nginx[1201]: 10.120.203.241 - akira "POST /api/v2/orders HTTP/1.1" 200 86533 "-" "Go-http-client/1.1" 2026-10-09T13:19:09.303260-07:00 api-08 haproxy[917]: 192.113.128.226:14054 [18144] http-in app/api-08 477/0/693/693/477 200 80848 - - ---- 131/131/76/76/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:09.331543-07:00 db-replica app[30608]: WARN slow query (1009 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '79 minutes' 2026-10-09T13:19:09.521649-07:00 api-07 sshd[59859]: Connection closed by 45.74.80.106 port 1974 [preauth] 2026-10-09T13:19:09.662745-07:00 web-01 app[30665]: INFO order 39950 confirmed for ci in 4346 ms (region us-east-1, queue webhooks) 2026-10-09T13:19:09.823194-07:00 web-03 nginx[1201]: 192.88.230.201 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 79294 "-" "curl/8.4.0" 2026-10-09T13:19:10.062783-07:00 web-03 sshd[1868]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:19:10.250851-07:00 cache-3 app[30685]: WARN retrying upstream 91.245.41.102:50250 after timeout (9051 ms), attempt 1 of 3 2026-10-09T13:19:10.322742-07:00 worker-12 sshd[55337]: Connection closed by 172.193.26.215 port 48768 [preauth] 2026-10-09T13:19:10.348426-07:00 worker-12 app[30852]: INFO worker 52 picked job 58c37d06ce197151 from queue orders 2026-10-09T13:19:10.361439-07:00 db-replica app[30875]: INFO order 14601 confirmed for deploy in 3479 ms (region eu-west-1, queue orders) 2026-10-09T13:19:10.371817-07:00 db-primary haproxy[903]: 91.92.103.244:41587 [25171] http-in app/edge-fr-1 3826/0/569/569/3826 502 82781 - - ---- 542/542/57/57/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:10.439598-07:00 cache-3 nginx[1206]: 192.220.93.59 - - "GET /api/v2/users HTTP/1.1" 301 1961 "-" "curl/8.4.0" 2026-10-09T13:19:10.484688-07:00 web-02 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:19:10.603624-07:00 bastion app[30217]: INFO worker 29 finished job f8d3622ebd0e9a20 in 1102 ms 2026-10-09T13:19:10.605924-07:00 db-replica app[30299]: INFO worker 90 finished job a16f273d8c1d9cda in 7639 ms 2026-10-09T13:19:10.760583-07:00 db-replica nginx[1206]: 45.207.57.109 - - "GET /static/app.js HTTP/1.1" 301 59931 "-" "python-requests/2.32.3" 2026-10-09T13:19:10.799535-07:00 bastion systemd[1]: session-19346.scope: Deactivated successfully. 2026-10-09T13:19:11.008595-07:00 db-primary app[30479]: INFO order 20066 confirmed for zoë in 6806 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:19:11.193562-07:00 bastion haproxy[910]: 45.140.86.24:41020 [84883] http-in app/api-08 8612/0/441/441/8612 200 4198 - - ---- 906/906/10/10/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:19:11.201738-07:00 db-primary haproxy[936]: 172.61.132.103:2499 [48446] http-in app/bastion 729/0/612/612/729 401 26734 - - ---- 401/401/72/72/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:19:11.263123-07:00 web-01 systemd[1]: Started Session 63120 of User zoë. 2026-10-09T13:19:11.269395-07:00 api-08 sshd[61717]: Accepted publickey for müller from 172.25.38.190 port 56302 ssh2: ED25519 SHA256:a2c0848e6c79c119 2026-10-09T13:19:11.330950-07:00 api-07 app[30207]: INFO order 19157 confirmed for müller in 6502 ms (region eu-west-1, queue emails) 2026-10-09T13:19:11.482948-07:00 api-08 systemd[1]: Started Session 84395 of User priya. 2026-10-09T13:19:11.634450-07:00 db-primary postgres[21842]: ERROR: deadlock detected 2026-10-09T13:19:11.666501-07:00 db-replica haproxy[935]: 172.144.109.107:30344 [98940] http-in app/edge-fr-1 5873/0/839/839/5873 200 48727 - - ---- 941/941/80/80/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:19:11.698632-07:00 worker-12 sshd[3578]: pam_unix(sshd:session): session opened for user sørensen(uid=4959) by (uid=0) 2026-10-09T13:19:11.774805-07:00 db-replica nginx[1202]: 45.3.251.105 - françois "POST /static/main.css HTTP/1.1" 200 46833 "-" "python-requests/2.32.3" 2026-10-09T13:19:11.804854-07:00 bastion systemd[1]: session-45970.scope: Deactivated successfully. 2026-10-09T13:19:12.008494-07:00 web-02 app[30336]: INFO request_id=9063c8c6deea0284 method=GET path=/api/v2/users status=200 duration=5655ms 2026-10-09T13:19:12.082882-07:00 edge-fr-1 app[30497]: INFO worker 43 finished job 3a2b20920a2afb2b in 3113 ms 2026-10-09T13:19:12.141510-07:00 web-02 nginx[1209]: 45.0.102.138 - - "GET /wp-login.php HTTP/1.1" 200 18223 "-" "Go-http-client/1.1" 2026-10-09T13:19:12.169252-07:00 worker-12 haproxy[911]: 45.92.201.99:34216 [25909] http-in app/edge-fr-1 3074/0/821/821/3074 404 34825 - - ---- 306/306/62/62/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:19:12.345861-07:00 web-01 nginx[1208]: 203.96.199.24 - deploy "POST /static/main.css HTTP/1.1" 404 79758 "-" "kube-probe/1.31" 2026-10-09T13:19:12.578259-07:00 cache-3 sshd[62005]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:19:13.054375-07:00 api-07 postgres[21704]: LOG: checkpoint complete: wrote 2649 buffers (42%); 0 WAL file(s) added, 0 removed, 62 recycled; write=7855.248 s, sync=0.248 s, total=7855.248 s 2026-10-09T13:19:13.309924-07:00 api-07 sshd[18415]: Connection closed by 91.15.93.151 port 7085 [preauth] 2026-10-09T13:19:13.417449-07:00 web-03 sshd[2595]: Invalid user akira from 192.235.13.194 port 3375 2026-10-09T13:19:13.548003-07:00 worker-12 app[30945]: INFO request_id=d9f19acad9059fbf method=GET path=/wp-login.php status=401 duration=2486ms 2026-10-09T13:19:13.592860-07:00 edge-fr-1 nginx[1200]: 192.201.173.252 - - "GET /login HTTP/1.1" 301 70950 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:13.658200-07:00 web-03 sshd[25071]: Invalid user müller from 203.235.112.40 port 48604 2026-10-09T13:19:13.716012-07:00 edge-fr-1 sshd[34499]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:19:13.833860-07:00 edge-fr-1 kernel: [12051.586874] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.143.84.230 DST=10.0.688.688 LEN=92 TOS=0x00 PREC=0x00 TTL=92 ID=12051 DF PROTO=TCP SPT=57969 DPT=57969 WINDOW=12051 RES=0x00 SYN URGP=0 2026-10-09T13:19:13.937582-07:00 bastion sshd[33779]: Received disconnect from 203.208.205.169 port 61231:11: Bye Bye [preauth] 2026-10-09T13:19:14.035469-07:00 web-02 app[30642]: INFO worker 45 picked job b9b22d454c162763 from queue invoices 2026-10-09T13:19:14.064004-07:00 db-primary app[30515]: INFO worker 83 finished job b5c8b7e687eb4f3c in 6248 ms 2026-10-09T13:19:14.090265-07:00 worker-12 app[30262]: INFO request_id=c9235172bf75b13c method=GET path=/favicon.ico status=502 duration=251ms 2026-10-09T13:19:14.278590-07:00 web-02 app[30844]: INFO health check ok: db 907 ms, cache 907 ms, queue depth 32 2026-10-09T13:19:14.308745-07:00 web-03 haproxy[926]: 45.161.37.91:30628 [91371] http-in app/web-01 1705/0/236/236/1705 301 70925 - - ---- 909/909/33/33/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:19:14.505141-07:00 cache-3 sshd[30020]: Accepted publickey for root from 192.12.19.181 port 6399 ssh2: ED25519 SHA256:3e6a1cf382501772 2026-10-09T13:19:14.577555-07:00 db-replica app[30684]: INFO order 22227 confirmed for françois in 5400 ms (region us-east-1, queue invoices) 2026-10-09T13:19:14.609656-07:00 web-03 kernel: [85544.765466] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.242.85.94 DST=10.0.764.764 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=85544 DF PROTO=TCP SPT=57057 DPT=57057 WINDOW=85544 RES=0x00 SYN URGP=0 2026-10-09T13:19:14.621890-07:00 web-03 app[30677]: INFO worker 61 picked job 8f0a8b7f9ed5d928 from queue invoices 2026-10-09T13:19:14.804188-07:00 cache-3 nginx[1203]: 10.105.120.58 - - "GET /static/main.css HTTP/1.1" 200 82643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:14.937336-07:00 worker-12 nginx[1210]: 91.206.118.191 - - "GET /.env HTTP/1.1" 200 69966 "-" "Go-http-client/1.1" 2026-10-09T13:19:15.039800-07:00 api-08 sshd[62765]: Connection closed by 172.117.133.94 port 41460 [preauth] 2026-10-09T13:19:15.295802-07:00 api-07 nginx[1200]: 192.80.134.239 - - "GET /favicon.ico HTTP/1.1" 502 3302 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:15.407571-07:00 web-01 app[30400]: INFO worker 99 picked job a4cc6057096074bb from queue emails 2026-10-09T13:19:15.539497-07:00 bastion haproxy[931]: 203.20.198.216:37718 [22371] http-in app/web-01 6726/0/665/665/6726 500 86539 - - ---- 162/162/69/69/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:19:15.549386-07:00 web-01 haproxy[921]: 203.149.209.135:53713 [21245] http-in app/web-03 6912/0/905/905/6912 200 89703 - - ---- 162/162/83/83/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:19:15.680730-07:00 api-07 app[30574]: INFO request_id=0c47437b71ee0c02 method=GET path=/.env status=302 duration=3965ms 2026-10-09T13:19:16.038565-07:00 db-replica app[30909]: INFO order 98627 confirmed for sørensen in 6355 ms (region eu-west-1, queue webhooks) 2026-10-09T13:19:16.079572-07:00 web-02 nginx[1204]: 91.29.12.24 - - "GET /wp-login.php HTTP/1.1" 200 35753 "-" "python-requests/2.32.3" 2026-10-09T13:19:16.088365-07:00 api-07 sshd[61696]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:19:16.116555-07:00 db-primary sshd[8683]: Accepted publickey for zoë from 192.2.213.67 port 33814 ssh2: ED25519 SHA256:652af76e01179a13 2026-10-09T13:19:16.121804-07:00 bastion nginx[1204]: 172.132.158.2 - - "GET /health HTTP/1.1" 204 85658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:16.222521-07:00 db-replica nginx[1205]: 203.15.176.226 - - "GET /static/app.js HTTP/1.1" 401 75242 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:16.377109-07:00 db-replica app[30670]: DEBUG cache hit ratio 67% over the last minute (98665 lookups) 2026-10-09T13:19:16.826481-07:00 db-replica app[30967]: INFO worker 38 finished job 87a13098987a21ac in 4342 ms 2026-10-09T13:19:16.894175-07:00 db-replica nginx[1202]: 91.25.18.151 - - "GET /.env HTTP/1.1" 500 40202 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:16.968214-07:00 cache-3 kernel: [21589.976530] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.176.195.197 DST=10.0.827.827 LEN=91 TOS=0x00 PREC=0x00 TTL=91 ID=21589 DF PROTO=TCP SPT=62850 DPT=62850 WINDOW=21589 RES=0x00 SYN URGP=0 2026-10-09T13:19:17.212564-07:00 web-01 nginx[1207]: 192.38.220.233 - - "GET /api/v2/orders HTTP/1.1" 500 60850 "-" "Go-http-client/1.1" 2026-10-09T13:19:17.316737-07:00 edge-fr-1 sshd[22704]: Invalid user müller from 10.49.92.225 port 20185 2026-10-09T13:19:17.584301-07:00 edge-fr-1 nginx[1202]: 91.32.223.170 - priya "POST /api/v2/orders HTTP/1.1" 302 21945 "-" "python-requests/2.32.3" 2026-10-09T13:19:17.712284-07:00 db-primary app[30886]: INFO order 55410 confirmed for ci in 823 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:19:17.942702-07:00 db-primary app[30104]: INFO request_id=07f8921530981f80 method=GET path=/api/v2/users status=404 duration=1505ms 2026-10-09T13:19:17.951099-07:00 api-08 app[30931]: INFO order 18473 confirmed for ci in 5961 ms (region us-east-1, queue orders) 2026-10-09T13:19:17.978042-07:00 cache-3 sshd[51295]: pam_unix(sshd:session): session opened for user sørensen(uid=5528) by (uid=0) 2026-10-09T13:19:18.152978-07:00 worker-12 systemd[1]: Started Session 92125 of User zoë. 2026-10-09T13:19:18.250582-07:00 web-02 nginx[1207]: 10.184.129.33 - müller "POST /static/main.css HTTP/1.1" 200 52766 "-" "curl/8.4.0" 2026-10-09T13:19:18.261608-07:00 api-08 systemd[1]: session-60872.scope: Deactivated successfully. 2026-10-09T13:19:18.383429-07:00 web-01 postgres[4084]: LOG: duration: 6369.124 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:18.435975-07:00 cache-3 kernel: [77012.129383] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.231.57.148 DST=10.0.739.739 LEN=24 TOS=0x00 PREC=0x00 TTL=24 ID=77012 DF PROTO=TCP SPT=37724 DPT=37724 WINDOW=77012 RES=0x00 SYN URGP=0 2026-10-09T13:19:18.535636-07:00 db-primary nginx[1204]: 91.25.80.213 - - "GET /api/v2/users HTTP/1.1" 200 16883 "-" "kube-probe/1.31" 2026-10-09T13:19:18.690056-07:00 api-07 app[30856]: INFO request_id=7f30adf91e74e18d method=GET path=/api/v2/users status=200 duration=1832ms 2026-10-09T13:19:18.701203-07:00 api-08 app[30813]: INFO order 27655 confirmed for müller in 9940 ms (region us-east-1, queue emails) 2026-10-09T13:19:19.110573-07:00 api-07 nginx[1201]: 203.1.5.144 - - "GET /favicon.ico HTTP/1.1" 200 88041 "-" "Go-http-client/1.1" 2026-10-09T13:19:19.194668-07:00 web-02 app[30662]: INFO request_id=fbc168aeb3826668 method=GET path=/api/v2/users status=301 duration=8097ms 2026-10-09T13:19:19.309405-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577159.956:37269): pid=37269 uid=0 auid=9071 ses=220 msg='op=login id=9071 exe="/usr/sbin/sshd" hostname=? addr=203.198.88.30 terminal=/dev/pts/0 res=success' 2026-10-09T13:19:19.449890-07:00 edge-fr-1 sshd[2646]: Failed password for invalid user françois from 192.164.116.39 port 60735 ssh2 2026-10-09T13:19:19.454113-07:00 db-primary sudo: sørensen : TTY=pts/0 ; PWD=/home/sørensen ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:19:19.776343-07:00 cache-3 sshd[38109]: Invalid user ci from 172.143.70.104 port 54813 2026-10-09T13:19:20.020230-07:00 api-07 nginx[1210]: 10.145.42.54 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 62818 "-" "curl/8.4.0" 2026-10-09T13:19:20.101418-07:00 db-replica sshd[37473]: Connection closed by 203.120.142.71 port 50439 [preauth] 2026-10-09T13:19:20.127893-07:00 cache-3 haproxy[922]: 192.43.49.104:22863 [58623] http-in app/edge-fr-1 9042/0/702/702/9042 200 8152 - - ---- 754/754/78/78/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:19:20.136341-07:00 db-primary app[30686]: INFO order 85680 confirmed for deploy in 1349 ms (region us-east-1, queue orders) 2026-10-09T13:19:20.199846-07:00 web-02 postgres[17297]: LOG: checkpoint complete: wrote 8294 buffers (19%); 0 WAL file(s) added, 0 removed, 98 recycled; write=3531.695 s, sync=0.695 s, total=3531.695 s 2026-10-09T13:19:20.308701-07:00 bastion app[30121]: INFO worker 33 picked job ff6667ae6ff2f322 from queue webhooks 2026-10-09T13:19:20.578903-07:00 bastion nginx[1205]: 172.3.28.215 - - "GET /wp-login.php HTTP/1.1" 401 15872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:20.588934-07:00 web-03 sshd[50694]: Connection closed by 203.241.136.193 port 40834 [preauth] 2026-10-09T13:19:20.598607-07:00 web-01 app[30170]: INFO request_id=058a90061f9ee2f5 method=GET path=/login status=500 duration=8992ms 2026-10-09T13:19:20.926997-07:00 edge-fr-1 sshd[40452]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:19:20.932406-07:00 api-07 app[30004]: INFO request_id=d195517181bbb918 method=GET path=/health status=401 duration=1351ms 2026-10-09T13:19:20.966201-07:00 bastion systemd[1]: session-70790.scope: Deactivated successfully. 2026-10-09T13:19:21.187034-07:00 bastion nginx[1202]: 192.161.217.79 - - "GET /static/app.js HTTP/1.1" 404 39140 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:21.223000-07:00 edge-fr-1 app[30373]: DEBUG cache hit ratio 74% over the last minute (35617 lookups) 2026-10-09T13:19:21.242567-07:00 worker-12 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:19:21.380842-07:00 cache-3 app[30519]: INFO request_id=0386667eef1a44cb method=GET path=/metrics status=200 duration=7420ms 2026-10-09T13:19:21.399728-07:00 web-02 app[30733]: INFO request_id=89a05ca4d5a04d13 method=GET path=/static/main.css status=502 duration=577ms 2026-10-09T13:19:21.744563-07:00 web-03 nginx[1209]: 45.130.25.247 - - "GET /favicon.ico HTTP/1.1" 404 63931 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:21.771866-07:00 edge-fr-1 app[30157]: INFO request_id=23a9edf0abe4e186 method=GET path=/static/app.js status=301 duration=7916ms 2026-10-09T13:19:21.871013-07:00 web-03 nginx[1207]: 192.140.134.123 - - "GET /api/v2/orders HTTP/1.1" 200 69897 "-" "kube-probe/1.31" 2026-10-09T13:19:22.048916-07:00 api-07 sshd[45514]: pam_unix(sshd:session): session opened for user müller(uid=8610) by (uid=0) 2026-10-09T13:19:22.092248-07:00 db-primary postgres[30974]: LOG: duration: 1655.709 ms statement: SELECT * FROM orders WHERE customer_id = 30300 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:22.261127-07:00 db-replica app[30446]: INFO request_id=606e382b07902399 method=GET path=/api/v2/search?q=invoice status=200 duration=465ms 2026-10-09T13:19:22.261172-07:00 api-07 systemd[1]: Started Session 35945 of User müller. 2026-10-09T13:19:22.265613-07:00 edge-fr-1 app[30316]: INFO worker 61 finished job 06e033dc68901c62 in 6060 ms 2026-10-09T13:19:22.336244-07:00 db-primary app[30598]: INFO request_id=98677098f67ff6f3 method=GET path=/login status=204 duration=5761ms 2026-10-09T13:19:22.379460-07:00 edge-fr-1 sshd[7893]: Received disconnect from 192.164.95.212 port 39521:11: Bye Bye [preauth] 2026-10-09T13:19:22.812827-07:00 db-primary app[30208]: INFO request_id=d03a7dead259819b method=GET path=/api/v2/orders/8841 status=200 duration=3516ms 2026-10-09T13:19:22.853711-07:00 bastion nginx[1208]: 203.243.5.189 - - "GET /static/app.js HTTP/1.1" 500 34797 "-" "python-requests/2.32.3" 2026-10-09T13:19:22.937655-07:00 edge-fr-1 sshd[61979]: pam_unix(sshd:session): session opened for user ci(uid=8806) by (uid=0) 2026-10-09T13:19:22.985302-07:00 web-02 sshd[18245]: pam_unix(sshd:session): session opened for user priya(uid=6488) by (uid=0) 2026-10-09T13:19:23.056576-07:00 api-07 nginx[1200]: 45.89.96.104 - priya "POST /health HTTP/1.1" 500 13195 "-" "kube-probe/1.31" 2026-10-09T13:19:23.268415-07:00 api-07 nginx[1207]: 91.97.160.99 - - "GET /.env HTTP/1.1" 502 38982 "-" "python-requests/2.32.3" 2026-10-09T13:19:23.403189-07:00 api-08 app[30475]: INFO order 26564 confirmed for ci in 7325 ms (region us-east-1, queue emails) 2026-10-09T13:19:23.678257-07:00 bastion nginx[1206]: 10.109.113.240 - - "GET /health HTTP/1.1" 204 26406 "-" "curl/8.4.0" 2026-10-09T13:19:24.118777-07:00 web-01 sshd[2291]: Failed password for invalid user backup from 45.62.38.41 port 41175 ssh2 2026-10-09T13:19:24.196444-07:00 api-07 sshd[18546]: Connection closed by 192.15.64.115 port 50402 [preauth] 2026-10-09T13:19:24.198992-07:00 api-07 sshd[59460]: Connection closed by 172.216.83.61 port 12559 [preauth] 2026-10-09T13:19:24.236411-07:00 edge-fr-1 systemd[1]: Started Session 53449 of User sørensen. 2026-10-09T13:19:24.328405-07:00 db-replica app[30304]: INFO request_id=2e157908884cf6e2 method=GET path=/api/v2/orders status=200 duration=5780ms 2026-10-09T13:19:24.639539-07:00 web-02 sshd[34685]: Failed password for invalid user backup from 203.193.255.2 port 64006 ssh2 2026-10-09T13:19:24.790417-07:00 web-01 kernel: [39428.123218] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.118.154.105 DST=10.0.674.674 LEN=25 TOS=0x00 PREC=0x00 TTL=25 ID=39428 DF PROTO=TCP SPT=33597 DPT=33597 WINDOW=39428 RES=0x00 SYN URGP=0 2026-10-09T13:19:24.843827-07:00 db-replica nginx[1201]: 10.239.218.51 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 67717 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:25.007656-07:00 db-primary systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:19:25.009808-07:00 edge-fr-1 nginx[1201]: 172.150.219.61 - ci "POST /health HTTP/1.1" 404 88612 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:25.229876-07:00 web-03 nginx[1201]: 172.155.20.127 - - "GET /.env HTTP/1.1" 502 50606 "-" "python-requests/2.32.3" 2026-10-09T13:19:25.508359-07:00 db-primary postgres[7698]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 85637 remain, 6443 scanned (55% of total) 2026-10-09T13:19:25.558995-07:00 bastion kubelet[800]: E1009 13:19:25.333605 3890 pod_workers.go:3890] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-96a3b945bc7206f4" 2026-10-09T13:19:25.588653-07:00 edge-fr-1 app[30238]: INFO request_id=59eb1b22fcb0898d method=GET path=/static/app.js status=404 duration=3346ms 2026-10-09T13:19:25.680733-07:00 db-primary sshd[55270]: Connection closed by 45.243.63.252 port 35528 [preauth] 2026-10-09T13:19:25.716816-07:00 web-02 app[30116]: INFO worker 91 picked job cdd7cd5ca9111f01 from queue emails 2026-10-09T13:19:25.842218-07:00 edge-fr-1 sshd[45815]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:19:25.872605-07:00 web-03 haproxy[900]: 192.46.23.220:21773 [74134] http-in app/edge-fr-1 4108/0/101/101/4108 500 61075 - - ---- 250/250/42/42/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:19:25.931662-07:00 web-03 sshd[31946]: Failed password for invalid user sørensen from 10.153.27.37 port 9044 ssh2 2026-10-09T13:19:25.998032-07:00 edge-fr-1 systemd[1]: session-94061.scope: Deactivated successfully. 2026-10-09T13:19:26.011528-07:00 api-08 sshd[9296]: Accepted publickey for zoë from 45.63.235.201 port 11981 ssh2: ED25519 SHA256:e1844ed318511b7f 2026-10-09T13:19:26.066007-07:00 web-01 app[30582]: INFO health check ok: db 849 ms, cache 849 ms, queue depth 98 2026-10-09T13:19:26.121723-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577166.260:95128): pid=95128 uid=0 auid=7907 ses=251 msg='op=login id=7907 exe="/usr/sbin/sshd" hostname=? addr=192.16.90.137 terminal=/dev/pts/0 res=success' 2026-10-09T13:19:26.180128-07:00 worker-12 nginx[1203]: 45.84.109.25 - - "GET /wp-login.php HTTP/1.1" 404 27187 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:26.264518-07:00 worker-12 sshd[15515]: Received disconnect from 192.124.188.60 port 22349:11: Bye Bye [preauth] 2026-10-09T13:19:26.644517-07:00 api-07 app[30790]: INFO worker 89 picked job b6570104af0089d6 from queue invoices 2026-10-09T13:19:26.940417-07:00 edge-fr-1 nginx[1206]: 192.126.58.26 - deploy "POST /api/v2/orders HTTP/1.1" 302 73230 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:27.059747-07:00 api-07 dockerd[700]: time="2026-10-09T13:19:27.059747-07:00" level=info msg="Container 991daf48bc759241 exited with code 0" 2026-10-09T13:19:27.157289-07:00 worker-12 app[30494]: INFO request_id=9c3e6176a9b1aca3 method=GET path=/.env status=301 duration=4354ms 2026-10-09T13:19:27.436908-07:00 api-08 sshd[48287]: Connection closed by 45.24.12.59 port 47852 [preauth] 2026-10-09T13:19:27.483861-07:00 api-08 app[30934]: INFO request_id=7bba29cb136bf024 method=GET path=/api/v2/orders status=200 duration=3823ms 2026-10-09T13:19:27.525640-07:00 worker-12 app[30500]: INFO request_id=b10bf265f905f436 method=GET path=/admin status=200 duration=4651ms 2026-10-09T13:19:27.658576-07:00 web-01 kubelet[800]: E1009 13:19:27.707165 4549 pod_workers.go:4549] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-cc95a07b1e63a107" 2026-10-09T13:19:27.677377-07:00 web-03 haproxy[929]: 172.78.209.231:37859 [32374] http-in app/worker-12 7144/0/700/700/7144 200 35082 - - ---- 542/542/19/19/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:19:27.890335-07:00 web-02 sshd[2209]: Accepted publickey for ci from 203.119.97.129 port 60286 ssh2: ED25519 SHA256:6d1973ae076452b5 2026-10-09T13:19:27.929069-07:00 db-replica sshd[34125]: Connection closed by 203.90.189.182 port 46335 [preauth] 2026-10-09T13:19:27.940361-07:00 db-replica app[30091]: INFO order 94391 confirmed for françois in 7215 ms (region eu-west-1, queue webhooks) 2026-10-09T13:19:28.001961-07:00 api-07 app[30825]: INFO health check ok: db 323 ms, cache 323 ms, queue depth 60 2026-10-09T13:19:28.028371-07:00 db-primary app[30089]: INFO request_id=e21732c3500df05f method=GET path=/static/main.css status=404 duration=6033ms 2026-10-09T13:19:28.086712-07:00 edge-fr-1 app[30945]: INFO request_id=749c6ee98e4bbdf7 method=GET path=/metrics status=404 duration=3327ms 2026-10-09T13:19:28.170249-07:00 web-03 app[30301]: INFO health check ok: db 338 ms, cache 338 ms, queue depth 15 2026-10-09T13:19:28.265080-07:00 edge-fr-1 app[30919]: INFO request_id=e104ac5cfcdd0a3f method=GET path=/.env status=302 duration=3378ms 2026-10-09T13:19:28.380325-07:00 api-07 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:19:28.544837-07:00 api-08 nginx[1200]: 172.199.18.79 - - "GET /favicon.ico HTTP/1.1" 200 46317 "-" "Go-http-client/1.1" 2026-10-09T13:19:28.829772-07:00 worker-12 app[30971]: WARN slow query (3896 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '84 minutes' 2026-10-09T13:19:29.165255-07:00 worker-12 sshd[7224]: Connection closed by 45.232.2.162 port 27929 [preauth] 2026-10-09T13:19:29.209344-07:00 cache-3 nginx[1207]: 203.16.67.78 - - "GET /wp-login.php HTTP/1.1" 404 73911 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:29.386044-07:00 web-01 postgres[16764]: LOG: duration: 2531.947 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:29.433607-07:00 api-08 sshd[61210]: Received disconnect from 10.211.246.95 port 47231:11: Bye Bye [preauth] 2026-10-09T13:19:29.484841-07:00 api-08 nginx[1210]: 203.145.99.19 - - "GET /favicon.ico HTTP/1.1" 200 77090 "-" "python-requests/2.32.3" 2026-10-09T13:19:29.611244-07:00 web-03 nginx[1206]: 192.166.186.198 - - "GET /admin HTTP/1.1" 200 7095 "-" "curl/8.4.0" 2026-10-09T13:19:29.627431-07:00 edge-fr-1 postgres[2949]: LOG: duration: 9657.742 ms statement: SELECT * FROM orders WHERE customer_id = 44239 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:29.683619-07:00 edge-fr-1 sshd[28004]: pam_unix(sshd:session): session opened for user deploy(uid=6397) by (uid=0) 2026-10-09T13:19:29.688565-07:00 web-02 app[30581]: INFO worker 57 picked job 0ffcfc99fe65f358 from queue orders 2026-10-09T13:19:29.722575-07:00 cache-3 app[30424]: WARN slow query (7605 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '76 minutes' 2026-10-09T13:19:29.750893-07:00 db-replica nginx[1201]: 91.208.107.83 - - "GET /wp-login.php HTTP/1.1" 502 29835 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:29.890274-07:00 edge-fr-1 postgres[8541]: LOG: duration: 9144.578 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:29.956488-07:00 db-primary app[30740]: DEBUG cache hit ratio 78% over the last minute (74765 lookups) 2026-10-09T13:19:29.964680-07:00 cache-3 haproxy[949]: 45.129.137.240:9069 [78568] http-in app/db-primary 8780/0/245/245/8780 200 38871 - - ---- 141/141/21/21/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:29.964695-07:00 api-08 nginx[1203]: 203.169.61.71 - - "GET /wp-login.php HTTP/1.1" 204 66195 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:29.985879-07:00 db-primary postgres[25912]: LOG: duration: 2901.873 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:30.013911-07:00 db-replica app[30524]: INFO health check ok: db 14 ms, cache 14 ms, queue depth 11 2026-10-09T13:19:30.216793-07:00 edge-fr-1 nginx[1206]: 192.149.165.199 - françois "POST /favicon.ico HTTP/1.1" 204 10881 "-" "curl/8.4.0" 2026-10-09T13:19:30.236556-07:00 web-01 haproxy[921]: 91.57.208.76:5318 [18507] http-in app/web-03 3818/0/114/114/3818 401 88552 - - ---- 345/345/16/16/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:19:30.250633-07:00 db-replica sshd[46599]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:19:30.522611-07:00 web-01 sshd[52020]: Accepted publickey for sørensen from 192.117.140.128 port 59178 ssh2: ED25519 SHA256:20290fee808549d8 2026-10-09T13:19:30.690777-07:00 web-02 haproxy[903]: 192.132.168.119:48467 [70088] http-in app/db-replica 1174/0/152/152/1174 200 88398 - - ---- 270/270/31/31/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:19:30.812695-07:00 web-01 sshd[36570]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:19:30.830266-07:00 worker-12 nginx[1206]: 172.173.161.217 - - "GET /admin HTTP/1.1" 200 17095 "-" "python-requests/2.32.3" 2026-10-09T13:19:30.891269-07:00 web-01 nginx[1200]: 203.12.45.73 - - "GET /static/main.css HTTP/1.1" 200 82956 "-" "Go-http-client/1.1" 2026-10-09T13:19:30.913112-07:00 cache-3 app[30488]: INFO request_id=9017972561634192 method=GET path=/static/app.js status=200 duration=8606ms 2026-10-09T13:19:30.963321-07:00 web-01 kernel: [98719.821073] TCP: request_sock_TCP: Possible SYN flooding on port 28973. Sending cookies. Check SNMP counters. 2026-10-09T13:19:30.977289-07:00 bastion kernel: [31867.595152] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.198.249.127 DST=10.0.953.953 LEN=60 TOS=0x00 PREC=0x00 TTL=60 ID=31867 DF PROTO=TCP SPT=18733 DPT=18733 WINDOW=31867 RES=0x00 SYN URGP=0 2026-10-09T13:19:31.272057-07:00 web-03 nginx[1206]: 45.233.129.215 - - "GET /wp-login.php HTTP/1.1" 204 73160 "-" "kube-probe/1.31" 2026-10-09T13:19:31.587412-07:00 db-primary systemd[1]: session-60171.scope: Deactivated successfully. 2026-10-09T13:19:31.754467-07:00 web-03 haproxy[919]: 45.72.134.220:7637 [50584] http-in app/bastion 8269/0/20/20/8269 200 77477 - - ---- 150/150/27/27/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:19:31.897724-07:00 api-08 app[30406]: INFO request_id=5c41225939a34983 method=GET path=/metrics status=200 duration=7463ms 2026-10-09T13:19:31.999049-07:00 db-replica nginx[1209]: 172.175.115.224 - root "POST /metrics HTTP/1.1" 404 47418 "-" "curl/8.4.0" 2026-10-09T13:19:32.004077-07:00 bastion kubelet[800]: E1009 13:19:32.228240 8754 pod_workers.go:8754] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-913866e166456304" 2026-10-09T13:19:32.054501-07:00 cache-3 sshd[14940]: Received disconnect from 192.25.61.45 port 42444:11: Bye Bye [preauth] 2026-10-09T13:19:32.251830-07:00 bastion postgres[21262]: LOG: duration: 7111.90 ms statement: SELECT * FROM orders WHERE customer_id = 56193 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:32.266484-07:00 db-primary nginx[1204]: 203.225.155.17 - - "GET /api/v2/users HTTP/1.1" 200 15809 "-" "kube-probe/1.31" 2026-10-09T13:19:32.662442-07:00 api-08 app[30848]: INFO worker 52 picked job 3aa5984c560eccfa from queue invoices 2026-10-09T13:19:32.989898-07:00 api-07 haproxy[941]: 91.147.82.246:37211 [20107] http-in app/web-02 4720/0/686/686/4720 200 27873 - - ---- 405/405/91/91/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:19:33.220299-07:00 worker-12 kernel: [63824.351556] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.52.67.236 DST=10.0.846.846 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=63824 DF PROTO=TCP SPT=21086 DPT=21086 WINDOW=63824 RES=0x00 SYN URGP=0 2026-10-09T13:19:33.249107-07:00 worker-12 app[30104]: INFO worker 15 picked job 954e6ee3e5693922 from queue invoices 2026-10-09T13:19:33.363849-07:00 web-03 postgres[23600]: LOG: duration: 9022.484 ms statement: SELECT * FROM orders WHERE customer_id = 27051 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:33.487061-07:00 api-07 sshd[20789]: Failed password for invalid user müller from 45.17.42.15 port 18034 ssh2 2026-10-09T13:19:33.792164-07:00 worker-12 sshd[59873]: Accepted publickey for sørensen from 203.163.53.109 port 54307 ssh2: ED25519 SHA256:bf50882364abb7b1 2026-10-09T13:19:33.801378-07:00 web-01 sshd[22932]: Failed password for invalid user deploy from 91.249.47.113 port 22064 ssh2 2026-10-09T13:19:33.850821-07:00 bastion postgres[19444]: LOG: duration: 4013.601 ms statement: SELECT * FROM orders WHERE customer_id = 53942 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:33.891470-07:00 web-03 kernel: [33395.879136] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.127.149.237 DST=10.0.771.771 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=33395 DF PROTO=TCP SPT=11485 DPT=11485 WINDOW=33395 RES=0x00 SYN URGP=0 2026-10-09T13:19:33.982278-07:00 worker-12 app[30318]: ERROR cache miss storm: 6197 misses in 6055 ms, key prefix session:sørensen 2026-10-09T13:19:34.543329-07:00 api-08 kernel: [43427.342515] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.200.212.59 DST=10.0.128.128 LEN=39 TOS=0x00 PREC=0x00 TTL=39 ID=43427 DF PROTO=TCP SPT=31067 DPT=31067 WINDOW=43427 RES=0x00 SYN URGP=0 2026-10-09T13:19:34.602326-07:00 worker-12 nginx[1206]: 10.88.108.160 - - "GET /metrics HTTP/1.1" 200 77772 "-" "python-requests/2.32.3" 2026-10-09T13:19:34.698887-07:00 cache-3 app[30216]: INFO request_id=3e8b89cfd05dc651 method=GET path=/health status=200 duration=1483ms 2026-10-09T13:19:34.713454-07:00 db-replica sshd[60953]: Failed password for invalid user priya from 172.99.36.205 port 33023 ssh2 2026-10-09T13:19:34.764268-07:00 web-02 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:19:35.147190-07:00 web-02 nginx[1202]: 45.161.43.118 - - "GET /admin HTTP/1.1" 404 77787 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:35.252388-07:00 web-02 sshd[25089]: Accepted publickey for akira from 203.100.176.20 port 52656 ssh2: ED25519 SHA256:e2bb8bf0ef489a2a 2026-10-09T13:19:35.496589-07:00 web-01 nginx[1208]: 91.39.230.57 - zoë "POST /login HTTP/1.1" 200 25852 "-" "curl/8.4.0" 2026-10-09T13:19:35.518941-07:00 web-03 app[30928]: ERROR payment declined for order 38419: card_declined (code 38), customer notified 2026-10-09T13:19:35.570957-07:00 web-01 dockerd[700]: time="2026-10-09T13:19:35.570957-07:00" level=info msg="Container ff5e1a90530b3a46 exited with code 0" 2026-10-09T13:19:35.614802-07:00 worker-12 nginx[1207]: 192.62.207.26 - - "GET /login HTTP/1.1" 302 31102 "-" "curl/8.4.0" 2026-10-09T13:19:35.627253-07:00 api-08 kernel: [98995.155355] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.131.247.33 DST=10.0.770.770 LEN=55 TOS=0x00 PREC=0x00 TTL=55 ID=98995 DF PROTO=TCP SPT=14288 DPT=14288 WINDOW=98995 RES=0x00 SYN URGP=0 2026-10-09T13:19:36.215015-07:00 bastion postgres[3704]: LOG: duration: 8644.871 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:36.268765-07:00 web-02 postgres[3062]: LOG: duration: 1272.326 ms statement: SELECT * FROM orders WHERE customer_id = 85044 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:36.443935-07:00 api-08 app[30733]: INFO request_id=eb0ac5826e1fe2fc method=GET path=/favicon.ico status=301 duration=7881ms 2026-10-09T13:19:36.894588-07:00 api-08 app[30286]: INFO order 24451 confirmed for zoë in 3107 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:19:36.929520-07:00 db-replica nginx[1205]: 91.174.210.10 - - "GET /static/main.css HTTP/1.1" 200 7279 "-" "python-requests/2.32.3" 2026-10-09T13:19:36.975660-07:00 web-01 app[30441]: INFO request_id=c967d27ce755923a method=GET path=/api/v2/orders status=502 duration=1381ms 2026-10-09T13:19:37.246686-07:00 web-03 sshd[24471]: Invalid user deploy from 172.125.83.152 port 30797 2026-10-09T13:19:37.392373-07:00 bastion app[30313]: INFO worker 35 finished job 10885e59379e1d09 in 5296 ms 2026-10-09T13:19:37.393091-07:00 db-primary postgres[30462]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 98371 remain, 1389 scanned (23% of total) 2026-10-09T13:19:37.457376-07:00 web-02 systemd[1]: Started Session 99512 of User deploy. 2026-10-09T13:19:37.724813-07:00 db-replica app[30964]: INFO request_id=5774897ddc325b79 method=GET path=/api/v2/orders/8841 status=404 duration=7039ms 2026-10-09T13:19:37.738802-07:00 db-primary sshd[44871]: Connection closed by 10.82.46.67 port 41809 [preauth] 2026-10-09T13:19:37.829680-07:00 db-replica app[30722]: INFO order 95471 confirmed for françois in 4920 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:19:38.086929-07:00 web-01 nginx[1200]: 10.157.96.37 - - "GET /static/main.css HTTP/1.1" 204 38544 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:38.220694-07:00 bastion haproxy[945]: 91.110.202.225:53187 [32884] http-in app/web-03 2144/0/193/193/2144 404 86065 - - ---- 352/352/67/67/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:19:38.314579-07:00 db-replica sshd[63731]: Invalid user françois from 172.175.252.1 port 3575 2026-10-09T13:19:38.407433-07:00 web-03 postgres[22213]: LOG: duration: 9637.418 ms statement: SELECT * FROM orders WHERE customer_id = 71173 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:38.507787-07:00 web-03 app[30459]: INFO request_id=412adaf91522cae6 method=GET path=/admin status=404 duration=2190ms 2026-10-09T13:19:39.106963-07:00 edge-fr-1 app[30615]: INFO order 54849 confirmed for müller in 2904 ms (region eu-west-1, queue orders) 2026-10-09T13:19:39.162692-07:00 api-08 app[30629]: INFO worker 76 finished job 0a64eadfe1b76a56 in 4531 ms 2026-10-09T13:19:39.205639-07:00 web-01 sshd[21626]: Accepted publickey for root from 172.252.222.109 port 12238 ssh2: ED25519 SHA256:519dc6a8802ba01e 2026-10-09T13:19:39.274273-07:00 bastion postgres[12963]: LOG: duration: 2658.823 ms statement: SELECT * FROM orders WHERE customer_id = 25522 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:39.441912-07:00 edge-fr-1 postgres[31690]: LOG: duration: 9588.482 ms statement: SELECT * FROM orders WHERE customer_id = 57751 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:39.448702-07:00 db-replica haproxy[931]: 45.70.192.247:29026 [89472] http-in app/bastion 8902/0/880/880/8902 404 14746 - - ---- 768/768/82/82/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:19:39.471941-07:00 db-replica app[30024]: INFO worker 73 picked job 1c90a650fd7ef0a9 from queue emails 2026-10-09T13:19:39.693303-07:00 web-03 systemd[1]: session-37500.scope: Deactivated successfully. 2026-10-09T13:19:39.701858-07:00 db-primary systemd[1]: Started Session 12381 of User akira. 2026-10-09T13:19:39.780423-07:00 web-01 postgres[4703]: LOG: duration: 2272.706 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:39.872715-07:00 edge-fr-1 nginx[1209]: 172.223.216.216 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 20065 "-" "Go-http-client/1.1" 2026-10-09T13:19:39.915339-07:00 api-08 app[30679]: WARN retrying upstream 45.223.20.160:3778 after timeout (5882 ms), attempt 1 of 3 2026-10-09T13:19:40.195254-07:00 api-07 app[30701]: INFO request_id=f54afeaa91714f59 method=GET path=/favicon.ico status=404 duration=2202ms 2026-10-09T13:19:40.504528-07:00 db-replica app[30322]: INFO worker 53 finished job 441aee106918abae in 1043 ms 2026-10-09T13:19:40.569280-07:00 web-01 app[30025]: INFO worker 77 picked job 2611bb11fcf16c90 from queue orders 2026-10-09T13:19:40.652342-07:00 web-01 sshd[15956]: Invalid user müller from 203.149.9.108 port 54218 2026-10-09T13:19:40.952209-07:00 api-08 sshd[64297]: Invalid user müller from 192.105.244.175 port 60673 2026-10-09T13:19:41.163830-07:00 web-03 postgres[12345]: LOG: duration: 9428.852 ms statement: SELECT * FROM orders WHERE customer_id = 93295 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:41.242810-07:00 bastion sshd[17847]: Connection closed by 172.80.187.101 port 18527 [preauth] 2026-10-09T13:19:41.574827-07:00 cache-3 sshd[50772]: Connection closed by 91.10.97.172 port 40492 [preauth] 2026-10-09T13:19:41.708202-07:00 api-07 app[30633]: INFO worker 84 picked job c42b31fb335e4ddb from queue invoices 2026-10-09T13:19:41.803065-07:00 db-replica sshd[13568]: Connection closed by 91.228.38.101 port 50281 [preauth] 2026-10-09T13:19:41.811306-07:00 edge-fr-1 nginx[1210]: 203.11.139.187 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 646 "-" "Go-http-client/1.1" 2026-10-09T13:19:42.061893-07:00 worker-12 sshd[51267]: pam_unix(sshd:session): session opened for user sørensen(uid=6539) by (uid=0) 2026-10-09T13:19:42.173928-07:00 worker-12 sshd[12539]: Failed password for invalid user root from 203.124.50.127 port 22904 ssh2 2026-10-09T13:19:42.235986-07:00 bastion sshd[29039]: pam_unix(sshd:session): session opened for user françois(uid=1467) by (uid=0) 2026-10-09T13:19:42.404078-07:00 api-07 app[30309]: INFO request_id=bdd54214f578b5cd method=GET path=/api/v2/orders/8841 status=500 duration=4831ms 2026-10-09T13:19:42.433568-07:00 db-replica sshd[15584]: Accepted publickey for françois from 172.167.150.105 port 30104 ssh2: ED25519 SHA256:1c3a329a5093ab53 2026-10-09T13:19:42.440214-07:00 edge-fr-1 postgres[8346]: LOG: duration: 7031.888 ms statement: SELECT * FROM orders WHERE customer_id = 71191 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:42.602275-07:00 web-01 sshd[30640]: pam_unix(sshd:session): session opened for user müller(uid=3990) by (uid=0) 2026-10-09T13:19:42.613652-07:00 web-01 postgres[29467]: LOG: duration: 1216.173 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:42.886860-07:00 cache-3 nginx[1204]: 91.162.152.16 - - "GET /login HTTP/1.1" 404 7145 "-" "curl/8.4.0" 2026-10-09T13:19:42.969092-07:00 db-primary nginx[1202]: 91.83.75.45 - - "GET /favicon.ico HTTP/1.1" 200 31556 "-" "kube-probe/1.31" 2026-10-09T13:19:43.007120-07:00 worker-12 postgres[21784]: LOG: duration: 8650.487 ms statement: SELECT * FROM orders WHERE customer_id = 42297 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:43.106558-07:00 cache-3 app[30451]: INFO request_id=9dea1877551910e9 method=GET path=/admin status=200 duration=3889ms 2026-10-09T13:19:43.179333-07:00 worker-12 app[30141]: INFO order 94529 confirmed for françois in 4173 ms (region us-east-1, queue webhooks) 2026-10-09T13:19:43.272854-07:00 web-02 app[30974]: WARN retrying upstream 203.147.0.55:14795 after timeout (2617 ms), attempt 3 of 3 2026-10-09T13:19:43.526984-07:00 cache-3 nginx[1207]: 192.113.248.225 - - "GET /.env HTTP/1.1" 401 44392 "-" "Go-http-client/1.1" 2026-10-09T13:19:43.561286-07:00 worker-12 sshd[57517]: Accepted publickey for ci from 192.159.164.244 port 48726 ssh2: ED25519 SHA256:d292fe52a5a1af10 2026-10-09T13:19:43.896189-07:00 cache-3 postgres[29476]: LOG: duration: 8353.373 ms statement: SELECT * FROM orders WHERE customer_id = 19498 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:43.904416-07:00 edge-fr-1 haproxy[936]: 192.110.202.191:38122 [96303] http-in app/edge-fr-1 1572/0/60/60/1572 204 39134 - - ---- 564/564/81/81/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:19:44.363624-07:00 api-08 nginx[1208]: 91.39.205.138 - - "GET /static/app.js HTTP/1.1" 502 42132 "-" "curl/8.4.0" 2026-10-09T13:19:44.610597-07:00 cache-3 haproxy[932]: 172.115.1.34:30021 [11261] http-in app/edge-fr-1 4863/0/432/432/4863 404 27911 - - ---- 233/233/21/21/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:19:44.743484-07:00 web-01 app[30972]: INFO order 62669 confirmed for zoë in 4759 ms (region eu-west-1, queue orders) 2026-10-09T13:19:44.820583-07:00 web-03 app[30450]: INFO request_id=657a4bed55eec8b1 method=GET path=/favicon.ico status=301 duration=7086ms 2026-10-09T13:19:44.875886-07:00 worker-12 app[30232]: INFO request_id=349f7554d0e301b4 method=GET path=/wp-login.php status=302 duration=9759ms 2026-10-09T13:19:44.879693-07:00 cache-3 cron[57007]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:19:44.934015-07:00 db-replica cron[23597]: (root) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:19:44.989444-07:00 web-01 app[30029]: INFO worker 73 finished job e7626ceec1b3621a in 682 ms 2026-10-09T13:19:45.150173-07:00 web-02 sshd[9370]: Connection closed by 172.91.39.138 port 37723 [preauth] 2026-10-09T13:19:45.276327-07:00 worker-12 nginx[1206]: 192.181.206.203 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 200 79071 "-" "python-requests/2.32.3" 2026-10-09T13:19:45.396396-07:00 web-02 haproxy[935]: 203.54.105.93:7578 [77280] http-in app/web-01 6061/0/851/851/6061 200 35729 - - ---- 103/103/75/75/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:19:45.616279-07:00 cache-3 postgres[6213]: LOG: duration: 1184.405 ms statement: SELECT * FROM orders WHERE customer_id = 78334 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:45.870289-07:00 web-03 postgres[20891]: LOG: duration: 8201.616 ms statement: SELECT * FROM orders WHERE customer_id = 84487 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:46.140775-07:00 edge-fr-1 app[30801]: INFO request_id=61792301986d0ac4 method=GET path=/api/v2/users status=204 duration=6949ms 2026-10-09T13:19:46.155545-07:00 db-primary postgres[31517]: LOG: duration: 9265.214 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:46.280015-07:00 cache-3 app[30297]: INFO request_id=75d5cbbc1fbf3d30 method=GET path=/favicon.ico status=301 duration=9976ms 2026-10-09T13:19:46.403879-07:00 edge-fr-1 nginx[1209]: 45.229.71.234 - - "GET /.env HTTP/1.1" 204 15097 "-" "Go-http-client/1.1" 2026-10-09T13:19:46.419030-07:00 bastion nginx[1210]: 203.127.204.230 - - "GET /health HTTP/1.1" 200 29385 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:46.476693-07:00 api-07 app[30309]: INFO health check ok: db 312 ms, cache 312 ms, queue depth 92 2026-10-09T13:19:46.575104-07:00 cache-3 sshd[2333]: Received disconnect from 172.180.20.69 port 49454:11: Bye Bye [preauth] 2026-10-09T13:19:46.589170-07:00 bastion nginx[1201]: 203.133.34.91 - - "GET /metrics HTTP/1.1" 500 23807 "-" "curl/8.4.0" 2026-10-09T13:19:46.696137-07:00 cache-3 nginx[1203]: 172.21.129.127 - - "GET /.env HTTP/1.1" 302 37690 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:46.903748-07:00 db-replica cron[53156]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:19:46.945466-07:00 web-03 nginx[1200]: 203.15.142.46 - - "GET /health HTTP/1.1" 404 30598 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:46.962027-07:00 cache-3 kernel: [15401.177188] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.113.67.155 DST=10.0.153.153 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=15401 DF PROTO=TCP SPT=26822 DPT=26822 WINDOW=15401 RES=0x00 SYN URGP=0 2026-10-09T13:19:47.178848-07:00 cache-3 app[30816]: INFO worker 72 finished job 174d959711bc48aa in 9241 ms 2026-10-09T13:19:47.185245-07:00 worker-12 app[30313]: INFO worker 34 finished job 5a651e78cb229647 in 881 ms 2026-10-09T13:19:47.241627-07:00 worker-12 kernel: [16337.868817] TCP: request_sock_TCP: Possible SYN flooding on port 60156. Sending cookies. Check SNMP counters. 2026-10-09T13:19:47.271158-07:00 worker-12 sshd[6675]: Invalid user ci from 203.237.14.137 port 33540 2026-10-09T13:19:47.489211-07:00 edge-fr-1 app[30229]: INFO order 11662 confirmed for zoë in 6822 ms (region eu-west-1, queue webhooks) 2026-10-09T13:19:48.245925-07:00 api-07 sshd[56150]: Invalid user deploy from 45.10.204.43 port 63406 2026-10-09T13:19:48.378410-07:00 web-01 haproxy[926]: 10.23.204.24:34150 [49477] http-in app/worker-12 1299/0/799/799/1299 302 70864 - - ---- 919/919/47/47/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:19:48.444617-07:00 cache-3 app[30831]: INFO worker 78 picked job 8268cda6f01bc960 from queue invoices 2026-10-09T13:19:48.467084-07:00 web-01 app[30867]: ERROR payment declined for order 59121: card_declined (code 43), customer notified 2026-10-09T13:19:48.475046-07:00 db-replica kernel: [87836.023864] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.133.115.7 DST=10.0.136.136 LEN=70 TOS=0x00 PREC=0x00 TTL=70 ID=87836 DF PROTO=TCP SPT=56055 DPT=56055 WINDOW=87836 RES=0x00 SYN URGP=0 2026-10-09T13:19:48.507229-07:00 api-07 kernel: [29538.195980] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.209.190.77 DST=10.0.481.481 LEN=90 TOS=0x00 PREC=0x00 TTL=90 ID=29538 DF PROTO=TCP SPT=57639 DPT=57639 WINDOW=29538 RES=0x00 SYN URGP=0 2026-10-09T13:19:48.510469-07:00 web-03 kernel: [51997.086242] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.131.246.137 DST=10.0.600.600 LEN=30 TOS=0x00 PREC=0x00 TTL=30 ID=51997 DF PROTO=TCP SPT=27967 DPT=27967 WINDOW=51997 RES=0x00 SYN URGP=0 2026-10-09T13:19:48.656093-07:00 db-replica app[30762]: INFO worker 31 finished job 59133c6a74897220 in 6147 ms 2026-10-09T13:19:48.825788-07:00 db-primary app[30618]: INFO request_id=4ff533fb795f6275 method=GET path=/admin status=200 duration=2608ms 2026-10-09T13:19:48.899398-07:00 db-primary nginx[1205]: 45.68.149.154 - akira "POST /static/app.js HTTP/1.1" 500 20233 "-" "Go-http-client/1.1" 2026-10-09T13:19:49.065724-07:00 worker-12 nginx[1208]: 172.28.247.204 - - "GET /static/main.css HTTP/1.1" 502 22682 "-" "curl/8.4.0" 2026-10-09T13:19:49.317525-07:00 web-01 app[30034]: INFO worker 76 finished job f534df508640ae7d in 655 ms 2026-10-09T13:19:49.390029-07:00 worker-12 haproxy[931]: 10.123.244.25:24607 [48660] http-in app/db-replica 9078/0/922/922/9078 500 23234 - - ---- 241/241/10/10/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:19:49.565077-07:00 worker-12 systemd[1]: Started Session 41522 of User françois. 2026-10-09T13:19:49.871484-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:19:49.871484-07:00" level=warning msg="Health check for container 9803b8dd320c2658 error: context deadline exceeded" 2026-10-09T13:19:49.873641-07:00 edge-fr-1 postgres[19805]: LOG: duration: 2455.409 ms statement: SELECT * FROM orders WHERE customer_id = 94959 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:49.923863-07:00 edge-fr-1 sshd[9204]: Accepted publickey for root from 172.217.209.95 port 31654 ssh2: ED25519 SHA256:cdffdcf99a8457a1 2026-10-09T13:19:50.013761-07:00 bastion app[30680]: INFO request_id=a172c905d909c95a method=GET path=/.env status=302 duration=1398ms 2026-10-09T13:19:50.352061-07:00 worker-12 kernel: [32159.849691] TCP: request_sock_TCP: Possible SYN flooding on port 37500. Sending cookies. Check SNMP counters. 2026-10-09T13:19:50.485161-07:00 db-primary app[30435]: INFO worker 27 picked job e204d3a078720424 from queue invoices 2026-10-09T13:19:50.755142-07:00 api-08 systemd[1]: Started Session 65960 of User backup. 2026-10-09T13:19:50.848050-07:00 cache-3 app[30599]: INFO order 68702 confirmed for backup in 318 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:19:50.875935-07:00 web-03 postgres[4552]: LOG: duration: 6864.168 ms statement: SELECT * FROM orders WHERE customer_id = 64493 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:51.394965-07:00 db-primary sshd[57920]: Connection closed by 203.122.203.178 port 53034 [preauth] 2026-10-09T13:19:51.486473-07:00 web-01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:19:51.724372-07:00 api-07 app[30306]: INFO order 15976 confirmed for ci in 4276 ms (region us-east-1, queue webhooks) 2026-10-09T13:19:51.844584-07:00 cache-3 app[30371]: INFO request_id=12c9c8c84ca8c5f4 method=GET path=/static/app.js status=200 duration=2693ms 2026-10-09T13:19:51.901600-07:00 web-02 app[30490]: INFO order 98967 confirmed for backup in 8549 ms (region eu-west-1, queue emails) 2026-10-09T13:19:52.035863-07:00 web-01 nginx[1204]: 172.197.228.152 - - "GET /static/app.js HTTP/1.1" 302 17163 "-" "kube-probe/1.31" 2026-10-09T13:19:52.067765-07:00 db-primary sshd[60524]: Accepted publickey for müller from 192.17.153.126 port 58882 ssh2: ED25519 SHA256:a82bbeff7edb9f5a 2026-10-09T13:19:52.273319-07:00 api-08 sshd[31608]: Invalid user sørensen from 192.168.206.142 port 41611 2026-10-09T13:19:52.563476-07:00 db-primary app[30552]: INFO request_id=6f6ff2debc2ae409 method=GET path=/static/app.js status=404 duration=9349ms 2026-10-09T13:19:52.629412-07:00 web-02 app[30317]: INFO worker 34 finished job 84463122f098e747 in 7725 ms 2026-10-09T13:19:52.712117-07:00 db-replica app[30233]: INFO order 99658 confirmed for deploy in 1249 ms (region us-east-1, queue invoices) 2026-10-09T13:19:52.748997-07:00 edge-fr-1 sshd[9147]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:19:52.893960-07:00 api-07 app[30856]: INFO worker 60 picked job 4493e428226d19f0 from queue invoices 2026-10-09T13:19:53.051311-07:00 db-replica app[30477]: INFO request_id=be13ebdd3fa308b6 method=GET path=/health status=200 duration=7209ms 2026-10-09T13:19:53.059925-07:00 db-primary sshd[7793]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:19:53.124365-07:00 bastion nginx[1205]: 172.146.75.210 - - "GET /.env HTTP/1.1" 204 81051 "-" "python-requests/2.32.3" 2026-10-09T13:19:53.125082-07:00 cache-3 nginx[1202]: 172.34.191.37 - zoë "POST /login HTTP/1.1" 200 39149 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:19:53.390558-07:00 api-07 app[30337]: INFO health check ok: db 136 ms, cache 136 ms, queue depth 33 2026-10-09T13:19:53.397600-07:00 web-01 app[30144]: INFO request_id=17dd6eb091494628 method=GET path=/login status=200 duration=7005ms 2026-10-09T13:19:53.703621-07:00 db-replica app[30284]: INFO worker 79 picked job 5178ecbd093997f9 from queue webhooks 2026-10-09T13:19:53.826390-07:00 db-primary app[30195]: INFO order 80745 confirmed for zoë in 4970 ms (region us-east-1, queue emails) 2026-10-09T13:19:54.379959-07:00 worker-12 cron[25847]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:19:54.396019-07:00 db-replica postgres[20459]: LOG: duration: 8744.163 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:54.485513-07:00 api-07 nginx[1203]: 45.46.50.65 - françois "POST /static/main.css HTTP/1.1" 200 43392 "-" "Go-http-client/1.1" 2026-10-09T13:19:54.637963-07:00 web-01 app[30209]: INFO request_id=e7ffaacae7a3524b method=GET path=/admin status=204 duration=3906ms 2026-10-09T13:19:54.668165-07:00 edge-fr-1 nginx[1210]: 10.19.178.13 - - "GET /static/main.css HTTP/1.1" 502 87167 "-" "Go-http-client/1.1" 2026-10-09T13:19:54.781415-07:00 edge-fr-1 systemd[1]: session-91665.scope: Deactivated successfully. 2026-10-09T13:19:54.822157-07:00 cache-3 haproxy[929]: Server app/db-primary is DOWN, reason: Layer4 timeout, check duration: 5138ms. 93 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:19:54.864341-07:00 db-replica app[30558]: INFO worker 65 finished job 9a37fce4e21ab63f in 4430 ms 2026-10-09T13:19:55.147197-07:00 api-08 sshd[14538]: Accepted publickey for priya from 91.24.193.217 port 20102 ssh2: ED25519 SHA256:2618dcc10b610e6b 2026-10-09T13:19:55.547903-07:00 web-01 app[30919]: INFO worker 49 finished job bdaf3de6a28fca26 in 3759 ms 2026-10-09T13:19:55.851379-07:00 bastion app[30525]: INFO order 26202 confirmed for akira in 642 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:19:56.090995-07:00 db-replica haproxy[917]: 10.152.96.36:45227 [44581] http-in app/api-07 8316/0/643/643/8316 301 51670 - - ---- 787/787/49/49/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:19:56.142561-07:00 db-replica haproxy[901]: 172.41.192.120:35387 [73057] http-in app/db-primary 5372/0/164/164/5372 404 60586 - - ---- 466/466/19/19/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:19:56.268924-07:00 api-08 nginx[1210]: 172.27.36.72 - - "GET /api/v2/orders HTTP/1.1" 404 78980 "-" "Go-http-client/1.1" 2026-10-09T13:19:56.297765-07:00 web-03 app[30153]: INFO order 28264 confirmed for root in 107 ms (region us-east-1, queue orders) 2026-10-09T13:19:56.327157-07:00 db-replica app[30710]: INFO request_id=5801d5008f35f155 method=GET path=/favicon.ico status=200 duration=234ms 2026-10-09T13:19:56.357066-07:00 web-02 app[30582]: INFO health check ok: db 547 ms, cache 547 ms, queue depth 66 2026-10-09T13:19:56.710758-07:00 edge-fr-1 app[30234]: INFO health check ok: db 456 ms, cache 456 ms, queue depth 29 2026-10-09T13:19:56.937212-07:00 web-03 haproxy[948]: 192.9.142.39:4098 [78361] http-in app/worker-12 5477/0/354/354/5477 200 64061 - - ---- 407/407/78/78/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:19:57.052467-07:00 api-08 app[30720]: INFO worker 16 finished job ed658a86f56aff69 in 2173 ms 2026-10-09T13:19:57.058298-07:00 web-03 nginx[1204]: 45.73.202.254 - - "GET /admin HTTP/1.1" 502 67120 "-" "kube-probe/1.31" 2026-10-09T13:19:57.157944-07:00 db-replica app[30718]: INFO worker 59 picked job 732bebe3b3ba2e64 from queue webhooks 2026-10-09T13:19:57.167879-07:00 web-01 postgres[21492]: LOG: duration: 2208.279 ms statement: SELECT * FROM orders WHERE customer_id = 36880 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:19:57.269021-07:00 web-03 nginx[1200]: 10.209.115.47 - backup "POST /static/app.js HTTP/1.1" 200 55552 "-" "python-requests/2.32.3" 2026-10-09T13:19:57.356798-07:00 edge-fr-1 sshd[34275]: Invalid user zoë from 45.20.90.82 port 27351 2026-10-09T13:19:57.406145-07:00 bastion nginx[1202]: 91.155.200.63 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 61402 "-" "curl/8.4.0" 2026-10-09T13:19:58.058764-07:00 web-01 app[30620]: WARN retrying upstream 172.124.87.123:4153 after timeout (4252 ms), attempt 2 of 3 2026-10-09T13:19:58.087938-07:00 db-replica sshd[32688]: pam_unix(sshd:session): session opened for user ci(uid=3518) by (uid=0) 2026-10-09T13:19:58.138033-07:00 web-02 nginx[1208]: 10.187.212.157 - - "GET /wp-login.php HTTP/1.1" 404 48616 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:58.178690-07:00 cache-3 nginx[1208]: 203.74.236.181 - - "GET /api/v2/orders HTTP/1.1" 500 77975 "-" "python-requests/2.32.3" 2026-10-09T13:19:58.194103-07:00 db-primary nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.69.124.87, server: app.example.com, request: "GET /api/v2/orders/8841 HTTP/1.1", upstream: "http://10.0.424.424:8080/api/v2/orders/8841" 2026-10-09T13:19:58.237166-07:00 edge-fr-1 systemd[1]: session-62843.scope: Deactivated successfully. 2026-10-09T13:19:58.266917-07:00 edge-fr-1 app[30022]: INFO order 75448 confirmed for ci in 7674 ms (region us-east-1, queue invoices) 2026-10-09T13:19:58.463776-07:00 api-07 haproxy[941]: 45.39.238.79:20193 [41372] http-in app/api-07 7667/0/522/522/7667 200 87115 - - ---- 520/520/16/16/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:19:58.486517-07:00 api-08 app[30231]: INFO health check ok: db 281 ms, cache 281 ms, queue depth 49 2026-10-09T13:19:58.560796-07:00 api-07 nginx[1204]: 172.63.123.103 - ci "POST /static/main.css HTTP/1.1" 301 14666 "-" "curl/8.4.0" 2026-10-09T13:19:58.709950-07:00 api-07 app[30084]: INFO health check ok: db 640 ms, cache 640 ms, queue depth 17 2026-10-09T13:19:58.873196-07:00 web-03 nginx[1209]: 91.234.195.151 - - "GET /admin HTTP/1.1" 404 51136 "-" "python-requests/2.32.3" 2026-10-09T13:19:58.920003-07:00 db-primary nginx[1202]: 203.62.47.132 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 81277 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:19:59.235804-07:00 api-07 haproxy[933]: 45.74.226.14:54963 [59392] http-in app/api-08 8212/0/594/594/8212 301 59574 - - ---- 611/611/93/93/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:19:59.339685-07:00 cache-3 sshd[34108]: pam_unix(sshd:session): session opened for user françois(uid=2291) by (uid=0) 2026-10-09T13:19:59.538860-07:00 api-07 postgres[15276]: LOG: duration: 5983.764 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:19:59.572779-07:00 bastion nginx[1209]: 10.37.60.70 - - "GET /wp-login.php HTTP/1.1" 200 4963 "-" "kube-probe/1.31" 2026-10-09T13:19:59.717034-07:00 db-primary sshd[10517]: Received disconnect from 203.216.84.135 port 1603:11: Bye Bye [preauth] 2026-10-09T13:20:00.009109-07:00 db-primary app[30036]: INFO order 45080 confirmed for deploy in 5794 ms (region eu-west-1, queue orders) 2026-10-09T13:20:00.199463-07:00 edge-fr-1 postgres[30790]: LOG: duration: 6182.175 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:00.246891-07:00 edge-fr-1 sshd[1068]: Failed password for invalid user root from 203.149.156.161 port 48722 ssh2 2026-10-09T13:20:00.254527-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577200.257:40252): pid=40252 uid=0 auid=7538 ses=920 msg='op=login id=7538 exe="/usr/sbin/sshd" hostname=? addr=192.250.3.5 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:00.577964-07:00 web-03 sshd[8369]: pam_unix(sshd:session): session opened for user zoë(uid=6863) by (uid=0) 2026-10-09T13:20:00.738316-07:00 db-primary app[30799]: INFO worker 69 picked job 24960d0aea713145 from queue orders 2026-10-09T13:20:00.845897-07:00 api-08 app[30340]: DEBUG cache hit ratio 24% over the last minute (35032 lookups) 2026-10-09T13:20:00.864586-07:00 edge-fr-1 app[30078]: INFO request_id=53012a90d7f8bd52 method=GET path=/static/main.css status=404 duration=2143ms 2026-10-09T13:20:00.951553-07:00 db-primary postgres[22847]: LOG: duration: 2248.352 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:01.184055-07:00 cache-3 nginx[1209]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.188.118.115, server: app.example.com, request: "GET /api/v2/orders HTTP/1.1", upstream: "http://10.0.882.882:8080/api/v2/orders" 2026-10-09T13:20:01.250256-07:00 api-08 nginx[1202]: 192.130.201.147 - - "GET /static/app.js HTTP/1.1" 200 8080 "-" "Go-http-client/1.1" 2026-10-09T13:20:01.413807-07:00 web-01 systemd[1]: Started Session 12397 of User deploy. 2026-10-09T13:20:01.794281-07:00 worker-12 nginx[1207]: 172.229.214.66 - - "GET /metrics HTTP/1.1" 401 8965 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:01.901591-07:00 web-02 postgres[29416]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 84320 remain, 8267 scanned (38% of total) 2026-10-09T13:20:02.172991-07:00 db-primary nginx[1207]: 45.248.42.161 - priya "POST /health HTTP/1.1" 401 28161 "-" "kube-probe/1.31" 2026-10-09T13:20:02.347526-07:00 worker-12 app[30062]: INFO request_id=663369079dd542f2 method=GET path=/static/main.css status=502 duration=7830ms 2026-10-09T13:20:02.399641-07:00 db-replica app[30233]: INFO worker 50 picked job 4db8c9fbb1c02dd2 from queue invoices 2026-10-09T13:20:02.607058-07:00 cache-3 nginx[1206]: 192.35.70.26 - - "GET /static/app.js HTTP/1.1" 200 22242 "-" "python-requests/2.32.3" 2026-10-09T13:20:02.652249-07:00 bastion postgres[12643]: LOG: checkpoint complete: wrote 9384 buffers (1%); 0 WAL file(s) added, 0 removed, 10 recycled; write=1415.924 s, sync=0.924 s, total=1415.924 s 2026-10-09T13:20:02.723235-07:00 worker-12 app[30604]: INFO worker 55 picked job 5afdd998b50c9300 from queue invoices 2026-10-09T13:20:02.775222-07:00 edge-fr-1 nginx[1205]: 192.3.44.34 - - "GET /admin HTTP/1.1" 401 24023 "-" "kube-probe/1.31" 2026-10-09T13:20:02.788312-07:00 db-replica systemd[1]: session-27199.scope: Deactivated successfully. 2026-10-09T13:20:02.900713-07:00 db-replica nginx[1202]: 10.232.45.94 - françois "POST /health HTTP/1.1" 404 30551 "-" "python-requests/2.32.3" 2026-10-09T13:20:03.139023-07:00 db-primary sshd[31605]: pam_unix(sshd:session): session opened for user backup(uid=5570) by (uid=0) 2026-10-09T13:20:03.356092-07:00 edge-fr-1 sshd[19298]: Invalid user akira from 45.83.103.234 port 1230 2026-10-09T13:20:03.650011-07:00 api-08 app[30848]: INFO order 22573 confirmed for zoë in 1274 ms (region eu-west-1, queue webhooks) 2026-10-09T13:20:03.905763-07:00 web-02 kubelet[800]: E1009 13:20:03.649424 4293 pod_workers.go:4293] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-146814b4ee246662" 2026-10-09T13:20:03.915171-07:00 db-replica haproxy[935]: 192.187.119.248:29274 [48542] http-in app/worker-12 553/0/131/131/553 404 37975 - - ---- 487/487/14/14/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:04.231132-07:00 edge-fr-1 app[30200]: INFO request_id=d2b52118838dd71c method=GET path=/favicon.ico status=204 duration=578ms 2026-10-09T13:20:04.262455-07:00 db-replica haproxy[921]: 192.43.122.200:41211 [78791] http-in app/api-08 2927/0/638/638/2927 500 55507 - - ---- 184/184/94/94/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:20:04.327743-07:00 worker-12 haproxy[938]: 91.28.107.208:48015 [35929] http-in app/cache-3 5/0/452/452/5 204 47503 - - ---- 240/240/51/51/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:20:04.362374-07:00 edge-fr-1 app[30346]: INFO request_id=5d3a481ed3403d14 method=GET path=/api/v2/orders/8841 status=302 duration=6002ms 2026-10-09T13:20:04.529749-07:00 web-03 haproxy[921]: 10.230.205.138:33683 [32190] http-in app/api-07 3006/0/980/980/3006 204 7204 - - ---- 884/884/25/25/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:20:04.969564-07:00 worker-12 dockerd[700]: time="2026-10-09T13:20:04.969564-07:00" level=info msg="Container 9d4bd194e0e56ce7 exited with code 0" 2026-10-09T13:20:05.002464-07:00 edge-fr-1 app[30497]: INFO worker 69 finished job a2a62395351ef10d in 8084 ms 2026-10-09T13:20:05.163105-07:00 db-primary app[30720]: INFO request_id=a058fc4c9adc37ec method=GET path=/api/v2/search?q=invoice status=200 duration=9376ms 2026-10-09T13:20:05.408303-07:00 bastion haproxy[921]: 91.108.253.127:51743 [52550] http-in app/edge-fr-1 1306/0/37/37/1306 502 64653 - - ---- 104/104/61/61/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:20:05.494398-07:00 api-07 app[30391]: INFO order 44891 confirmed for root in 6498 ms (region us-east-1, queue webhooks) 2026-10-09T13:20:05.632257-07:00 db-replica app[30322]: INFO order 11478 confirmed for akira in 8196 ms (region eu-west-1, queue emails) 2026-10-09T13:20:05.722152-07:00 web-03 sshd[25047]: Accepted publickey for françois from 45.155.196.37 port 22358 ssh2: ED25519 SHA256:0f54b158800ce9f4 2026-10-09T13:20:05.995046-07:00 api-07 sshd[64125]: pam_unix(sshd:session): session opened for user deploy(uid=9159) by (uid=0) 2026-10-09T13:20:06.101770-07:00 bastion nginx[1206]: 172.28.231.86 - - "GET /admin HTTP/1.1" 302 37659 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:06.238581-07:00 cache-3 app[30267]: INFO order 15999 confirmed for françois in 5666 ms (region us-east-1, queue emails) 2026-10-09T13:20:06.292942-07:00 web-02 haproxy[948]: 203.72.53.231:28579 [75423] http-in app/web-03 7122/0/445/445/7122 301 30092 - - ---- 205/205/47/47/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:20:06.303349-07:00 web-01 app[30515]: WARN slow query (6489 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '72 minutes' 2026-10-09T13:20:06.447599-07:00 web-03 app[30121]: INFO request_id=952cc1da126ae1f0 method=GET path=/.env status=200 duration=7432ms 2026-10-09T13:20:06.617202-07:00 web-03 sshd[52567]: Invalid user müller from 91.59.26.254 port 21242 2026-10-09T13:20:06.621341-07:00 bastion nginx[1208]: 45.174.192.175 - deploy "POST /admin HTTP/1.1" 302 49930 "-" "kube-probe/1.31" 2026-10-09T13:20:06.682091-07:00 edge-fr-1 app[30179]: INFO worker 67 finished job ecd90a4e58cf68d3 in 9212 ms 2026-10-09T13:20:06.830803-07:00 db-primary nginx[1208]: 172.38.164.207 - - "GET /static/app.js HTTP/1.1" 200 3225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:06.907908-07:00 edge-fr-1 app[30375]: INFO order 35851 confirmed for müller in 3527 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:20:06.927025-07:00 db-replica postgres[17821]: LOG: duration: 8989.500 ms statement: SELECT * FROM orders WHERE customer_id = 30519 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:07.071334-07:00 web-01 app[30754]: INFO request_id=08eacd73f14887d2 method=GET path=/.env status=401 duration=4290ms 2026-10-09T13:20:07.112943-07:00 api-07 app[30667]: INFO order 34460 confirmed for ci in 3887 ms (region eu-west-1, queue emails) 2026-10-09T13:20:07.312709-07:00 bastion app[30228]: INFO worker 98 finished job 5f10be4c9328f6f0 in 4989 ms 2026-10-09T13:20:07.345449-07:00 api-08 sshd[50041]: pam_unix(sshd:session): session opened for user akira(uid=9027) by (uid=0) 2026-10-09T13:20:07.354888-07:00 web-02 cron[29175]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:20:07.485995-07:00 api-08 app[30219]: INFO request_id=05dc427566a7964d method=GET path=/metrics status=404 duration=6973ms 2026-10-09T13:20:07.590614-07:00 api-07 nginx[1204]: 203.176.52.223 - - "GET /admin HTTP/1.1" 301 15329 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:07.604851-07:00 db-replica app[30396]: INFO request_id=96117a9e4614277b method=GET path=/api/v2/users status=302 duration=5507ms 2026-10-09T13:20:07.796446-07:00 cache-3 haproxy[903]: 203.228.196.148:33487 [44295] http-in app/edge-fr-1 4467/0/767/767/4467 502 65402 - - ---- 692/692/64/64/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:20:07.861129-07:00 db-replica postgres[13916]: LOG: duration: 4900.835 ms statement: SELECT * FROM orders WHERE customer_id = 97505 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:08.086941-07:00 db-replica app[30491]: WARN slow query (7743 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '74 minutes' 2026-10-09T13:20:08.149950-07:00 web-02 app[30250]: DEBUG cache hit ratio 97% over the last minute (31774 lookups) 2026-10-09T13:20:08.283806-07:00 bastion cron[12802]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:20:08.325671-07:00 db-replica app[30065]: INFO request_id=864c6d67fa2713e9 method=GET path=/login status=401 duration=9966ms 2026-10-09T13:20:08.480884-07:00 api-07 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:20:08.907357-07:00 db-primary haproxy[925]: 91.117.243.198:57599 [24441] http-in app/bastion 8672/0/743/743/8672 500 79004 - - ---- 669/669/94/94/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:20:09.541965-07:00 web-02 nginx[1202]: 10.96.38.67 - - "GET /.env HTTP/1.1" 401 85376 "-" "python-requests/2.32.3" 2026-10-09T13:20:09.564926-07:00 web-01 app[30411]: INFO health check ok: db 13 ms, cache 13 ms, queue depth 42 2026-10-09T13:20:09.872749-07:00 worker-12 sshd[17603]: pam_unix(sshd:session): session opened for user müller(uid=5567) by (uid=0) 2026-10-09T13:20:10.084374-07:00 web-03 nginx[1202]: 10.192.147.144 - - "GET /static/app.js HTTP/1.1" 404 80859 "-" "python-requests/2.32.3" 2026-10-09T13:20:10.428519-07:00 api-07 sshd[3451]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:20:10.460459-07:00 edge-fr-1 sshd[39237]: Connection closed by 192.154.222.30 port 43948 [preauth] 2026-10-09T13:20:10.578040-07:00 db-primary nginx[1209]: 45.156.209.133 - - "GET /admin HTTP/1.1" 200 50869 "-" "kube-probe/1.31" 2026-10-09T13:20:10.622666-07:00 db-primary app[30215]: INFO order 99797 confirmed for françois in 6264 ms (region us-east-1, queue webhooks) 2026-10-09T13:20:10.654247-07:00 web-03 app[30651]: INFO worker 77 picked job 2a751c88a0c97ac3 from queue webhooks 2026-10-09T13:20:10.687077-07:00 bastion app[30082]: INFO health check ok: db 454 ms, cache 454 ms, queue depth 39 2026-10-09T13:20:10.739494-07:00 web-02 app[30342]: INFO health check ok: db 172 ms, cache 172 ms, queue depth 37 2026-10-09T13:20:10.813209-07:00 web-02 kernel: [50445.097590] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.193.138.227 DST=10.0.393.393 LEN=44 TOS=0x00 PREC=0x00 TTL=44 ID=50445 DF PROTO=TCP SPT=42012 DPT=42012 WINDOW=50445 RES=0x00 SYN URGP=0 2026-10-09T13:20:10.844430-07:00 web-02 app[30370]: INFO request_id=ff79ed7299c249a2 method=GET path=/static/main.css status=200 duration=6624ms 2026-10-09T13:20:10.995189-07:00 api-08 kubelet[800]: I1009 13:20:10.193548 1644 kubelet.go:1644] "Pod is terminating, skipping pod status update" pod="default/api-76d9fb3ae6031071" 2026-10-09T13:20:11.075216-07:00 api-07 haproxy[901]: 172.176.58.9:59586 [47116] http-in app/web-03 7874/0/69/69/7874 200 57245 - - ---- 131/131/66/66/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:20:11.304390-07:00 api-08 nginx[1204]: 10.27.73.214 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 24078 "-" "kube-probe/1.31" 2026-10-09T13:20:11.445674-07:00 db-replica nginx[1208]: 203.199.120.1 - müller "POST /.env HTTP/1.1" 204 1826 "-" "Go-http-client/1.1" 2026-10-09T13:20:11.530939-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:20:11.530939-07:00" level=warning msg="Health check for container 077c94c4f93e44bc error: context deadline exceeded" 2026-10-09T13:20:11.767979-07:00 bastion postgres[8832]: LOG: duration: 3347.532 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:11.995460-07:00 web-01 app[30951]: INFO request_id=0797ead36932dc6e method=GET path=/metrics status=302 duration=6070ms 2026-10-09T13:20:12.417310-07:00 api-07 app[30200]: INFO health check ok: db 233 ms, cache 233 ms, queue depth 55 2026-10-09T13:20:12.477867-07:00 cache-3 app[30540]: INFO order 53516 confirmed for root in 915 ms (region us-east-1, queue invoices) 2026-10-09T13:20:12.561327-07:00 edge-fr-1 app[30663]: INFO health check ok: db 551 ms, cache 551 ms, queue depth 74 2026-10-09T13:20:12.956064-07:00 web-03 app[30550]: INFO worker 44 finished job 06d79df27e95576e in 3728 ms 2026-10-09T13:20:13.023195-07:00 edge-fr-1 sshd[29520]: pam_unix(sshd:session): session opened for user zoë(uid=2525) by (uid=0) 2026-10-09T13:20:13.079265-07:00 web-03 nginx[1204]: 203.40.224.9 - - "GET /api/v2/orders HTTP/1.1" 401 39810 "-" "python-requests/2.32.3" 2026-10-09T13:20:13.569391-07:00 worker-12 app[30151]: INFO request_id=75973d9ab549971a method=GET path=/api/v2/search?q=invoice status=204 duration=2204ms 2026-10-09T13:20:14.002947-07:00 db-primary app[30591]: DEBUG cache hit ratio 25% over the last minute (69474 lookups) 2026-10-09T13:20:14.004115-07:00 bastion nginx[1205]: 45.57.67.93 - - "GET /health HTTP/1.1" 404 11750 "-" "python-requests/2.32.3" 2026-10-09T13:20:14.099189-07:00 bastion app[30521]: INFO order 53741 confirmed for sørensen in 4112 ms (region us-east-1, queue emails) 2026-10-09T13:20:14.166855-07:00 web-01 nginx[1207]: 91.97.124.40 - - "GET /favicon.ico HTTP/1.1" 401 77992 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:14.211096-07:00 api-07 nginx[1209]: 203.137.131.10 - - "GET /api/v2/users HTTP/1.1" 204 42962 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:14.256325-07:00 api-08 kernel: [41539.121415] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.216.83.25 DST=10.0.214.214 LEN=22 TOS=0x00 PREC=0x00 TTL=22 ID=41539 DF PROTO=TCP SPT=35326 DPT=35326 WINDOW=41539 RES=0x00 SYN URGP=0 2026-10-09T13:20:14.472242-07:00 worker-12 nginx[1201]: 45.166.132.115 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 16094 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:14.549889-07:00 db-primary app[30793]: INFO worker 48 finished job d30b05c6eba9e53f in 3167 ms 2026-10-09T13:20:14.552774-07:00 db-replica nginx[1207]: 172.234.37.227 - - "GET /.env HTTP/1.1" 301 72671 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:14.648523-07:00 web-03 app[30239]: INFO worker 62 picked job 44853ebcbac61f92 from queue invoices 2026-10-09T13:20:14.736115-07:00 db-replica app[30497]: INFO request_id=1481521eaa0b1725 method=GET path=/metrics status=200 duration=2606ms 2026-10-09T13:20:14.903550-07:00 bastion app[30499]: INFO worker 11 finished job 83aea18f00f8f366 in 4730 ms 2026-10-09T13:20:14.922162-07:00 api-07 nginx[1203]: 192.113.21.175 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 38082 "-" "curl/8.4.0" 2026-10-09T13:20:15.286464-07:00 bastion app[30772]: INFO request_id=55e116a8e10cc737 method=GET path=/favicon.ico status=204 duration=5245ms 2026-10-09T13:20:15.537604-07:00 worker-12 kernel: [22215.212045] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.134.132.99 DST=10.0.362.362 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=22215 DF PROTO=TCP SPT=58842 DPT=58842 WINDOW=22215 RES=0x00 SYN URGP=0 2026-10-09T13:20:15.579540-07:00 web-03 haproxy[932]: 172.86.155.253:30682 [16788] http-in app/bastion 5380/0/219/219/5380 200 30006 - - ---- 187/187/30/30/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:20:15.926570-07:00 cache-3 haproxy[936]: 10.238.45.242:7369 [50450] http-in app/db-primary 7822/0/31/31/7822 200 10152 - - ---- 821/821/89/89/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:20:16.078478-07:00 web-01 app[30534]: INFO worker 45 picked job 3eaa497e5dc91554 from queue invoices 2026-10-09T13:20:16.162575-07:00 worker-12 app[30436]: INFO request_id=a6395fc448304a10 method=GET path=/metrics status=404 duration=2381ms 2026-10-09T13:20:16.172756-07:00 db-replica app[30732]: INFO order 69128 confirmed for deploy in 4770 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:20:16.176025-07:00 web-03 nginx[1203]: 10.30.158.181 - backup "POST /static/app.js HTTP/1.1" 404 69125 "-" "python-requests/2.32.3" 2026-10-09T13:20:16.554013-07:00 db-primary dockerd[700]: time="2026-10-09T13:20:16.554013-07:00" level=info msg="Container 1b2ad33e31bf78ba exited with code 0" 2026-10-09T13:20:16.650570-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577216.334:84137): pid=84137 uid=0 auid=4323 ses=245 msg='op=login id=4323 exe="/usr/sbin/sshd" hostname=? addr=192.79.55.58 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:16.672850-07:00 cache-3 kernel: [10666.043205] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.233.10.162 DST=10.0.389.389 LEN=82 TOS=0x00 PREC=0x00 TTL=82 ID=10666 DF PROTO=TCP SPT=49779 DPT=49779 WINDOW=10666 RES=0x00 SYN URGP=0 2026-10-09T13:20:16.797158-07:00 worker-12 app[30042]: INFO worker 94 finished job bce40e592c24a149 in 8745 ms 2026-10-09T13:20:16.914185-07:00 api-08 app[30868]: INFO worker 68 finished job a499ea1870ef4221 in 4303 ms 2026-10-09T13:20:17.065285-07:00 edge-fr-1 postgres[12577]: LOG: duration: 4999.359 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:17.093381-07:00 api-08 nginx[1204]: 45.131.215.254 - zoë "POST /static/app.js HTTP/1.1" 200 17121 "-" "Go-http-client/1.1" 2026-10-09T13:20:17.263599-07:00 api-08 app[30621]: INFO order 10691 confirmed for deploy in 6078 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:20:17.369934-07:00 db-replica sshd[24580]: Accepted publickey for müller from 91.97.197.198 port 37761 ssh2: ED25519 SHA256:f8d9166ed8b714ed 2026-10-09T13:20:17.384241-07:00 db-replica kernel: [89616.624707] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.33.137.188 DST=10.0.751.751 LEN=22 TOS=0x00 PREC=0x00 TTL=22 ID=89616 DF PROTO=TCP SPT=23671 DPT=23671 WINDOW=89616 RES=0x00 SYN URGP=0 2026-10-09T13:20:17.427790-07:00 edge-fr-1 app[30403]: INFO worker 61 finished job a11d1240b5b8a4e1 in 4831 ms 2026-10-09T13:20:17.492552-07:00 web-02 haproxy[913]: 192.244.149.39:36418 [96670] http-in app/db-primary 8162/0/962/962/8162 401 58698 - - ---- 241/241/50/50/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:17.647665-07:00 bastion nginx[1200]: 45.110.239.191 - zoë "POST /login HTTP/1.1" 500 5011 "-" "curl/8.4.0" 2026-10-09T13:20:17.669711-07:00 db-replica nginx[1203]: 10.229.101.67 - root "POST /api/v2/search?q=invoice HTTP/1.1" 301 9462 "-" "Go-http-client/1.1" 2026-10-09T13:20:17.674178-07:00 edge-fr-1 sshd[7835]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:20:17.923329-07:00 bastion systemd[1]: session-40929.scope: Deactivated successfully. 2026-10-09T13:20:18.049555-07:00 web-03 systemd[1]: Started Session 71642 of User priya. 2026-10-09T13:20:18.372008-07:00 edge-fr-1 nginx[1208]: 192.44.3.41 - zoë "POST /wp-login.php HTTP/1.1" 200 5336 "-" "curl/8.4.0" 2026-10-09T13:20:18.408375-07:00 worker-12 sshd[33414]: Accepted publickey for müller from 45.187.206.221 port 1378 ssh2: ED25519 SHA256:92f227976908ba96 2026-10-09T13:20:18.698176-07:00 api-08 haproxy[914]: 45.121.111.123:12766 [49177] http-in app/bastion 2159/0/36/36/2159 200 66163 - - ---- 731/731/27/27/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:20:18.763206-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577218.342:71716): pid=71716 uid=0 auid=9818 ses=323 msg='op=login id=9818 exe="/usr/sbin/sshd" hostname=? addr=10.235.212.98 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:19.040741-07:00 cache-3 nginx[1204]: 91.148.88.20 - - "GET /.env HTTP/1.1" 301 87570 "-" "Go-http-client/1.1" 2026-10-09T13:20:19.057445-07:00 web-02 app[30885]: INFO request_id=3eebea98326f41b7 method=GET path=/static/main.css status=401 duration=8573ms 2026-10-09T13:20:19.448713-07:00 web-02 nginx[1206]: 172.6.119.169 - - "GET /metrics HTTP/1.1" 500 63124 "-" "Go-http-client/1.1" 2026-10-09T13:20:19.528524-07:00 web-01 app[30897]: INFO request_id=cb087f1a6b39477a method=GET path=/admin status=500 duration=3488ms 2026-10-09T13:20:19.675213-07:00 bastion sshd[43970]: Failed password for invalid user zoë from 203.102.6.124 port 34538 ssh2 2026-10-09T13:20:19.746059-07:00 db-replica nginx[1207]: 172.85.223.52 - - "GET /wp-login.php HTTP/1.1" 401 42380 "-" "Go-http-client/1.1" 2026-10-09T13:20:19.850301-07:00 web-03 app[30225]: INFO worker 55 picked job 0369711b382c014d from queue invoices 2026-10-09T13:20:19.894138-07:00 api-08 haproxy[907]: 192.211.66.234:23346 [88360] http-in app/api-08 1973/0/944/944/1973 404 31329 - - ---- 259/259/42/42/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:20:20.176246-07:00 worker-12 app[30535]: INFO health check ok: db 654 ms, cache 654 ms, queue depth 95 2026-10-09T13:20:20.394416-07:00 db-replica sshd[20232]: Received disconnect from 192.157.229.104 port 15239:11: Bye Bye [preauth] 2026-10-09T13:20:20.451294-07:00 web-02 app[30194]: DEBUG cache hit ratio 80% over the last minute (63926 lookups) 2026-10-09T13:20:20.528617-07:00 edge-fr-1 app[30888]: INFO order 19790 confirmed for root in 8743 ms (region eu-west-1, queue webhooks) 2026-10-09T13:20:20.696210-07:00 db-replica app[30498]: INFO health check ok: db 742 ms, cache 742 ms, queue depth 54 2026-10-09T13:20:20.747180-07:00 web-03 app[30173]: INFO request_id=969c339dd9cc9149 method=GET path=/wp-login.php status=200 duration=4999ms 2026-10-09T13:20:20.841006-07:00 web-03 app[30732]: INFO request_id=37ae2cf66b5654b8 method=GET path=/static/main.css status=401 duration=3865ms 2026-10-09T13:20:20.861349-07:00 cache-3 nginx[1204]: 172.97.85.12 - - "GET /admin HTTP/1.1" 200 77938 "-" "Go-http-client/1.1" 2026-10-09T13:20:21.004750-07:00 worker-12 nginx[1208]: 45.195.90.160 - - "GET /health HTTP/1.1" 200 911 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:21.033540-07:00 worker-12 sshd[29174]: Connection closed by 91.187.80.200 port 49484 [preauth] 2026-10-09T13:20:21.285283-07:00 worker-12 app[30407]: INFO worker 97 finished job b711aac520378783 in 8203 ms 2026-10-09T13:20:21.337248-07:00 worker-12 nginx[1210]: 203.61.189.109 - - "GET /metrics HTTP/1.1" 404 31333 "-" "kube-probe/1.31" 2026-10-09T13:20:21.444412-07:00 api-07 kernel: [98283.743286] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.250.249.168 DST=10.0.733.733 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=98283 DF PROTO=TCP SPT=54767 DPT=54767 WINDOW=98283 RES=0x00 SYN URGP=0 2026-10-09T13:20:21.476025-07:00 web-03 sshd[12575]: Received disconnect from 10.17.87.8 port 62816:11: Bye Bye [preauth] 2026-10-09T13:20:21.492208-07:00 cache-3 app[30585]: INFO request_id=957ef230e865f9ef method=GET path=/static/main.css status=404 duration=2445ms 2026-10-09T13:20:21.508650-07:00 web-01 systemd[1]: session-36465.scope: Deactivated successfully. 2026-10-09T13:20:21.686039-07:00 db-primary kubelet[800]: I1009 13:20:21.833695 2380 kubelet.go:2380] "Pod is terminating, skipping pod status update" pod="default/api-762344fb84728123" 2026-10-09T13:20:21.864831-07:00 api-08 sshd[55584]: Invalid user zoë from 203.250.23.226 port 38821 2026-10-09T13:20:21.875973-07:00 web-03 app[30401]: INFO health check ok: db 144 ms, cache 144 ms, queue depth 11 2026-10-09T13:20:22.002625-07:00 api-08 sshd[25896]: Accepted publickey for sørensen from 91.3.77.74 port 15178 ssh2: ED25519 SHA256:86b00d5826aa5859 2026-10-09T13:20:22.007404-07:00 api-08 sshd[6525]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:20:22.273435-07:00 web-03 kernel: [35985.662673] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.128.79.228 DST=10.0.377.377 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=35985 DF PROTO=TCP SPT=48515 DPT=48515 WINDOW=35985 RES=0x00 SYN URGP=0 2026-10-09T13:20:22.329795-07:00 bastion kernel: [73695.937678] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.156.155.96 DST=10.0.777.777 LEN=32 TOS=0x00 PREC=0x00 TTL=32 ID=73695 DF PROTO=TCP SPT=10243 DPT=10243 WINDOW=73695 RES=0x00 SYN URGP=0 2026-10-09T13:20:22.382807-07:00 web-02 app[30140]: INFO request_id=55db23937ed5fba3 method=GET path=/api/v2/orders/8841 status=404 duration=4750ms 2026-10-09T13:20:22.454704-07:00 bastion app[30074]: WARN slow query (7064 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '71 minutes' 2026-10-09T13:20:22.574470-07:00 worker-12 systemd[1]: session-65053.scope: Deactivated successfully. 2026-10-09T13:20:22.611534-07:00 bastion app[30128]: WARN slow query (7428 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '20 minutes' 2026-10-09T13:20:22.911923-07:00 db-primary kernel: [61545.557214] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.185.18.203 DST=10.0.590.590 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=61545 DF PROTO=TCP SPT=55645 DPT=55645 WINDOW=61545 RES=0x00 SYN URGP=0 2026-10-09T13:20:23.067829-07:00 cache-3 nginx[1209]: 172.157.153.228 - - "GET /.env HTTP/1.1" 404 89821 "-" "Go-http-client/1.1" 2026-10-09T13:20:23.180874-07:00 api-08 app[30066]: INFO request_id=cf8ae75402a69b5e method=GET path=/favicon.ico status=502 duration=7935ms 2026-10-09T13:20:23.349964-07:00 bastion nginx[1205]: 91.226.73.142 - - "GET /static/app.js HTTP/1.1" 502 3938 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:23.394565-07:00 db-replica app[30403]: INFO request_id=3f791515502f9b87 method=GET path=/login status=204 duration=6599ms 2026-10-09T13:20:23.474390-07:00 api-07 app[30244]: INFO order 57385 confirmed for müller in 640 ms (region eu-west-1, queue emails) 2026-10-09T13:20:23.478924-07:00 bastion systemd[1]: Started Session 64764 of User priya. 2026-10-09T13:20:23.685992-07:00 web-01 nginx[1201]: 10.51.14.164 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 52896 "-" "curl/8.4.0" 2026-10-09T13:20:23.764680-07:00 db-replica systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:20:23.766044-07:00 api-08 postgres[6956]: LOG: duration: 776.460 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:23.898129-07:00 worker-12 sshd[23108]: Failed password for invalid user akira from 45.34.200.67 port 60938 ssh2 2026-10-09T13:20:24.153804-07:00 worker-12 haproxy[938]: 10.241.8.81:62479 [92468] http-in app/bastion 8492/0/745/745/8492 302 25716 - - ---- 811/811/55/55/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:20:24.214634-07:00 web-01 postgres[29081]: LOG: duration: 7191.693 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:24.405042-07:00 api-08 sshd[25768]: Received disconnect from 45.48.81.113 port 7546:11: Bye Bye [preauth] 2026-10-09T13:20:24.415519-07:00 db-primary systemd[1]: Started Session 96287 of User root. 2026-10-09T13:20:24.456823-07:00 web-02 cron[58493]: (ci) CMD (/usr/bin/backup --quiet --target /srv/ci) 2026-10-09T13:20:24.517720-07:00 web-03 app[30450]: INFO health check ok: db 603 ms, cache 603 ms, queue depth 56 2026-10-09T13:20:24.639642-07:00 cache-3 app[30096]: INFO request_id=c57546d7999b1625 method=GET path=/.env status=200 duration=3645ms 2026-10-09T13:20:24.685583-07:00 web-02 systemd[1]: Started Session 47500 of User backup. 2026-10-09T13:20:24.833477-07:00 api-07 app[30662]: INFO request_id=59e4973ecaf95606 method=GET path=/api/v2/orders/8841 status=200 duration=921ms 2026-10-09T13:20:24.893698-07:00 bastion sshd[17051]: Received disconnect from 10.153.118.125 port 49218:11: Bye Bye [preauth] 2026-10-09T13:20:25.123670-07:00 web-03 nginx[1208]: 203.32.59.149 - - "GET /static/app.js HTTP/1.1" 301 80035 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:25.164148-07:00 db-replica app[30371]: INFO request_id=032bfb2650b3f9c2 method=GET path=/.env status=502 duration=1872ms 2026-10-09T13:20:25.171746-07:00 edge-fr-1 nginx[1208]: 91.122.189.213 - - "GET /static/app.js HTTP/1.1" 401 42189 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:25.336828-07:00 api-07 nginx[1201]: 192.50.59.247 - - "GET /.env HTTP/1.1" 404 58942 "-" "curl/8.4.0" 2026-10-09T13:20:25.481812-07:00 db-replica app[30362]: INFO request_id=75bc81ab3bf379c5 method=GET path=/health status=500 duration=4781ms 2026-10-09T13:20:25.593120-07:00 db-replica nginx[1205]: 10.105.35.72 - akira "POST /.env HTTP/1.1" 200 23261 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:25.696789-07:00 web-02 kubelet[800]: I1009 13:20:25.675890 8392 kubelet.go:8392] "Pod is terminating, skipping pod status update" pod="default/api-aea10e2fa009a8a8" 2026-10-09T13:20:25.954741-07:00 db-replica app[30297]: INFO request_id=6a7190838617e37d method=GET path=/metrics status=200 duration=6761ms 2026-10-09T13:20:25.988565-07:00 web-02 app[30242]: INFO order 77206 confirmed for priya in 3461 ms (region us-east-1, queue orders) 2026-10-09T13:20:26.223454-07:00 web-01 nginx[1206]: 91.169.194.100 - - "GET /wp-login.php HTTP/1.1" 200 72396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:26.303896-07:00 api-08 app[30655]: INFO request_id=a9f6fa707a653c5a method=GET path=/metrics status=301 duration=7817ms 2026-10-09T13:20:26.619834-07:00 edge-fr-1 haproxy[903]: 203.94.244.151:58482 [18258] http-in app/bastion 728/0/841/841/728 301 159 - - ---- 472/472/60/60/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:20:26.723209-07:00 db-primary nginx[1209]: 192.179.241.154 - françois "POST /metrics HTTP/1.1" 500 82879 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:27.039684-07:00 web-03 dockerd[700]: time="2026-10-09T13:20:27.039684-07:00" level=warning msg="Health check for container 4ed3e53a5cb713b4 error: context deadline exceeded" 2026-10-09T13:20:27.149494-07:00 cache-3 sshd[4452]: Invalid user root from 10.151.249.49 port 4258 2026-10-09T13:20:27.226112-07:00 web-03 app[30354]: INFO request_id=428cb05d3dc633ff method=GET path=/api/v2/search?q=invoice status=200 duration=1115ms 2026-10-09T13:20:27.247276-07:00 worker-12 app[30130]: INFO request_id=44e437a1a4717d9b method=GET path=/wp-login.php status=200 duration=2170ms 2026-10-09T13:20:27.290375-07:00 db-primary sshd[62482]: Connection closed by 45.6.146.93 port 37284 [preauth] 2026-10-09T13:20:27.463983-07:00 web-01 kernel: [34560.500826] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.242.180.195 DST=10.0.191.191 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=34560 DF PROTO=TCP SPT=32310 DPT=32310 WINDOW=34560 RES=0x00 SYN URGP=0 2026-10-09T13:20:27.718584-07:00 cache-3 sshd[53907]: Connection closed by 91.171.6.51 port 57641 [preauth] 2026-10-09T13:20:27.772006-07:00 api-08 nginx[1205]: 10.154.23.204 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 32015 "-" "curl/8.4.0" 2026-10-09T13:20:27.951844-07:00 db-primary app[30554]: WARN retrying upstream 45.192.68.204:3850 after timeout (7064 ms), attempt 1 of 3 2026-10-09T13:20:28.176020-07:00 web-03 postgres[11241]: LOG: duration: 3660.847 ms statement: SELECT * FROM orders WHERE customer_id = 84430 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:28.267975-07:00 db-replica haproxy[905]: 91.168.58.195:46096 [15325] http-in app/web-01 6/0/581/581/6 200 69213 - - ---- 511/511/25/25/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:20:28.387705-07:00 web-01 app[30403]: INFO worker 75 finished job ed35294939a7b891 in 6665 ms 2026-10-09T13:20:28.416239-07:00 bastion nginx[1203]: 91.88.223.178 - - "GET /.env HTTP/1.1" 404 5751 "-" "kube-probe/1.31" 2026-10-09T13:20:28.433277-07:00 db-primary app[30471]: INFO order 85428 confirmed for zoë in 9003 ms (region us-east-1, queue webhooks) 2026-10-09T13:20:28.536581-07:00 web-03 postgres[18261]: LOG: duration: 7657.968 ms statement: SELECT * FROM orders WHERE customer_id = 84472 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:29.083887-07:00 cache-3 app[30052]: INFO order 50294 confirmed for ci in 9787 ms (region ap-northeast-1, queue orders) 2026-10-09T13:20:29.113282-07:00 web-02 nginx[1203]: 172.83.110.120 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 28220 "-" "kube-probe/1.31" 2026-10-09T13:20:29.123574-07:00 cache-3 nginx[1206]: 45.35.19.8 - - "GET /api/v2/users HTTP/1.1" 200 68494 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:29.167549-07:00 worker-12 sshd[4412]: Connection closed by 91.89.243.27 port 13727 [preauth] 2026-10-09T13:20:29.187582-07:00 bastion app[30209]: INFO request_id=5dc45b231decbb41 method=GET path=/favicon.ico status=200 duration=5438ms 2026-10-09T13:20:29.370222-07:00 web-03 sshd[57808]: Failed password for invalid user françois from 172.192.162.164 port 30464 ssh2 2026-10-09T13:20:29.545249-07:00 db-replica nginx[1205]: 203.35.226.194 - - "GET /api/v2/orders HTTP/1.1" 500 41155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:29.554365-07:00 worker-12 postgres[15464]: LOG: duration: 2312.817 ms statement: SELECT * FROM orders WHERE customer_id = 41065 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:29.618676-07:00 db-replica app[30525]: INFO request_id=a11143048a070e43 method=GET path=/api/v2/orders/8841 status=200 duration=4463ms 2026-10-09T13:20:29.630903-07:00 web-02 app[30277]: DEBUG cache hit ratio 43% over the last minute (51964 lookups) 2026-10-09T13:20:30.009165-07:00 api-08 haproxy[931]: 203.255.48.136:65337 [49963] http-in app/worker-12 7187/0/844/844/7187 200 33138 - - ---- 437/437/10/10/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:20:30.045877-07:00 web-02 app[30674]: INFO order 65723 confirmed for zoë in 4648 ms (region eu-west-1, queue emails) 2026-10-09T13:20:30.049523-07:00 web-01 haproxy[923]: 10.7.206.224:7432 [67004] http-in app/db-primary 5911/0/178/178/5911 200 78577 - - ---- 325/325/27/27/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:20:30.190841-07:00 web-02 app[30913]: WARN retrying upstream 10.178.143.137:4472 after timeout (3346 ms), attempt 3 of 3 2026-10-09T13:20:30.310466-07:00 web-02 app[30493]: DEBUG cache hit ratio 38% over the last minute (48580 lookups) 2026-10-09T13:20:30.312578-07:00 bastion app[30253]: INFO request_id=79a6530e8b42d7a9 method=GET path=/api/v2/orders status=200 duration=5436ms 2026-10-09T13:20:30.325812-07:00 web-01 app[30680]: INFO request_id=4f0bdb65a4a0a2f1 method=GET path=/metrics status=200 duration=8805ms 2026-10-09T13:20:30.353184-07:00 web-01 sshd[17937]: Failed password for invalid user akira from 91.87.176.70 port 5396 ssh2 2026-10-09T13:20:30.458140-07:00 web-03 nginx[1207]: 45.211.203.79 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 200 42023 "-" "Go-http-client/1.1" 2026-10-09T13:20:30.466863-07:00 web-01 haproxy[916]: 203.242.169.178:16209 [20693] http-in app/db-replica 5611/0/808/808/5611 200 44801 - - ---- 652/652/31/31/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:20:30.493151-07:00 cache-3 nginx[1201]: 91.162.47.47 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 44362 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:30.547433-07:00 edge-fr-1 systemd[1]: session-86788.scope: Deactivated successfully. 2026-10-09T13:20:30.656149-07:00 db-replica app[30734]: INFO order 98565 confirmed for akira in 1093 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:20:30.829758-07:00 worker-12 app[30595]: INFO order 29972 confirmed for deploy in 1120 ms (region us-east-1, queue invoices) 2026-10-09T13:20:30.918953-07:00 web-01 app[30613]: INFO request_id=e2608079d1c2f946 method=GET path=/api/v2/search?q=invoice status=301 duration=4125ms 2026-10-09T13:20:30.935808-07:00 edge-fr-1 kernel: [51599.397238] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.124.117.109 DST=10.0.528.528 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=51599 DF PROTO=TCP SPT=16110 DPT=16110 WINDOW=51599 RES=0x00 SYN URGP=0 2026-10-09T13:20:31.007778-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577231.127:12700): pid=12700 uid=0 auid=7143 ses=605 msg='op=login id=7143 exe="/usr/sbin/sshd" hostname=? addr=172.125.84.245 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:31.052829-07:00 web-03 sshd[37848]: Invalid user müller from 203.142.168.102 port 24553 2026-10-09T13:20:31.069974-07:00 bastion sshd[51750]: Connection closed by 45.189.160.58 port 22113 [preauth] 2026-10-09T13:20:31.087100-07:00 web-03 sshd[43123]: Connection closed by 10.209.134.129 port 46377 [preauth] 2026-10-09T13:20:31.313930-07:00 cache-3 app[30733]: WARN retrying upstream 192.241.181.236:35537 after timeout (6831 ms), attempt 2 of 3 2026-10-09T13:20:31.330018-07:00 edge-fr-1 nginx[1209]: 172.126.148.128 - - "GET /wp-login.php HTTP/1.1" 200 29783 "-" "Go-http-client/1.1" 2026-10-09T13:20:31.536141-07:00 web-02 app[30907]: DEBUG cache hit ratio 35% over the last minute (45106 lookups) 2026-10-09T13:20:31.577811-07:00 web-02 app[30999]: INFO request_id=00ed6162e2cc63fa method=GET path=/wp-login.php status=404 duration=4774ms 2026-10-09T13:20:31.655070-07:00 api-07 sshd[42373]: Connection closed by 203.183.99.73 port 59569 [preauth] 2026-10-09T13:20:31.665307-07:00 db-primary app[30202]: INFO order 77972 confirmed for françois in 2008 ms (region us-east-1, queue webhooks) 2026-10-09T13:20:31.714513-07:00 edge-fr-1 nginx[1204]: 91.204.56.55 - - "GET /static/app.js HTTP/1.1" 301 232 "-" "kube-probe/1.31" 2026-10-09T13:20:31.766021-07:00 cache-3 app[30671]: WARN retrying upstream 10.165.58.108:8418 after timeout (9326 ms), attempt 2 of 3 2026-10-09T13:20:31.866734-07:00 web-02 postgres[22878]: LOG: duration: 2897.604 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:32.291484-07:00 cache-3 sshd[5918]: Invalid user sørensen from 172.136.122.135 port 53859 2026-10-09T13:20:32.300980-07:00 api-08 haproxy[933]: 45.247.152.82:62976 [32318] http-in app/web-02 5719/0/742/742/5719 200 19635 - - ---- 637/637/94/94/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:20:32.395918-07:00 edge-fr-1 app[30541]: INFO worker 44 picked job 48002e6029c1ae59 from queue emails 2026-10-09T13:20:32.470657-07:00 web-01 app[30316]: INFO worker 25 finished job bbb098cf06368128 in 2694 ms 2026-10-09T13:20:32.579114-07:00 web-01 nginx[1203]: 172.138.195.94 - - "GET /.env HTTP/1.1" 401 87245 "-" "python-requests/2.32.3" 2026-10-09T13:20:32.631170-07:00 web-02 app[30001]: INFO request_id=b7fd42b88b9b6c58 method=GET path=/wp-login.php status=502 duration=8236ms 2026-10-09T13:20:32.815928-07:00 api-08 kubelet[800]: I1009 13:20:32.901255 4448 kubelet.go:4448] "Pod is terminating, skipping pod status update" pod="default/api-46e6c45495345ef2" 2026-10-09T13:20:33.091066-07:00 db-replica nginx[1208]: 91.193.33.23 - - "GET /admin HTTP/1.1" 502 35381 "-" "Go-http-client/1.1" 2026-10-09T13:20:33.151865-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791577233.919:99580): pid=99580 uid=0 auid=7680 ses=216 msg='op=login id=7680 exe="/usr/sbin/sshd" hostname=? addr=203.125.152.201 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:33.171421-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577233.981:99023): pid=99023 uid=0 auid=1625 ses=123 msg='op=login id=1625 exe="/usr/sbin/sshd" hostname=? addr=192.250.78.178 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:33.349651-07:00 db-replica sshd[45590]: Connection closed by 203.152.148.33 port 41574 [preauth] 2026-10-09T13:20:33.615173-07:00 web-01 haproxy[947]: 172.126.57.77:45337 [79120] http-in app/web-01 8432/0/555/555/8432 200 22720 - - ---- 325/325/54/54/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:20:33.852657-07:00 web-03 systemd[1]: session-82407.scope: Deactivated successfully. 2026-10-09T13:20:33.941019-07:00 db-primary app[30192]: INFO request_id=0c4c9f73db644f62 method=GET path=/metrics status=502 duration=6240ms 2026-10-09T13:20:34.237122-07:00 worker-12 nginx[1210]: 91.141.169.51 - - "GET /.env HTTP/1.1" 500 35306 "-" "curl/8.4.0" 2026-10-09T13:20:34.436065-07:00 db-replica app[30448]: INFO worker 29 finished job db437df080332f9c in 3499 ms 2026-10-09T13:20:34.439063-07:00 web-01 sshd[36478]: Accepted publickey for backup from 45.139.86.218 port 25701 ssh2: ED25519 SHA256:11f76c0652d92495 2026-10-09T13:20:34.446535-07:00 edge-fr-1 app[30936]: WARN slow query (3218 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '37 minutes' 2026-10-09T13:20:34.522134-07:00 worker-12 app[30263]: INFO request_id=db744c4f64535f94 method=GET path=/login status=200 duration=1876ms 2026-10-09T13:20:34.568108-07:00 db-primary app[30874]: INFO order 27302 confirmed for müller in 6723 ms (region ap-northeast-1, queue orders) 2026-10-09T13:20:34.712572-07:00 cache-3 kernel: [70829.491655] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.211.140.90 DST=10.0.428.428 LEN=39 TOS=0x00 PREC=0x00 TTL=39 ID=70829 DF PROTO=TCP SPT=48466 DPT=48466 WINDOW=70829 RES=0x00 SYN URGP=0 2026-10-09T13:20:34.744196-07:00 worker-12 app[30165]: INFO worker 37 finished job 4e21fd21fccb9545 in 5878 ms 2026-10-09T13:20:34.857046-07:00 web-02 postgres[14514]: LOG: duration: 2482.426 ms statement: SELECT * FROM orders WHERE customer_id = 11194 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:34.984052-07:00 cache-3 sshd[19558]: Failed password for invalid user zoë from 10.67.130.205 port 1336 ssh2 2026-10-09T13:20:35.053465-07:00 bastion haproxy[910]: 192.200.3.221:59921 [71959] http-in app/db-replica 2049/0/890/890/2049 200 86377 - - ---- 736/736/31/31/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:20:35.134247-07:00 db-replica app[30995]: INFO order 70926 confirmed for priya in 953 ms (region us-east-1, queue emails) 2026-10-09T13:20:35.209057-07:00 api-08 nginx[1200]: 91.28.26.44 - - "GET /favicon.ico HTTP/1.1" 404 35642 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:35.505695-07:00 api-08 sshd[58579]: Failed password for invalid user françois from 172.47.145.31 port 25535 ssh2 2026-10-09T13:20:35.619809-07:00 db-replica kernel: [62200.981906] TCP: request_sock_TCP: Possible SYN flooding on port 57476. Sending cookies. Check SNMP counters. 2026-10-09T13:20:36.131004-07:00 api-08 app[30023]: INFO request_id=b63d4fd438e3d449 method=GET path=/api/v2/search?q=invoice status=502 duration=8301ms 2026-10-09T13:20:36.180621-07:00 web-02 nginx[1210]: 203.251.243.56 - - "GET /admin HTTP/1.1" 200 14269 "-" "curl/8.4.0" 2026-10-09T13:20:36.265979-07:00 api-07 nginx[1205]: 192.45.87.57 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 21721 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:36.310149-07:00 db-replica sshd[11691]: Invalid user zoë from 192.113.83.54 port 12663 2026-10-09T13:20:36.427258-07:00 db-primary sshd[53400]: Received disconnect from 172.217.143.241 port 20937:11: Bye Bye [preauth] 2026-10-09T13:20:36.585516-07:00 db-primary app[30930]: INFO worker 21 finished job 56bfb5318a5341d6 in 4433 ms 2026-10-09T13:20:36.884666-07:00 worker-12 sshd[27299]: Failed password for invalid user priya from 91.199.49.116 port 25922 ssh2 2026-10-09T13:20:36.967390-07:00 edge-fr-1 app[30630]: INFO order 59802 confirmed for zoë in 519 ms (region eu-west-1, queue orders) 2026-10-09T13:20:37.216333-07:00 edge-fr-1 app[30439]: INFO request_id=3d950b09477ab54c method=GET path=/static/main.css status=204 duration=8001ms 2026-10-09T13:20:37.220205-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577237.215:60197): pid=60197 uid=0 auid=4499 ses=292 msg='op=login id=4499 exe="/usr/sbin/sshd" hostname=? addr=172.62.172.126 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:37.245772-07:00 web-03 sshd[32223]: Connection closed by 91.157.21.39 port 12567 [preauth] 2026-10-09T13:20:37.271858-07:00 edge-fr-1 kernel: [50926.994141] TCP: request_sock_TCP: Possible SYN flooding on port 3034. Sending cookies. Check SNMP counters. 2026-10-09T13:20:37.352511-07:00 web-02 nginx[1203]: 10.172.173.223 - - "GET /static/main.css HTTP/1.1" 401 3033 "-" "kube-probe/1.31" 2026-10-09T13:20:37.410644-07:00 bastion nginx[1207]: 91.202.106.52 - - "GET /api/v2/orders HTTP/1.1" 200 34323 "-" "python-requests/2.32.3" 2026-10-09T13:20:37.774380-07:00 web-02 app[30700]: INFO health check ok: db 472 ms, cache 472 ms, queue depth 40 2026-10-09T13:20:37.915931-07:00 api-08 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:20:38.095303-07:00 worker-12 app[30218]: INFO order 12842 confirmed for françois in 4227 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:20:38.103709-07:00 api-07 app[30746]: INFO health check ok: db 511 ms, cache 511 ms, queue depth 10 2026-10-09T13:20:38.139864-07:00 bastion app[30433]: INFO order 99457 confirmed for backup in 2301 ms (region eu-west-1, queue orders) 2026-10-09T13:20:38.145954-07:00 web-01 app[30893]: INFO request_id=c96c4584658ada33 method=GET path=/api/v2/users status=200 duration=3745ms 2026-10-09T13:20:38.173219-07:00 web-03 sshd[59686]: Accepted publickey for müller from 45.84.198.147 port 12710 ssh2: ED25519 SHA256:27bab0bf986eb351 2026-10-09T13:20:38.207857-07:00 api-08 app[30159]: INFO worker 20 picked job fa709b1ba4c3ca07 from queue invoices 2026-10-09T13:20:38.362421-07:00 web-03 app[30170]: INFO request_id=5b65a62e23898337 method=GET path=/static/app.js status=404 duration=4733ms 2026-10-09T13:20:38.404291-07:00 db-replica nginx[1207]: 172.170.117.97 - deploy "POST /api/v2/orders HTTP/1.1" 401 5486 "-" "Go-http-client/1.1" 2026-10-09T13:20:38.552560-07:00 db-primary app[30066]: INFO worker 16 finished job cbee23117c7d0734 in 2503 ms 2026-10-09T13:20:38.569902-07:00 db-replica app[30821]: INFO order 44176 confirmed for akira in 9253 ms (region ap-northeast-1, queue emails) 2026-10-09T13:20:38.989743-07:00 api-08 app[30081]: INFO worker 16 finished job 0bb787af9fe5943d in 3716 ms 2026-10-09T13:20:39.019125-07:00 db-primary sshd[37526]: Invalid user backup from 203.72.152.226 port 7514 2026-10-09T13:20:39.153154-07:00 api-08 app[30280]: INFO health check ok: db 688 ms, cache 688 ms, queue depth 55 2026-10-09T13:20:39.200915-07:00 web-01 kernel: [84703.476593] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/app.service,task=java,pid=84703,uid=4742 2026-10-09T13:20:39.241720-07:00 db-primary nginx[1201]: 172.73.250.178 - - "GET /login HTTP/1.1" 301 81452 "-" "Go-http-client/1.1" 2026-10-09T13:20:39.257788-07:00 edge-fr-1 app[30949]: WARN slow query (5022 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '82 minutes' 2026-10-09T13:20:39.490419-07:00 cache-3 app[30169]: INFO worker 37 picked job d122ea0a2e06d100 from queue orders 2026-10-09T13:20:39.666959-07:00 api-08 app[30441]: INFO health check ok: db 722 ms, cache 722 ms, queue depth 47 2026-10-09T13:20:39.669755-07:00 web-03 nginx[1200]: 10.148.89.197 - - "GET /admin HTTP/1.1" 200 57333 "-" "Go-http-client/1.1" 2026-10-09T13:20:39.756465-07:00 web-02 app[30736]: INFO request_id=556508cbbcba6231 method=GET path=/wp-login.php status=200 duration=3452ms 2026-10-09T13:20:39.949116-07:00 db-primary sshd[58969]: Accepted publickey for root from 10.1.225.35 port 5156 ssh2: ED25519 SHA256:a5a3ebd0e0dfcc1d 2026-10-09T13:20:40.089591-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577240.214:42628): pid=42628 uid=0 auid=3413 ses=602 msg='op=login id=3413 exe="/usr/sbin/sshd" hostname=? addr=192.184.242.199 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:40.223239-07:00 web-01 sshd[62841]: Failed password for invalid user deploy from 203.228.65.183 port 24011 ssh2 2026-10-09T13:20:40.343783-07:00 edge-fr-1 app[30724]: INFO request_id=6968cb12c7cff4ef method=GET path=/.env status=500 duration=4556ms 2026-10-09T13:20:40.421855-07:00 db-replica nginx[1201]: 10.254.174.129 - - "GET /api/v2/orders HTTP/1.1" 500 57478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:40.494083-07:00 edge-fr-1 app[30845]: INFO health check ok: db 522 ms, cache 522 ms, queue depth 90 2026-10-09T13:20:40.580710-07:00 web-01 app[30961]: INFO worker 67 picked job a3018638e4a96f05 from queue invoices 2026-10-09T13:20:40.743879-07:00 web-01 nginx[1208]: 10.58.153.160 - - "GET /login HTTP/1.1" 500 16588 "-" "kube-probe/1.31" 2026-10-09T13:20:40.825012-07:00 api-07 postgres[5328]: LOG: duration: 5790.450 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:41.140455-07:00 api-07 sshd[60550]: Received disconnect from 192.27.83.79 port 65054:11: Bye Bye [preauth] 2026-10-09T13:20:41.155855-07:00 db-replica postgres[22197]: LOG: duration: 9553.534 ms statement: SELECT * FROM orders WHERE customer_id = 79592 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:41.305817-07:00 edge-fr-1 nginx[1204]: 203.113.37.74 - - "GET /api/v2/users HTTP/1.1" 401 27758 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:41.614565-07:00 db-primary cron[10315]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:20:41.717887-07:00 cache-3 kernel: [61227.605316] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.182.223.12 DST=10.0.711.711 LEN=30 TOS=0x00 PREC=0x00 TTL=30 ID=61227 DF PROTO=TCP SPT=21996 DPT=21996 WINDOW=61227 RES=0x00 SYN URGP=0 2026-10-09T13:20:41.740182-07:00 cache-3 app[30574]: DEBUG cache hit ratio 2% over the last minute (99857 lookups) 2026-10-09T13:20:41.934477-07:00 cache-3 app[30687]: INFO worker 27 finished job e4d8b7138a278ccc in 6958 ms 2026-10-09T13:20:41.992482-07:00 worker-12 haproxy[920]: 45.112.57.26:35683 [31672] http-in app/web-01 7863/0/559/559/7863 204 63002 - - ---- 926/926/46/46/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:20:42.141973-07:00 web-01 sshd[59031]: Connection closed by 172.121.141.171 port 20150 [preauth] 2026-10-09T13:20:42.455647-07:00 db-primary nginx[1201]: 192.228.97.178 - akira "POST /static/app.js HTTP/1.1" 404 21603 "-" "kube-probe/1.31" 2026-10-09T13:20:42.492418-07:00 cache-3 cron[8363]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:20:42.518500-07:00 web-03 sshd[36946]: Invalid user zoë from 45.77.28.143 port 64330 2026-10-09T13:20:42.530256-07:00 edge-fr-1 sshd[42073]: pam_unix(sshd:session): session opened for user françois(uid=5905) by (uid=0) 2026-10-09T13:20:42.679175-07:00 web-03 nginx[1200]: 10.2.220.22 - müller "POST /api/v2/orders/8841 HTTP/1.1" 200 65713 "-" "python-requests/2.32.3" 2026-10-09T13:20:42.709403-07:00 bastion app[30761]: INFO request_id=8ad70dee20755396 method=GET path=/favicon.ico status=200 duration=6283ms 2026-10-09T13:20:42.928922-07:00 worker-12 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:20:42.946853-07:00 edge-fr-1 sshd[24534]: Received disconnect from 45.129.68.82 port 16973:11: Bye Bye [preauth] 2026-10-09T13:20:43.061494-07:00 api-07 nginx[1204]: 45.40.81.89 - - "GET /favicon.ico HTTP/1.1" 404 59776 "-" "curl/8.4.0" 2026-10-09T13:20:43.113450-07:00 worker-12 app[30688]: INFO order 87536 confirmed for root in 4492 ms (region ap-northeast-1, queue orders) 2026-10-09T13:20:43.170801-07:00 worker-12 nginx[1204]: 91.225.216.90 - zoë "POST /.env HTTP/1.1" 404 72169 "-" "python-requests/2.32.3" 2026-10-09T13:20:43.249609-07:00 db-primary app[30264]: ERROR payment declined for order 53753: card_declined (code 69), customer notified 2026-10-09T13:20:43.251568-07:00 cache-3 sshd[5571]: Connection closed by 192.35.126.5 port 48435 [preauth] 2026-10-09T13:20:43.519653-07:00 web-02 postgres[7134]: LOG: duration: 6716.275 ms statement: SELECT * FROM orders WHERE customer_id = 92231 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:43.538925-07:00 web-01 app[30639]: INFO request_id=e8608ed4c0dd106a method=GET path=/favicon.ico status=404 duration=6792ms 2026-10-09T13:20:43.668525-07:00 api-07 kernel: [29692.643633] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.91.89.68 DST=10.0.884.884 LEN=92 TOS=0x00 PREC=0x00 TTL=92 ID=29692 DF PROTO=TCP SPT=47058 DPT=47058 WINDOW=29692 RES=0x00 SYN URGP=0 2026-10-09T13:20:43.716555-07:00 bastion sshd[22462]: Accepted publickey for deploy from 10.46.110.156 port 57822 ssh2: ED25519 SHA256:0c982edea7b57848 2026-10-09T13:20:43.773349-07:00 db-replica nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.124.100.86, server: app.example.com, request: "GET /static/main.css HTTP/1.1", upstream: "http://10.0.776.776:8080/static/main.css" 2026-10-09T13:20:43.944152-07:00 db-primary nginx[1201]: 172.103.183.72 - zoë "POST /static/main.css HTTP/1.1" 401 22351 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:44.041801-07:00 worker-12 nginx[1201]: 45.64.217.23 - - "GET /wp-login.php HTTP/1.1" 404 12193 "-" "kube-probe/1.31" 2026-10-09T13:20:44.093243-07:00 web-03 app[30101]: INFO worker 35 finished job 4aa876bc4576f01b in 4023 ms 2026-10-09T13:20:44.100960-07:00 worker-12 nginx[1209]: 10.201.118.40 - - "GET /static/app.js HTTP/1.1" 200 3600 "-" "curl/8.4.0" 2026-10-09T13:20:44.151990-07:00 bastion app[30606]: INFO worker 99 finished job 33946e0e60742223 in 6597 ms 2026-10-09T13:20:44.224263-07:00 web-02 nginx[1210]: 203.175.127.243 - sørensen "POST /api/v2/search?q=invoice HTTP/1.1" 200 15911 "-" "python-requests/2.32.3" 2026-10-09T13:20:44.243587-07:00 db-primary nginx[1208]: 192.239.152.178 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 89116 "-" "python-requests/2.32.3" 2026-10-09T13:20:44.581212-07:00 web-02 app[30706]: WARN retrying upstream 45.31.21.94:44059 after timeout (5168 ms), attempt 1 of 3 2026-10-09T13:20:44.661204-07:00 api-07 nginx[1204]: 203.129.75.223 - - "GET /login HTTP/1.1" 502 53597 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:44.738220-07:00 bastion app[30503]: INFO request_id=8be7d898955e206a method=GET path=/health status=302 duration=2463ms 2026-10-09T13:20:44.744373-07:00 web-01 app[30460]: INFO request_id=b8eb0a5043468fd5 method=GET path=/favicon.ico status=204 duration=5090ms 2026-10-09T13:20:44.835267-07:00 db-primary app[30538]: INFO health check ok: db 857 ms, cache 857 ms, queue depth 89 2026-10-09T13:20:44.882958-07:00 api-07 postgres[23580]: LOG: checkpoint complete: wrote 8552 buffers (23%); 0 WAL file(s) added, 0 removed, 53 recycled; write=9006.640 s, sync=0.640 s, total=9006.640 s 2026-10-09T13:20:44.897594-07:00 api-07 systemd[1]: Started Session 82466 of User müller. 2026-10-09T13:20:44.908730-07:00 api-07 sshd[7250]: Failed password for invalid user ci from 203.16.87.168 port 4080 ssh2 2026-10-09T13:20:44.947052-07:00 web-02 app[30658]: WARN slow query (34 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '53 minutes' 2026-10-09T13:20:45.071799-07:00 db-primary sshd[41607]: Received disconnect from 203.97.97.211 port 19303:11: Bye Bye [preauth] 2026-10-09T13:20:45.142021-07:00 edge-fr-1 nginx[1204]: 91.77.38.27 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 200 54274 "-" "python-requests/2.32.3" 2026-10-09T13:20:45.200036-07:00 cache-3 nginx[1206]: 192.198.179.132 - - "GET /favicon.ico HTTP/1.1" 200 85027 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:45.368677-07:00 edge-fr-1 app[30885]: INFO worker 37 finished job 52f14c94258672f2 in 148 ms 2026-10-09T13:20:45.381270-07:00 db-replica app[30524]: INFO request_id=07e3a6ef0df9b767 method=GET path=/wp-login.php status=200 duration=7215ms 2026-10-09T13:20:45.702069-07:00 worker-12 app[30614]: INFO request_id=020b7de35bba3eab method=GET path=/login status=500 duration=5271ms 2026-10-09T13:20:45.795907-07:00 api-08 nginx[1210]: 203.221.215.59 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 11161 "-" "Go-http-client/1.1" 2026-10-09T13:20:45.847805-07:00 db-primary app[30921]: INFO request_id=83da95f848fbd9d1 method=GET path=/api/v2/search?q=invoice status=200 duration=3385ms 2026-10-09T13:20:46.098169-07:00 web-03 app[30781]: INFO order 27420 confirmed for müller in 3928 ms (region eu-west-1, queue webhooks) 2026-10-09T13:20:46.109229-07:00 api-07 nginx[1203]: 45.84.107.75 - ci "POST /api/v2/orders/8841 HTTP/1.1" 500 52066 "-" "Go-http-client/1.1" 2026-10-09T13:20:46.136179-07:00 api-08 sshd[40569]: Failed password for invalid user backup from 10.255.106.84 port 33302 ssh2 2026-10-09T13:20:46.453808-07:00 api-07 app[30714]: INFO request_id=5d1712acb39cd8b1 method=GET path=/admin status=200 duration=919ms 2026-10-09T13:20:46.576630-07:00 db-replica nginx[1209]: 172.254.203.122 - akira "POST /.env HTTP/1.1" 401 8692 "-" "kube-probe/1.31" 2026-10-09T13:20:46.676692-07:00 web-01 nginx[1205]: 192.66.28.26 - sørensen "POST /api/v2/search?q=invoice HTTP/1.1" 301 23861 "-" "curl/8.4.0" 2026-10-09T13:20:46.680774-07:00 web-01 app[30549]: INFO order 15133 confirmed for müller in 4664 ms (region us-east-1, queue orders) 2026-10-09T13:20:46.711472-07:00 api-07 sshd[19312]: Connection closed by 91.93.217.47 port 33741 [preauth] 2026-10-09T13:20:46.750732-07:00 web-02 cron[17714]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:20:47.191493-07:00 api-08 app[30378]: DEBUG cache hit ratio 27% over the last minute (12412 lookups) 2026-10-09T13:20:47.261840-07:00 bastion nginx[1210]: 91.223.233.97 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 200 50919 "-" "python-requests/2.32.3" 2026-10-09T13:20:47.266871-07:00 edge-fr-1 app[30368]: INFO health check ok: db 917 ms, cache 917 ms, queue depth 34 2026-10-09T13:20:47.643234-07:00 web-01 sshd[43578]: Failed password for invalid user zoë from 45.175.157.158 port 25478 ssh2 2026-10-09T13:20:47.680825-07:00 worker-12 sshd[23769]: Connection closed by 172.132.75.220 port 50539 [preauth] 2026-10-09T13:20:47.825385-07:00 db-replica app[30107]: INFO worker 76 picked job f8b18b5e2248f702 from queue orders 2026-10-09T13:20:47.915847-07:00 worker-12 nginx[1202]: 91.98.195.6 - - "GET /static/app.js HTTP/1.1" 302 32346 "-" "kube-probe/1.31" 2026-10-09T13:20:47.949936-07:00 db-primary sshd[33270]: Connection closed by 172.126.9.119 port 19364 [preauth] 2026-10-09T13:20:48.116257-07:00 db-primary nginx[1209]: 10.207.79.112 - - "GET /health HTTP/1.1" 500 63280 "-" "kube-probe/1.31" 2026-10-09T13:20:48.313157-07:00 cache-3 haproxy[929]: 203.83.177.159:17420 [67810] http-in app/db-replica 2654/0/409/409/2654 200 39873 - - ---- 867/867/38/38/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:20:48.438647-07:00 db-replica app[30423]: INFO worker 97 finished job 193abcd4cc7430f2 in 3353 ms 2026-10-09T13:20:48.709336-07:00 bastion nginx[1204]: 45.92.194.1 - akira "POST /static/main.css HTTP/1.1" 404 46981 "-" "curl/8.4.0" 2026-10-09T13:20:48.853927-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577248.295:53694): pid=53694 uid=0 auid=9900 ses=864 msg='op=login id=9900 exe="/usr/sbin/sshd" hostname=? addr=203.112.188.40 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:48.940544-07:00 web-02 postgres[22353]: LOG: checkpoint complete: wrote 1227 buffers (66%); 0 WAL file(s) added, 0 removed, 80 recycled; write=9559.256 s, sync=0.256 s, total=9559.256 s 2026-10-09T13:20:49.038437-07:00 db-replica haproxy[901]: 192.95.96.101:45419 [82067] http-in app/edge-fr-1 7505/0/269/269/7505 204 61787 - - ---- 971/971/46/46/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:49.111679-07:00 web-03 sudo: backup : TTY=pts/0 ; PWD=/home/backup ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:20:49.131381-07:00 api-08 sudo: root : TTY=pts/0 ; PWD=/home/root ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:20:49.574598-07:00 db-primary nginx[1206]: 45.0.7.68 - - "GET /.env HTTP/1.1" 401 57805 "-" "Go-http-client/1.1" 2026-10-09T13:20:49.643859-07:00 api-08 nginx[1209]: 192.23.109.13 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 3409 "-" "python-requests/2.32.3" 2026-10-09T13:20:49.790241-07:00 worker-12 sshd[61586]: Invalid user ci from 10.165.168.250 port 54644 2026-10-09T13:20:49.792225-07:00 worker-12 app[30522]: INFO request_id=a3969f5d294b920d method=GET path=/wp-login.php status=200 duration=9525ms 2026-10-09T13:20:49.890214-07:00 web-01 haproxy[909]: 192.107.13.81:46484 [24817] http-in app/web-02 78/0/183/183/78 401 6505 - - ---- 758/758/97/97/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:49.960994-07:00 web-02 postgres[4878]: LOG: duration: 1221.630 ms statement: SELECT * FROM orders WHERE customer_id = 65852 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:50.071086-07:00 web-01 haproxy[924]: 172.61.237.98:20066 [78078] http-in app/web-01 8204/0/793/793/8204 200 17028 - - ---- 224/224/89/89/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:50.143918-07:00 worker-12 app[30239]: INFO health check ok: db 973 ms, cache 973 ms, queue depth 15 2026-10-09T13:20:50.165646-07:00 web-02 systemd[1]: Started Session 43749 of User root. 2026-10-09T13:20:50.236754-07:00 db-replica app[30913]: INFO request_id=1ccc531a27a8aeb8 method=GET path=/favicon.ico status=401 duration=8969ms 2026-10-09T13:20:50.256279-07:00 db-replica app[30460]: INFO request_id=a90569a308922404 method=GET path=/health status=404 duration=7536ms 2026-10-09T13:20:50.403417-07:00 bastion nginx[1205]: 91.21.243.219 - - "GET /api/v2/orders HTTP/1.1" 502 46931 "-" "Go-http-client/1.1" 2026-10-09T13:20:50.423740-07:00 bastion haproxy[913]: 10.151.80.201:6165 [44527] http-in app/worker-12 7725/0/40/40/7725 500 83433 - - ---- 437/437/44/44/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:20:50.471155-07:00 web-02 app[30588]: DEBUG cache hit ratio 98% over the last minute (57951 lookups) 2026-10-09T13:20:50.540911-07:00 web-02 haproxy[944]: 10.29.232.8:21219 [73380] http-in app/edge-fr-1 9451/0/788/788/9451 404 78551 - - ---- 499/499/53/53/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:50.602985-07:00 db-replica systemd[1]: session-32477.scope: Deactivated successfully. 2026-10-09T13:20:50.639553-07:00 cache-3 cron[5195]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:20:50.697785-07:00 web-02 postgres[5041]: LOG: duration: 7582.609 ms statement: SELECT * FROM orders WHERE customer_id = 82808 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:50.752384-07:00 api-07 sshd[62812]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:20:50.782541-07:00 bastion app[30708]: INFO worker 36 picked job 00bc98ba82489add from queue webhooks 2026-10-09T13:20:50.791688-07:00 edge-fr-1 app[30006]: INFO worker 32 picked job 24362b980390ab65 from queue orders 2026-10-09T13:20:50.795440-07:00 db-primary app[30043]: DEBUG cache hit ratio 40% over the last minute (99936 lookups) 2026-10-09T13:20:51.007326-07:00 cache-3 nginx[1204]: 172.131.43.249 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 43471 "-" "Go-http-client/1.1" 2026-10-09T13:20:51.084261-07:00 api-08 app[30848]: WARN slow query (6880 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '65 minutes' 2026-10-09T13:20:51.224288-07:00 edge-fr-1 app[30517]: INFO request_id=290b12b8777e7d52 method=GET path=/api/v2/orders/8841 status=200 duration=2835ms 2026-10-09T13:20:51.238011-07:00 cache-3 nginx[1206]: 172.11.134.80 - ci "POST /admin HTTP/1.1" 401 26314 "-" "kube-probe/1.31" 2026-10-09T13:20:51.499083-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577251.677:78866): pid=78866 uid=0 auid=4817 ses=924 msg='op=login id=4817 exe="/usr/sbin/sshd" hostname=? addr=10.51.41.10 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:51.594228-07:00 api-08 app[30347]: INFO request_id=f19e6ede2b0838cd method=GET path=/static/app.js status=302 duration=648ms 2026-10-09T13:20:51.734744-07:00 web-03 app[30705]: INFO worker 97 finished job b1f992e71cd0c3c9 in 4461 ms 2026-10-09T13:20:51.883412-07:00 bastion app[30904]: INFO order 36535 confirmed for akira in 7878 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:20:52.042236-07:00 edge-fr-1 sshd[63636]: Failed password for invalid user root from 203.141.232.224 port 28981 ssh2 2026-10-09T13:20:52.103584-07:00 web-03 app[30974]: INFO order 68602 confirmed for priya in 4592 ms (region eu-west-1, queue invoices) 2026-10-09T13:20:52.276718-07:00 web-03 sshd[35334]: Invalid user müller from 45.6.83.239 port 23883 2026-10-09T13:20:52.329539-07:00 db-primary app[30621]: INFO health check ok: db 287 ms, cache 287 ms, queue depth 59 2026-10-09T13:20:52.468157-07:00 worker-12 nginx[1206]: 10.15.26.175 - priya "POST /api/v2/users HTTP/1.1" 200 89430 "-" "kube-probe/1.31" 2026-10-09T13:20:52.545545-07:00 web-02 app[30186]: INFO worker 75 picked job 8aded80c2dcbc9c7 from queue orders 2026-10-09T13:20:52.570296-07:00 web-01 haproxy[904]: 192.87.12.182:50366 [36650] http-in app/web-01 9896/0/563/563/9896 204 41328 - - ---- 335/335/62/62/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:20:52.857634-07:00 worker-12 app[30139]: INFO request_id=58ae121502b7a707 method=GET path=/api/v2/users status=301 duration=9772ms 2026-10-09T13:20:52.894754-07:00 edge-fr-1 app[30094]: INFO worker 96 picked job b7d32263495fcd57 from queue invoices 2026-10-09T13:20:52.983545-07:00 bastion app[30503]: INFO request_id=264939779b99e2db method=GET path=/api/v2/orders/8841 status=500 duration=7961ms 2026-10-09T13:20:53.026132-07:00 db-replica nginx[1204]: 91.237.116.196 - - "GET /static/main.css HTTP/1.1" 500 46105 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:53.148801-07:00 bastion nginx[1203]: 91.66.39.185 - - "GET /login HTTP/1.1" 502 56211 "-" "python-requests/2.32.3" 2026-10-09T13:20:53.231596-07:00 web-01 haproxy[906]: 45.196.61.243:10356 [50821] http-in app/api-08 9680/0/811/811/9680 500 73033 - - ---- 931/931/27/27/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:20:53.266474-07:00 bastion nginx[1208]: 203.90.202.89 - root "POST /admin HTTP/1.1" 301 64688 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:53.323078-07:00 db-replica nginx[1208]: 192.238.172.56 - - "GET /api/v2/orders HTTP/1.1" 200 13002 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:53.371516-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:20:53.371516-07:00" level=warning msg="Health check for container 0472c615dd217c7b error: context deadline exceeded" 2026-10-09T13:20:53.708069-07:00 web-03 haproxy[911]: Server app/api-07 is UP, reason: Layer7 check passed, code: 200, check duration: 126ms. 76 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:20:53.713967-07:00 db-replica sshd[18980]: Failed password for invalid user sørensen from 192.215.116.160 port 4560 ssh2 2026-10-09T13:20:54.009411-07:00 worker-12 app[30411]: INFO request_id=df50205fc7974545 method=GET path=/favicon.ico status=401 duration=5823ms 2026-10-09T13:20:54.120415-07:00 web-03 nginx[1203]: 91.173.118.201 - - "GET /favicon.ico HTTP/1.1" 200 20010 "-" "kube-probe/1.31" 2026-10-09T13:20:54.161699-07:00 cache-3 nginx[1201]: 91.64.18.201 - - "GET /health HTTP/1.1" 200 14911 "-" "python-requests/2.32.3" 2026-10-09T13:20:54.194322-07:00 cache-3 postgres[20977]: LOG: duration: 5114.101 ms statement: SELECT * FROM orders WHERE customer_id = 11473 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:54.422126-07:00 cache-3 haproxy[923]: 192.7.223.96:42705 [49737] http-in app/web-02 4793/0/57/57/4793 200 33782 - - ---- 351/351/25/25/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:20:54.790951-07:00 db-primary nginx[1201]: 91.8.16.89 - - "GET /api/v2/users HTTP/1.1" 200 12339 "-" "curl/8.4.0" 2026-10-09T13:20:54.797401-07:00 cache-3 haproxy[932]: 10.119.29.103:63162 [58427] http-in app/cache-3 6982/0/333/333/6982 502 19179 - - ---- 196/196/66/66/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:20:54.848809-07:00 bastion sshd[52420]: Accepted publickey for müller from 172.147.197.195 port 10282 ssh2: ED25519 SHA256:1aa0ac91b20c4cc2 2026-10-09T13:20:54.863260-07:00 api-07 kernel: [80469.247124] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.128.6.217 DST=10.0.879.879 LEN=26 TOS=0x00 PREC=0x00 TTL=26 ID=80469 DF PROTO=TCP SPT=1169 DPT=1169 WINDOW=80469 RES=0x00 SYN URGP=0 2026-10-09T13:20:54.951408-07:00 web-01 haproxy[933]: 91.108.204.223:57940 [79293] http-in app/cache-3 491/0/134/134/491 401 56906 - - ---- 339/339/91/91/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:20:55.291416-07:00 api-08 nginx[1208]: 45.86.237.2 - - "GET /health HTTP/1.1" 200 56712 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:55.594512-07:00 api-07 nginx[1206]: 91.110.170.186 - - "GET /health HTTP/1.1" 200 17265 "-" "Go-http-client/1.1" 2026-10-09T13:20:55.611676-07:00 worker-12 nginx[1200]: 172.36.56.115 - - "GET /login HTTP/1.1" 200 38645 "-" "python-requests/2.32.3" 2026-10-09T13:20:55.634425-07:00 api-07 app[30017]: INFO order 81139 confirmed for akira in 1703 ms (region ap-northeast-1, queue orders) 2026-10-09T13:20:55.704526-07:00 web-01 app[30667]: ERROR cache miss storm: 7519 misses in 9969 ms, key prefix session:root 2026-10-09T13:20:56.039733-07:00 api-07 app[30405]: DEBUG cache hit ratio 45% over the last minute (36186 lookups) 2026-10-09T13:20:56.135311-07:00 api-08 sshd[39014]: Invalid user priya from 172.123.240.138 port 25193 2026-10-09T13:20:56.182070-07:00 cache-3 nginx[1201]: 192.46.52.24 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 6878 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:20:56.313934-07:00 web-02 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:20:56.635201-07:00 worker-12 app[30265]: INFO health check ok: db 126 ms, cache 126 ms, queue depth 39 2026-10-09T13:20:56.639963-07:00 web-02 nginx[1201]: 10.205.178.99 - deploy "POST /login HTTP/1.1" 204 74087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:20:56.692278-07:00 edge-fr-1 haproxy[931]: 10.26.245.199:16205 [31671] http-in app/db-replica 4779/0/280/280/4779 200 37054 - - ---- 173/173/69/69/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:20:56.810485-07:00 worker-12 nginx[1204]: 10.85.142.171 - - "GET /api/v2/orders HTTP/1.1" 301 26302 "-" "curl/8.4.0" 2026-10-09T13:20:56.980264-07:00 web-01 sshd[62143]: Failed password for invalid user deploy from 91.56.83.155 port 2682 ssh2 2026-10-09T13:20:57.373512-07:00 bastion nginx[1206]: 10.82.14.59 - - "GET /.env HTTP/1.1" 404 686 "-" "curl/8.4.0" 2026-10-09T13:20:57.508729-07:00 api-07 app[30671]: INFO request_id=a2a70d7b90adca40 method=GET path=/wp-login.php status=404 duration=5954ms 2026-10-09T13:20:57.563305-07:00 db-primary nginx[1205]: 45.89.192.124 - - "GET /metrics HTTP/1.1" 401 43847 "-" "kube-probe/1.31" 2026-10-09T13:20:57.768347-07:00 web-01 app[30799]: INFO request_id=d2e3b5a576620bc0 method=GET path=/login status=500 duration=9703ms 2026-10-09T13:20:57.804472-07:00 web-03 app[30616]: INFO worker 41 finished job 156775170a0fae6f in 8910 ms 2026-10-09T13:20:57.891824-07:00 edge-fr-1 nginx[1202]: 203.173.247.155 - deploy "POST /login HTTP/1.1" 301 23867 "-" "python-requests/2.32.3" 2026-10-09T13:20:57.892930-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577257.387:26680): pid=26680 uid=0 auid=9964 ses=789 msg='op=login id=9964 exe="/usr/sbin/sshd" hostname=? addr=192.89.30.64 terminal=/dev/pts/0 res=success' 2026-10-09T13:20:57.966756-07:00 web-01 haproxy[925]: 172.218.137.179:32131 [14507] http-in app/web-02 603/0/120/120/603 404 1909 - - ---- 545/545/38/38/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:20:57.997487-07:00 web-02 app[30141]: INFO worker 55 picked job 901562dbdea1fc0f from queue webhooks 2026-10-09T13:20:58.162607-07:00 api-08 app[30415]: INFO order 25049 confirmed for françois in 2057 ms (region us-east-1, queue invoices) 2026-10-09T13:20:58.361491-07:00 web-03 app[30355]: INFO order 30788 confirmed for deploy in 7468 ms (region us-east-1, queue invoices) 2026-10-09T13:20:58.446143-07:00 api-07 postgres[2719]: LOG: duration: 7991.770 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:58.495595-07:00 edge-fr-1 sshd[57299]: Connection closed by 45.193.146.176 port 39270 [preauth] 2026-10-09T13:20:58.614633-07:00 worker-12 app[30624]: INFO request_id=b831613aa6b80c7b method=GET path=/login status=204 duration=6773ms 2026-10-09T13:20:58.643623-07:00 api-07 haproxy[930]: 91.7.43.233:9017 [49817] http-in app/web-02 7795/0/616/616/7795 302 74176 - - ---- 254/254/79/79/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:20:58.824211-07:00 api-07 nginx[1204]: 91.120.168.237 - - "GET /admin HTTP/1.1" 500 37906 "-" "kube-probe/1.31" 2026-10-09T13:20:58.850355-07:00 web-01 sshd[14728]: Accepted publickey for sørensen from 10.16.170.136 port 52880 ssh2: ED25519 SHA256:85d2d95fa4209786 2026-10-09T13:20:59.075627-07:00 web-03 postgres[4670]: LOG: duration: 3746.831 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:20:59.171497-07:00 api-07 app[30138]: INFO worker 84 finished job d2a9f26ba7109957 in 1526 ms 2026-10-09T13:20:59.179068-07:00 api-07 postgres[13457]: LOG: duration: 8164.93 ms statement: SELECT * FROM orders WHERE customer_id = 95186 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:20:59.221180-07:00 web-01 postgres[15387]: ERROR: deadlock detected 2026-10-09T13:20:59.244345-07:00 edge-fr-1 cron[8341]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:20:59.452971-07:00 web-03 app[30052]: INFO worker 33 picked job 7c5a42f1e423b3b0 from queue webhooks 2026-10-09T13:20:59.471629-07:00 edge-fr-1 app[30550]: INFO worker 14 finished job 2c6c001ea7b194ff in 7314 ms 2026-10-09T13:20:59.595287-07:00 db-replica kernel: [26101.092672] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.13.153.53 DST=10.0.536.536 LEN=28 TOS=0x00 PREC=0x00 TTL=28 ID=26101 DF PROTO=TCP SPT=12413 DPT=12413 WINDOW=26101 RES=0x00 SYN URGP=0 2026-10-09T13:20:59.677566-07:00 db-primary app[30323]: INFO order 12059 confirmed for ci in 897 ms (region eu-west-1, queue invoices) 2026-10-09T13:20:59.709668-07:00 api-08 sshd[32750]: Failed password for invalid user akira from 10.75.73.99 port 34042 ssh2 2026-10-09T13:20:59.866490-07:00 cache-3 sshd[37665]: Accepted publickey for akira from 172.194.170.177 port 39898 ssh2: ED25519 SHA256:ada2d20787057d66 2026-10-09T13:21:00.009359-07:00 api-08 sshd[32701]: Failed password for invalid user sørensen from 192.138.154.179 port 49124 ssh2 2026-10-09T13:21:00.124300-07:00 worker-12 nginx[1200]: 45.74.35.110 - sørensen "POST /api/v2/users HTTP/1.1" 200 38026 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:00.187862-07:00 api-07 sshd[7359]: Received disconnect from 45.233.228.64 port 1352:11: Bye Bye [preauth] 2026-10-09T13:21:00.341574-07:00 db-replica systemd[1]: Started Session 96158 of User deploy. 2026-10-09T13:21:00.374870-07:00 web-01 nginx[1207]: 192.38.106.218 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 62250 "-" "Go-http-client/1.1" 2026-10-09T13:21:00.470238-07:00 db-replica haproxy[936]: 203.32.154.36:22946 [82125] http-in app/cache-3 6797/0/867/867/6797 500 68128 - - ---- 318/318/85/85/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:21:00.760721-07:00 cache-3 nginx[1200]: 172.86.200.168 - - "GET /login HTTP/1.1" 404 79128 "-" "python-requests/2.32.3" 2026-10-09T13:21:00.891924-07:00 edge-fr-1 app[30302]: INFO request_id=5abe68a595037b4e method=GET path=/health status=204 duration=5271ms 2026-10-09T13:21:00.924470-07:00 web-01 nginx[1203]: 10.37.220.80 - - "GET /health HTTP/1.1" 500 14376 "-" "curl/8.4.0" 2026-10-09T13:21:01.090263-07:00 web-01 haproxy[931]: 10.115.224.221:35111 [23447] http-in app/edge-fr-1 653/0/419/419/653 301 84355 - - ---- 342/342/19/19/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:21:01.155738-07:00 web-03 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 45.54.64.1, server: app.example.com, request: "GET /static/main.css HTTP/1.1", upstream: "http://10.0.394.394:8080/static/main.css" 2026-10-09T13:21:01.276252-07:00 edge-fr-1 nginx[1207]: 203.91.89.160 - - "GET /api/v2/users HTTP/1.1" 502 59620 "-" "kube-probe/1.31" 2026-10-09T13:21:01.368232-07:00 worker-12 nginx[1201]: 10.32.163.83 - - "GET /static/main.css HTTP/1.1" 404 35268 "-" "Go-http-client/1.1" 2026-10-09T13:21:01.422103-07:00 cache-3 app[30369]: INFO request_id=918302bdcb572fcf method=GET path=/wp-login.php status=502 duration=9312ms 2026-10-09T13:21:01.444824-07:00 web-03 haproxy[900]: 91.10.71.11:46945 [37545] http-in app/edge-fr-1 8958/0/138/138/8958 302 21467 - - ---- 604/604/11/11/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:21:01.532042-07:00 worker-12 nginx[1202]: 203.193.7.58 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 47415 "-" "kube-probe/1.31" 2026-10-09T13:21:01.585337-07:00 db-replica haproxy[905]: 91.101.113.246:23432 [44761] http-in app/web-02 6709/0/137/137/6709 301 86938 - - ---- 205/205/74/74/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:01.605254-07:00 cache-3 app[30959]: INFO request_id=b07af2da3d70aab4 method=GET path=/favicon.ico status=401 duration=9952ms 2026-10-09T13:21:01.753275-07:00 worker-12 sshd[25278]: Connection closed by 192.109.79.36 port 13077 [preauth] 2026-10-09T13:21:01.917737-07:00 db-primary haproxy[946]: 203.189.100.110:17403 [19170] http-in app/web-02 4950/0/891/891/4950 200 80206 - - ---- 761/761/30/30/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:21:01.943449-07:00 web-02 app[30951]: INFO worker 65 picked job 9acd56e8bbca80bb from queue emails 2026-10-09T13:21:01.974831-07:00 db-replica sshd[13656]: Received disconnect from 45.33.223.147 port 32773:11: Bye Bye [preauth] 2026-10-09T13:21:01.990932-07:00 api-08 app[30205]: INFO request_id=139eb6422138920d method=GET path=/api/v2/orders status=200 duration=9750ms 2026-10-09T13:21:02.052919-07:00 web-02 app[30384]: INFO worker 90 finished job 27b27ca9c7f8af3c in 4046 ms 2026-10-09T13:21:02.456592-07:00 edge-fr-1 nginx[1204]: 45.9.57.106 - - "GET /login HTTP/1.1" 502 10126 "-" "curl/8.4.0" 2026-10-09T13:21:02.569016-07:00 worker-12 app[30976]: WARN retrying upstream 45.138.6.140:3402 after timeout (1412 ms), attempt 2 of 3 2026-10-09T13:21:02.692190-07:00 api-08 app[30899]: INFO request_id=36a3dfe4b6bf7063 method=GET path=/metrics status=502 duration=4914ms 2026-10-09T13:21:02.738999-07:00 worker-12 postgres[10185]: LOG: duration: 5500.174 ms statement: SELECT * FROM orders WHERE customer_id = 15938 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:02.771814-07:00 worker-12 app[30810]: WARN slow query (2256 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '76 minutes' 2026-10-09T13:21:02.965706-07:00 bastion nginx[1209]: 192.132.24.113 - - "GET /admin HTTP/1.1" 204 49783 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:03.051849-07:00 api-08 sshd[60847]: Failed password for invalid user priya from 45.61.106.81 port 39127 ssh2 2026-10-09T13:21:03.077439-07:00 api-07 sshd[25494]: Invalid user root from 192.214.158.142 port 23930 2026-10-09T13:21:03.087709-07:00 db-primary haproxy[937]: 172.6.182.57:19910 [72997] http-in app/edge-fr-1 4599/0/89/89/4599 200 22157 - - ---- 633/633/76/76/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:21:03.316290-07:00 api-07 app[30221]: INFO worker 92 picked job f14eb49fb6825269 from queue orders 2026-10-09T13:21:03.592769-07:00 edge-fr-1 app[30894]: INFO request_id=cdf4af794f9b84fe method=GET path=/api/v2/users status=302 duration=1987ms 2026-10-09T13:21:03.685335-07:00 web-02 sshd[62312]: Failed password for invalid user sørensen from 203.91.75.237 port 53760 ssh2 2026-10-09T13:21:03.695522-07:00 web-02 app[30972]: INFO request_id=3ee736bcd0d1ab8e method=GET path=/api/v2/orders/8841 status=204 duration=6055ms 2026-10-09T13:21:03.722505-07:00 web-02 haproxy[923]: 192.4.247.108:59525 [51553] http-in app/web-01 3567/0/867/867/3567 404 70811 - - ---- 753/753/24/24/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:21:04.060307-07:00 api-08 app[30094]: INFO worker 31 finished job bce69ef0e50a6de0 in 4473 ms 2026-10-09T13:21:04.082656-07:00 db-replica nginx[1208]: 91.254.224.150 - - "GET /.env HTTP/1.1" 200 82773 "-" "python-requests/2.32.3" 2026-10-09T13:21:04.967895-07:00 api-08 nginx[1202]: 192.163.216.13 - - "GET /favicon.ico HTTP/1.1" 302 65619 "-" "kube-probe/1.31" 2026-10-09T13:21:04.981056-07:00 db-primary app[30202]: INFO order 57247 confirmed for backup in 3077 ms (region us-east-1, queue emails) 2026-10-09T13:21:05.017134-07:00 web-01 sshd[26887]: Accepted publickey for backup from 45.147.16.134 port 63359 ssh2: ED25519 SHA256:ffd8ef463dcde090 2026-10-09T13:21:05.045609-07:00 edge-fr-1 nginx[1204]: 91.4.189.53 - - "GET /metrics HTTP/1.1" 200 54334 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:05.146933-07:00 db-primary app[30647]: INFO request_id=eea7d2ece9a926ca method=GET path=/static/app.js status=401 duration=7295ms 2026-10-09T13:21:05.204630-07:00 edge-fr-1 app[30909]: ERROR payment declined for order 81654: card_declined (code 40), customer notified 2026-10-09T13:21:05.240686-07:00 web-02 nginx[1207]: 172.128.138.187 - - "GET /wp-login.php HTTP/1.1" 200 76929 "-" "Go-http-client/1.1" 2026-10-09T13:21:05.266450-07:00 api-07 app[30975]: INFO request_id=9c5ba840ec4b69b3 method=GET path=/wp-login.php status=200 duration=6161ms 2026-10-09T13:21:05.457282-07:00 api-08 nginx[1208]: 91.186.189.2 - - "GET /static/app.js HTTP/1.1" 401 77830 "-" "curl/8.4.0" 2026-10-09T13:21:05.582453-07:00 edge-fr-1 app[30543]: INFO worker 27 picked job 25064d173c6c4d99 from queue invoices 2026-10-09T13:21:05.665508-07:00 api-08 sshd[2317]: Failed password for invalid user ci from 45.91.23.112 port 10575 ssh2 2026-10-09T13:21:05.687053-07:00 worker-12 postgres[6055]: LOG: duration: 315.124 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:06.069143-07:00 web-02 postgres[12924]: LOG: duration: 4920.727 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:06.281894-07:00 cache-3 nginx[1210]: 172.220.254.96 - - "GET /favicon.ico HTTP/1.1" 404 66392 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:06.295598-07:00 db-primary app[30967]: INFO worker 12 picked job ac25a5bf3d895ba2 from queue orders 2026-10-09T13:21:06.780323-07:00 edge-fr-1 postgres[5323]: LOG: duration: 1756.908 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:07.082285-07:00 web-03 nginx[1200]: 203.229.79.36 - - "GET /health HTTP/1.1" 200 38653 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:07.114195-07:00 bastion app[30939]: INFO worker 22 picked job f7235ecdc650c92f from queue webhooks 2026-10-09T13:21:07.204913-07:00 db-primary nginx[1207]: 45.30.101.219 - priya "POST /health HTTP/1.1" 204 43173 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:07.275092-07:00 web-03 app[30768]: INFO worker 36 picked job c3b7e63aba87c747 from queue webhooks 2026-10-09T13:21:07.303559-07:00 cache-3 postgres[23994]: LOG: duration: 9660.594 ms statement: SELECT * FROM orders WHERE customer_id = 36759 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:07.410482-07:00 api-08 app[30216]: INFO worker 10 finished job b6d9a785fee09036 in 951 ms 2026-10-09T13:21:07.503904-07:00 cache-3 sshd[12877]: Failed password for invalid user sørensen from 203.173.41.86 port 24410 ssh2 2026-10-09T13:21:07.655168-07:00 db-primary app[30685]: INFO request_id=0cbb123b6de47d6b method=GET path=/static/app.js status=502 duration=8262ms 2026-10-09T13:21:08.231433-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577268.420:65128): pid=65128 uid=0 auid=8092 ses=372 msg='op=login id=8092 exe="/usr/sbin/sshd" hostname=? addr=192.108.188.91 terminal=/dev/pts/0 res=success' 2026-10-09T13:21:08.309111-07:00 web-03 app[30729]: INFO worker 98 finished job 2679be2d2946fba5 in 9500 ms 2026-10-09T13:21:08.331107-07:00 bastion app[30586]: INFO worker 40 picked job 1d1fae44db23075c from queue webhooks 2026-10-09T13:21:08.592963-07:00 api-08 app[30587]: DEBUG cache hit ratio 70% over the last minute (84989 lookups) 2026-10-09T13:21:08.900615-07:00 db-replica sshd[11177]: Invalid user müller from 91.159.152.181 port 4677 2026-10-09T13:21:08.919347-07:00 api-07 haproxy[914]: 10.1.32.17:57468 [23632] http-in app/api-08 9284/0/400/400/9284 204 40502 - - ---- 320/320/19/19/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:21:09.000522-07:00 db-replica nginx[1203]: 45.189.150.68 - - "GET /static/app.js HTTP/1.1" 301 48119 "-" "Go-http-client/1.1" 2026-10-09T13:21:09.016633-07:00 web-02 sshd[21184]: Invalid user sørensen from 203.31.232.114 port 27802 2026-10-09T13:21:09.496328-07:00 cache-3 sshd[56139]: Accepted publickey for françois from 192.124.249.105 port 30052 ssh2: ED25519 SHA256:ff1c5c31dbfe8e51 2026-10-09T13:21:09.714119-07:00 web-03 app[30173]: INFO health check ok: db 290 ms, cache 290 ms, queue depth 74 2026-10-09T13:21:09.726953-07:00 db-primary app[30488]: INFO worker 60 finished job 871f1baac2b4ce39 in 7141 ms 2026-10-09T13:21:09.731290-07:00 cache-3 systemd[1]: Started Session 40371 of User deploy. 2026-10-09T13:21:09.796208-07:00 edge-fr-1 app[30579]: INFO worker 30 picked job 5b282df5b1119dba from queue invoices 2026-10-09T13:21:10.019693-07:00 cache-3 app[30533]: INFO health check ok: db 247 ms, cache 247 ms, queue depth 14 2026-10-09T13:21:10.068105-07:00 api-07 app[30331]: INFO worker 16 finished job 932eea457463c516 in 3348 ms 2026-10-09T13:21:10.108533-07:00 cache-3 systemd[1]: Started Session 37566 of User deploy. 2026-10-09T13:21:10.112095-07:00 edge-fr-1 app[30800]: INFO order 36100 confirmed for root in 3426 ms (region eu-west-1, queue orders) 2026-10-09T13:21:10.166819-07:00 bastion app[30399]: INFO request_id=f1909537edfe1654 method=GET path=/api/v2/orders status=301 duration=3378ms 2026-10-09T13:21:10.509308-07:00 worker-12 postgres[25121]: LOG: duration: 6967.329 ms statement: SELECT * FROM orders WHERE customer_id = 35136 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:10.525343-07:00 bastion app[30566]: INFO health check ok: db 511 ms, cache 511 ms, queue depth 19 2026-10-09T13:21:10.528988-07:00 edge-fr-1 app[30363]: INFO request_id=376b78792b65df8f method=GET path=/metrics status=200 duration=7428ms 2026-10-09T13:21:10.541512-07:00 cache-3 nginx[1208]: 192.222.18.34 - - "GET /.env HTTP/1.1" 200 22303 "-" "curl/8.4.0" 2026-10-09T13:21:10.739378-07:00 db-primary app[30328]: INFO request_id=619772563210c9fc method=GET path=/api/v2/users status=204 duration=6465ms 2026-10-09T13:21:10.849684-07:00 bastion nginx[1206]: 192.102.112.101 - - "GET /favicon.ico HTTP/1.1" 301 74717 "-" "python-requests/2.32.3" 2026-10-09T13:21:11.041830-07:00 web-01 nginx[1202]: 203.253.35.119 - - "GET /api/v2/users HTTP/1.1" 200 36715 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:11.044583-07:00 db-primary app[30614]: INFO request_id=441b43803357d8a5 method=GET path=/api/v2/users status=301 duration=8025ms 2026-10-09T13:21:11.099225-07:00 web-01 sshd[22533]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:21:11.267230-07:00 db-replica haproxy[948]: 45.230.57.144:57336 [57329] http-in app/web-03 3702/0/827/827/3702 404 24664 - - ---- 862/862/37/37/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:21:11.345694-07:00 cache-3 sshd[29375]: Accepted publickey for priya from 45.251.71.252 port 19763 ssh2: ED25519 SHA256:bc6ab5450f0f0ebb 2026-10-09T13:21:11.408781-07:00 bastion systemd[1]: session-21357.scope: Deactivated successfully. 2026-10-09T13:21:11.453895-07:00 bastion app[30788]: INFO request_id=84a56a3c11ac5bdf method=GET path=/static/main.css status=204 duration=4368ms 2026-10-09T13:21:11.613611-07:00 web-02 haproxy[907]: 91.48.108.158:1720 [18496] http-in app/api-08 9293/0/537/537/9293 404 77647 - - ---- 489/489/31/31/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:21:11.748253-07:00 web-02 app[30888]: INFO worker 81 finished job 74d57cae843f48a9 in 5529 ms 2026-10-09T13:21:11.815533-07:00 cache-3 haproxy[924]: 192.14.21.217:38081 [31961] http-in app/web-01 7946/0/45/45/7946 404 32841 - - ---- 961/961/73/73/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:21:11.898076-07:00 web-02 nginx[1209]: 172.2.222.118 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 23428 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:11.992542-07:00 web-01 app[30721]: INFO worker 79 finished job 9316bd4211e38131 in 1011 ms 2026-10-09T13:21:12.031993-07:00 web-03 app[30197]: INFO order 27600 confirmed for ci in 4756 ms (region eu-west-1, queue orders) 2026-10-09T13:21:12.041346-07:00 web-01 sshd[38173]: Failed password for invalid user akira from 203.238.157.77 port 7510 ssh2 2026-10-09T13:21:12.166447-07:00 api-07 postgres[17415]: LOG: duration: 7086.807 ms statement: SELECT * FROM orders WHERE customer_id = 99845 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:12.460006-07:00 api-08 haproxy[903]: 45.43.132.26:49808 [76434] http-in app/web-03 8764/0/280/280/8764 404 1989 - - ---- 469/469/46/46/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:21:12.565898-07:00 web-02 sshd[38775]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:21:12.635954-07:00 web-02 sshd[38119]: Received disconnect from 203.24.237.108 port 45526:11: Bye Bye [preauth] 2026-10-09T13:21:12.658578-07:00 web-02 app[30016]: INFO worker 53 picked job 05e99f7238579f4c from queue emails 2026-10-09T13:21:12.734458-07:00 api-08 haproxy[916]: 10.108.137.215:48960 [31244] http-in app/worker-12 256/0/947/947/256 301 27423 - - ---- 212/212/52/52/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:21:12.752639-07:00 cache-3 systemd[1]: Started Session 77449 of User zoë. 2026-10-09T13:21:13.155919-07:00 api-08 sshd[10086]: Connection closed by 203.89.237.114 port 12419 [preauth] 2026-10-09T13:21:13.164582-07:00 edge-fr-1 app[30785]: INFO order 31483 confirmed for müller in 9925 ms (region us-east-1, queue webhooks) 2026-10-09T13:21:13.205911-07:00 api-08 nginx[1203]: 45.129.156.65 - - "GET /static/app.js HTTP/1.1" 302 83488 "-" "Go-http-client/1.1" 2026-10-09T13:21:13.293120-07:00 api-07 sshd[43790]: pam_unix(sshd:session): session opened for user backup(uid=2530) by (uid=0) 2026-10-09T13:21:13.300485-07:00 worker-12 app[30675]: INFO order 10341 confirmed for françois in 1422 ms (region us-east-1, queue orders) 2026-10-09T13:21:13.677530-07:00 worker-12 sshd[40780]: Invalid user müller from 91.122.78.116 port 30820 2026-10-09T13:21:13.755589-07:00 api-08 app[30663]: INFO request_id=5aeef74bc288cbbe method=GET path=/static/main.css status=200 duration=974ms 2026-10-09T13:21:13.760149-07:00 web-01 haproxy[910]: 45.107.3.176:64071 [66566] http-in app/db-replica 2114/0/258/258/2114 204 25602 - - ---- 608/608/72/72/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:21:13.832106-07:00 cache-3 app[30630]: INFO request_id=cd11f7da4001d17b method=GET path=/api/v2/search?q=invoice status=204 duration=3429ms 2026-10-09T13:21:13.896618-07:00 db-primary nginx[1209]: 172.194.251.208 - - "GET /wp-login.php HTTP/1.1" 204 3834 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:14.057037-07:00 db-primary app[30184]: INFO order 44209 confirmed for zoë in 9156 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:21:14.449683-07:00 api-07 sshd[56406]: Invalid user backup from 203.183.153.143 port 9190 2026-10-09T13:21:14.604508-07:00 api-08 sshd[5108]: Accepted publickey for zoë from 45.61.82.23 port 28067 ssh2: ED25519 SHA256:6682ae04b8598b0a 2026-10-09T13:21:14.702438-07:00 bastion kernel: [76466.819531] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.147.145.248 DST=10.0.267.267 LEN=24 TOS=0x00 PREC=0x00 TTL=24 ID=76466 DF PROTO=TCP SPT=22127 DPT=22127 WINDOW=76466 RES=0x00 SYN URGP=0 2026-10-09T13:21:14.894212-07:00 cache-3 app[30566]: INFO request_id=e97f98c923bd3dde method=GET path=/static/app.js status=204 duration=808ms 2026-10-09T13:21:14.918492-07:00 edge-fr-1 app[30969]: INFO worker 18 finished job 56f2cec5bc278451 in 914 ms 2026-10-09T13:21:15.211430-07:00 web-01 app[30194]: INFO order 74690 confirmed for root in 7629 ms (region eu-west-1, queue webhooks) 2026-10-09T13:21:15.299211-07:00 worker-12 systemd[1]: Started Session 30959 of User root. 2026-10-09T13:21:15.419927-07:00 db-replica app[30695]: INFO worker 14 finished job 3dd99d0efae16389 in 8680 ms 2026-10-09T13:21:15.452200-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577275.49:94731): pid=94731 uid=0 auid=8088 ses=583 msg='op=login id=8088 exe="/usr/sbin/sshd" hostname=? addr=203.91.187.11 terminal=/dev/pts/0 res=success' 2026-10-09T13:21:15.544350-07:00 db-primary app[30959]: INFO request_id=da701e214ed39821 method=GET path=/api/v2/orders/8841 status=200 duration=5715ms 2026-10-09T13:21:15.796710-07:00 db-replica app[30836]: INFO request_id=6c832cce28dda6e7 method=GET path=/api/v2/orders/8841 status=401 duration=1816ms 2026-10-09T13:21:15.798975-07:00 bastion sshd[49058]: Invalid user zoë from 203.185.225.167 port 15289 2026-10-09T13:21:15.845343-07:00 web-01 nginx[1200]: 10.85.70.139 - - "GET /admin HTTP/1.1" 200 35987 "-" "kube-probe/1.31" 2026-10-09T13:21:15.944503-07:00 api-07 sshd[5143]: Received disconnect from 45.79.187.176 port 2624:11: Bye Bye [preauth] 2026-10-09T13:21:16.072957-07:00 web-03 kernel: [39996.286161] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.59.82.176 DST=10.0.940.940 LEN=40 TOS=0x00 PREC=0x00 TTL=40 ID=39996 DF PROTO=TCP SPT=51163 DPT=51163 WINDOW=39996 RES=0x00 SYN URGP=0 2026-10-09T13:21:16.148106-07:00 db-replica postgres[10847]: LOG: duration: 5790.48 ms statement: SELECT * FROM orders WHERE customer_id = 43010 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:16.205847-07:00 worker-12 nginx[1205]: 10.229.94.20 - root "POST /api/v2/orders HTTP/1.1" 200 5556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:16.263093-07:00 bastion kernel: [73102.469254] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.224.110.240 DST=10.0.166.166 LEN=30 TOS=0x00 PREC=0x00 TTL=30 ID=73102 DF PROTO=TCP SPT=25283 DPT=25283 WINDOW=73102 RES=0x00 SYN URGP=0 2026-10-09T13:21:16.378778-07:00 web-01 haproxy[926]: 45.82.126.156:20876 [65067] http-in app/bastion 3544/0/533/533/3544 500 230 - - ---- 225/225/17/17/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:21:16.470868-07:00 db-replica systemd[1]: session-56256.scope: Deactivated successfully. 2026-10-09T13:21:16.518228-07:00 db-replica sshd[54342]: Invalid user zoë from 172.107.193.198 port 63758 2026-10-09T13:21:16.781021-07:00 web-01 haproxy[914]: 203.167.164.47:1026 [59587] http-in app/bastion 9961/0/668/668/9961 200 89872 - - ---- 130/130/94/94/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:21:16.894829-07:00 worker-12 app[30795]: INFO request_id=c50e45fa300dfc28 method=GET path=/static/main.css status=404 duration=8671ms 2026-10-09T13:21:16.952983-07:00 api-07 app[30143]: INFO order 51054 confirmed for sørensen in 4256 ms (region eu-west-1, queue orders) 2026-10-09T13:21:17.000118-07:00 web-02 nginx[1210]: 91.242.160.34 - - "GET /static/main.css HTTP/1.1" 502 31814 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:17.055285-07:00 web-01 app[30176]: INFO worker 54 picked job c21d724b5cdf84e6 from queue invoices 2026-10-09T13:21:17.199716-07:00 db-replica haproxy[914]: 172.72.104.132:14798 [55031] http-in app/db-replica 9346/0/545/545/9346 200 60626 - - ---- 112/112/56/56/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:17.224405-07:00 db-replica app[30607]: INFO request_id=8f7a51ae030f49ca method=GET path=/wp-login.php status=200 duration=6670ms 2026-10-09T13:21:17.264174-07:00 db-primary app[30652]: INFO worker 65 finished job ccb1329a3b175fee in 3918 ms 2026-10-09T13:21:17.467297-07:00 worker-12 app[30663]: INFO order 63631 confirmed for ci in 3319 ms (region ap-northeast-1, queue emails) 2026-10-09T13:21:17.837919-07:00 web-03 sshd[7537]: Received disconnect from 10.88.193.229 port 8586:11: Bye Bye [preauth] 2026-10-09T13:21:18.157922-07:00 web-02 sshd[62863]: Received disconnect from 192.2.245.153 port 30395:11: Bye Bye [preauth] 2026-10-09T13:21:18.226350-07:00 cache-3 app[30649]: INFO worker 76 finished job a9d8e1c1c698e67e in 9533 ms 2026-10-09T13:21:18.615585-07:00 db-primary app[30148]: INFO worker 40 picked job c25c27f7e97031c1 from queue emails 2026-10-09T13:21:18.800923-07:00 bastion nginx[1202]: 203.106.114.4 - - "GET /health HTTP/1.1" 401 89493 "-" "curl/8.4.0" 2026-10-09T13:21:19.003337-07:00 web-02 app[31000]: INFO worker 32 finished job 45ad03fd157f1d9a in 6179 ms 2026-10-09T13:21:19.030128-07:00 bastion app[30870]: INFO request_id=b895ae1f03be7ae8 method=GET path=/api/v2/orders/8841 status=200 duration=4692ms 2026-10-09T13:21:19.068075-07:00 db-primary nginx[1201]: 192.67.44.241 - - "GET /api/v2/orders HTTP/1.1" 301 58645 "-" "curl/8.4.0" 2026-10-09T13:21:19.154612-07:00 edge-fr-1 app[30090]: INFO worker 39 picked job 7a2f4d515f3a9e9f from queue emails 2026-10-09T13:21:19.207623-07:00 db-primary nginx[1207]: 10.234.174.73 - akira "POST /health HTTP/1.1" 404 66197 "-" "curl/8.4.0" 2026-10-09T13:21:19.698467-07:00 api-07 app[30854]: INFO worker 15 finished job b011afd0cdd57622 in 6122 ms 2026-10-09T13:21:19.862034-07:00 api-08 app[30411]: INFO request_id=0df792d998919fb5 method=GET path=/static/main.css status=502 duration=6937ms 2026-10-09T13:21:19.979588-07:00 db-replica nginx[1206]: 172.164.151.56 - - "GET /api/v2/users HTTP/1.1" 500 67878 "-" "curl/8.4.0" 2026-10-09T13:21:20.257261-07:00 api-08 postgres[14998]: LOG: duration: 9584.646 ms statement: SELECT * FROM orders WHERE customer_id = 23298 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:20.427956-07:00 edge-fr-1 app[30504]: INFO request_id=e2f1b90f705e702b method=GET path=/admin status=204 duration=6198ms 2026-10-09T13:21:20.532791-07:00 api-08 kernel: [56978.956551] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.46.138.202 DST=10.0.644.644 LEN=17 TOS=0x00 PREC=0x00 TTL=17 ID=56978 DF PROTO=TCP SPT=61864 DPT=61864 WINDOW=56978 RES=0x00 SYN URGP=0 2026-10-09T13:21:20.546801-07:00 cache-3 app[30065]: WARN slow query (5368 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '86 minutes' 2026-10-09T13:21:20.558934-07:00 edge-fr-1 postgres[31948]: LOG: duration: 7174.961 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:20.619390-07:00 cache-3 kernel: [13443.215330] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.141.122.200 DST=10.0.610.610 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=13443 DF PROTO=TCP SPT=2411 DPT=2411 WINDOW=13443 RES=0x00 SYN URGP=0 2026-10-09T13:21:20.744368-07:00 api-07 sshd[6130]: Received disconnect from 172.0.220.162 port 2800:11: Bye Bye [preauth] 2026-10-09T13:21:20.946842-07:00 api-08 cron[4942]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:21:21.101557-07:00 edge-fr-1 nginx[1204]: 192.153.176.249 - deploy "POST /login HTTP/1.1" 200 76533 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:21.237678-07:00 web-03 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:21:21.260166-07:00 web-02 postgres[26002]: LOG: duration: 3745.960 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:21.405076-07:00 db-replica haproxy[907]: 203.89.119.37:26958 [51191] http-in app/worker-12 4202/0/271/271/4202 500 6022 - - ---- 256/256/45/45/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:21.483088-07:00 web-01 kernel: [89924.129939] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.195.181.163 DST=10.0.796.796 LEN=28 TOS=0x00 PREC=0x00 TTL=28 ID=89924 DF PROTO=TCP SPT=31520 DPT=31520 WINDOW=89924 RES=0x00 SYN URGP=0 2026-10-09T13:21:21.484707-07:00 web-03 nginx[1201]: 45.164.173.27 - - "GET /api/v2/users HTTP/1.1" 404 63216 "-" "python-requests/2.32.3" 2026-10-09T13:21:21.774003-07:00 web-03 app[30655]: INFO order 24396 confirmed for zoë in 1155 ms (region eu-west-1, queue orders) 2026-10-09T13:21:21.827522-07:00 db-replica postgres[17322]: LOG: duration: 3540.429 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:21.939880-07:00 web-03 nginx[1201]: 45.163.172.195 - - "GET /api/v2/users HTTP/1.1" 200 687 "-" "python-requests/2.32.3" 2026-10-09T13:21:22.151290-07:00 cache-3 app[30089]: INFO worker 32 picked job bb12617995dd4273 from queue webhooks 2026-10-09T13:21:22.162042-07:00 edge-fr-1 app[30328]: INFO order 81629 confirmed for müller in 5906 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:21:22.230990-07:00 worker-12 app[30504]: INFO worker 15 finished job 333e32d611b05094 in 9008 ms 2026-10-09T13:21:22.232170-07:00 cache-3 app[30238]: DEBUG cache hit ratio 60% over the last minute (38512 lookups) 2026-10-09T13:21:22.256191-07:00 api-08 app[30784]: INFO worker 99 finished job eb429f1ccd40f17d in 3331 ms 2026-10-09T13:21:22.453535-07:00 db-replica nginx[1201]: 10.155.139.116 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 30519 "-" "Go-http-client/1.1" 2026-10-09T13:21:22.640938-07:00 worker-12 app[30511]: INFO order 49097 confirmed for deploy in 2074 ms (region us-east-1, queue invoices) 2026-10-09T13:21:22.777857-07:00 web-01 nginx[1201]: 10.173.25.184 - - "GET /.env HTTP/1.1" 301 19298 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:22.962572-07:00 cache-3 app[30255]: INFO request_id=a9fb0b923d6f4c9d method=GET path=/metrics status=301 duration=8422ms 2026-10-09T13:21:23.308509-07:00 web-02 app[30372]: INFO request_id=11b5c4bfa4afaed6 method=GET path=/admin status=200 duration=4726ms 2026-10-09T13:21:23.377848-07:00 bastion app[30215]: INFO order 32000 confirmed for backup in 7473 ms (region eu-west-1, queue orders) 2026-10-09T13:21:23.600317-07:00 db-replica systemd[1]: session-68641.scope: Deactivated successfully. 2026-10-09T13:21:23.722824-07:00 worker-12 app[30984]: INFO health check ok: db 792 ms, cache 792 ms, queue depth 30 2026-10-09T13:21:23.773001-07:00 api-08 app[30754]: ERROR payment declined for order 16540: card_declined (code 56), customer notified 2026-10-09T13:21:24.180033-07:00 cache-3 sshd[7143]: Received disconnect from 192.151.77.52 port 11877:11: Bye Bye [preauth] 2026-10-09T13:21:24.275230-07:00 bastion kernel: [29647.259018] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.102.150.207 DST=10.0.453.453 LEN=79 TOS=0x00 PREC=0x00 TTL=79 ID=29647 DF PROTO=TCP SPT=46083 DPT=46083 WINDOW=29647 RES=0x00 SYN URGP=0 2026-10-09T13:21:24.389384-07:00 web-02 app[30753]: INFO worker 88 finished job 9b12e39fa9982822 in 8548 ms 2026-10-09T13:21:24.465522-07:00 edge-fr-1 postgres[28785]: LOG: duration: 1217.160 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:24.514814-07:00 web-03 app[30331]: INFO request_id=9cbb20343f57b8c1 method=GET path=/api/v2/users status=200 duration=851ms 2026-10-09T13:21:24.572280-07:00 web-02 systemd[1]: Started Session 89714 of User zoë. 2026-10-09T13:21:24.764688-07:00 bastion sshd[13522]: Received disconnect from 192.170.77.106 port 33362:11: Bye Bye [preauth] 2026-10-09T13:21:24.970091-07:00 bastion app[30717]: WARN slow query (4097 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '57 minutes' 2026-10-09T13:21:25.070826-07:00 bastion app[30946]: INFO request_id=792a14f36230b553 method=GET path=/metrics status=200 duration=3253ms 2026-10-09T13:21:25.188556-07:00 db-replica app[30723]: INFO worker 72 picked job f11e6927863117dd from queue emails 2026-10-09T13:21:25.211440-07:00 api-08 haproxy[923]: 203.196.141.119:24936 [27773] http-in app/web-02 9786/0/240/240/9786 200 52738 - - ---- 530/530/18/18/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:21:25.396233-07:00 edge-fr-1 app[30248]: INFO request_id=d6cc5b3db616b78f method=GET path=/favicon.ico status=500 duration=2574ms 2026-10-09T13:21:25.460811-07:00 web-03 nginx[1202]: 172.92.100.62 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 69367 "-" "kube-probe/1.31" 2026-10-09T13:21:25.669941-07:00 web-01 app[30568]: INFO worker 88 picked job 10083e0bc1d785e0 from queue emails 2026-10-09T13:21:25.730130-07:00 worker-12 sshd[28356]: Failed password for invalid user françois from 45.70.21.231 port 18007 ssh2 2026-10-09T13:21:25.774185-07:00 api-07 sshd[50177]: Connection closed by 10.69.47.137 port 15672 [preauth] 2026-10-09T13:21:26.049150-07:00 api-08 kernel: [48106.661580] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.62.38.75 DST=10.0.966.966 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=48106 DF PROTO=TCP SPT=23637 DPT=23637 WINDOW=48106 RES=0x00 SYN URGP=0 2026-10-09T13:21:26.064649-07:00 api-08 nginx[1206]: 10.127.115.187 - root "POST /static/app.js HTTP/1.1" 204 11642 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:26.091024-07:00 db-replica postgres[13342]: LOG: duration: 3129.148 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:26.109450-07:00 api-07 nginx[1208]: 203.208.204.60 - - "GET /favicon.ico HTTP/1.1" 200 55836 "-" "Go-http-client/1.1" 2026-10-09T13:21:26.143633-07:00 web-01 sshd[64062]: Invalid user müller from 172.220.70.225 port 36022 2026-10-09T13:21:26.177150-07:00 api-07 nginx[1200]: 203.199.89.236 - backup "POST /api/v2/orders/8841 HTTP/1.1" 200 88943 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:26.208075-07:00 web-02 postgres[11067]: LOG: duration: 6501.938 ms statement: SELECT * FROM orders WHERE customer_id = 31911 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:26.372635-07:00 bastion nginx[1207]: 45.66.101.172 - - "GET /api/v2/users HTTP/1.1" 404 68993 "-" "curl/8.4.0" 2026-10-09T13:21:26.464968-07:00 web-03 app[30509]: INFO worker 59 finished job 37d42741e3951137 in 6122 ms 2026-10-09T13:21:26.571478-07:00 db-primary systemd[1]: session-49340.scope: Deactivated successfully. 2026-10-09T13:21:26.599152-07:00 worker-12 systemd[1]: Started Session 35746 of User backup. 2026-10-09T13:21:26.627601-07:00 worker-12 postgres[27627]: LOG: duration: 4124.286 ms statement: SELECT * FROM orders WHERE customer_id = 99048 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:26.963496-07:00 edge-fr-1 nginx[1204]: 45.10.11.190 - - "GET /login HTTP/1.1" 404 25265 "-" "Go-http-client/1.1" 2026-10-09T13:21:27.035083-07:00 api-08 app[30493]: INFO order 19510 confirmed for ci in 6462 ms (region us-east-1, queue webhooks) 2026-10-09T13:21:27.080103-07:00 db-primary app[30904]: INFO health check ok: db 620 ms, cache 620 ms, queue depth 86 2026-10-09T13:21:27.087004-07:00 db-primary haproxy[904]: 172.53.46.170:18392 [22535] http-in app/cache-3 5158/0/960/960/5158 200 63478 - - ---- 211/211/78/78/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:21:27.184834-07:00 cache-3 postgres[31655]: LOG: duration: 5833.176 ms statement: SELECT * FROM orders WHERE customer_id = 92880 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:27.544916-07:00 web-02 haproxy[903]: 91.72.198.223:62414 [65406] http-in app/edge-fr-1 2928/0/185/185/2928 200 27904 - - ---- 428/428/14/14/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:21:27.675316-07:00 edge-fr-1 nginx[1206]: 203.46.165.35 - - "GET /api/v2/users HTTP/1.1" 301 16889 "-" "kube-probe/1.31" 2026-10-09T13:21:27.781285-07:00 web-03 nginx[1207]: 203.62.38.82 - sørensen "POST /api/v2/users HTTP/1.1" 200 16374 "-" "Go-http-client/1.1" 2026-10-09T13:21:27.880707-07:00 bastion sshd[18537]: pam_unix(sshd:session): session opened for user priya(uid=5342) by (uid=0) 2026-10-09T13:21:27.955659-07:00 web-03 app[30458]: INFO worker 71 finished job 922b03fffd1708ff in 1983 ms 2026-10-09T13:21:28.129395-07:00 db-primary haproxy[940]: 192.229.164.223:54191 [89965] http-in app/db-primary 6447/0/937/937/6447 301 60984 - - ---- 333/333/26/26/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:21:28.139065-07:00 cache-3 app[30013]: INFO health check ok: db 374 ms, cache 374 ms, queue depth 69 2026-10-09T13:21:28.147166-07:00 api-08 haproxy[913]: 91.17.139.94:11239 [56080] http-in app/web-03 6999/0/247/247/6999 500 58649 - - ---- 363/363/28/28/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:21:28.219465-07:00 cache-3 nginx[1209]: 192.105.7.194 - - "GET /favicon.ico HTTP/1.1" 301 22879 "-" "curl/8.4.0" 2026-10-09T13:21:28.227664-07:00 db-primary app[30404]: INFO worker 37 picked job ad502ba1233a6df9 from queue emails 2026-10-09T13:21:28.476289-07:00 cache-3 app[30106]: INFO worker 80 finished job c18ac01a4c3e6e59 in 5752 ms 2026-10-09T13:21:28.682035-07:00 worker-12 nginx[1209]: 45.37.83.212 - - "GET /wp-login.php HTTP/1.1" 204 71297 "-" "python-requests/2.32.3" 2026-10-09T13:21:28.712597-07:00 db-replica systemd[1]: session-45116.scope: Deactivated successfully. 2026-10-09T13:21:28.749206-07:00 worker-12 cron[31319]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:21:29.192322-07:00 web-01 haproxy[941]: 10.242.118.226:36587 [52942] http-in app/web-03 3455/0/514/514/3455 502 62474 - - ---- 929/929/79/79/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:29.239930-07:00 web-03 sshd[19726]: Invalid user müller from 192.103.51.141 port 11435 2026-10-09T13:21:29.248443-07:00 worker-12 nginx[1204]: 192.228.50.208 - - "GET /wp-login.php HTTP/1.1" 200 84920 "-" "python-requests/2.32.3" 2026-10-09T13:21:29.265539-07:00 db-replica sshd[4660]: Received disconnect from 10.191.240.251 port 65021:11: Bye Bye [preauth] 2026-10-09T13:21:29.368001-07:00 bastion app[30983]: INFO worker 81 picked job 20f66f281b4a11dd from queue webhooks 2026-10-09T13:21:29.390802-07:00 edge-fr-1 app[30688]: INFO health check ok: db 626 ms, cache 626 ms, queue depth 44 2026-10-09T13:21:29.572119-07:00 web-03 sshd[13295]: Failed password for invalid user müller from 10.101.80.164 port 61286 ssh2 2026-10-09T13:21:29.787215-07:00 api-07 app[30180]: INFO order 31332 confirmed for zoë in 1598 ms (region ap-northeast-1, queue emails) 2026-10-09T13:21:29.826481-07:00 web-01 sshd[19316]: Connection closed by 91.140.130.140 port 53789 [preauth] 2026-10-09T13:21:29.836504-07:00 web-01 sshd[3430]: Accepted publickey for deploy from 10.228.117.181 port 1767 ssh2: ED25519 SHA256:c16a08c8d38e8dd3 2026-10-09T13:21:29.865305-07:00 db-primary app[30241]: DEBUG cache hit ratio 43% over the last minute (59283 lookups) 2026-10-09T13:21:30.033990-07:00 api-08 app[30617]: INFO request_id=327f51131440df7f method=GET path=/wp-login.php status=200 duration=5057ms 2026-10-09T13:21:30.175673-07:00 worker-12 kernel: [67090.604121] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.96.85.150 DST=10.0.858.858 LEN=10 TOS=0x00 PREC=0x00 TTL=10 ID=67090 DF PROTO=TCP SPT=43030 DPT=43030 WINDOW=67090 RES=0x00 SYN URGP=0 2026-10-09T13:21:30.247705-07:00 api-07 nginx[1202]: 91.50.226.19 - - "GET /static/app.js HTTP/1.1" 204 28954 "-" "python-requests/2.32.3" 2026-10-09T13:21:30.435553-07:00 web-02 postgres[27156]: LOG: duration: 9765.565 ms statement: SELECT * FROM orders WHERE customer_id = 23796 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:30.477315-07:00 web-02 app[30160]: INFO health check ok: db 567 ms, cache 567 ms, queue depth 23 2026-10-09T13:21:30.483332-07:00 bastion systemd[1]: session-29124.scope: Deactivated successfully. 2026-10-09T13:21:30.717178-07:00 web-03 app[30367]: INFO worker 24 finished job 0ca410de294f5cec in 9257 ms 2026-10-09T13:21:30.793529-07:00 db-primary haproxy[916]: 203.9.205.252:62831 [12041] http-in app/web-03 7112/0/776/776/7112 200 23207 - - ---- 314/314/86/86/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:21:31.147493-07:00 edge-fr-1 postgres[13795]: LOG: duration: 2409.869 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:31.519575-07:00 worker-12 postgres[24179]: LOG: duration: 6062.130 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:31.731923-07:00 web-03 sshd[61608]: Failed password for invalid user deploy from 192.27.193.72 port 32745 ssh2 2026-10-09T13:21:31.924135-07:00 web-03 kernel: [29636.916903] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.155.85.116 DST=10.0.915.915 LEN=18 TOS=0x00 PREC=0x00 TTL=18 ID=29636 DF PROTO=TCP SPT=38002 DPT=38002 WINDOW=29636 RES=0x00 SYN URGP=0 2026-10-09T13:21:32.064761-07:00 web-02 haproxy[911]: 45.236.229.125:63141 [25125] http-in app/web-02 1204/0/863/863/1204 302 15644 - - ---- 738/738/48/48/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:32.264303-07:00 web-01 haproxy[948]: 10.150.219.65:46492 [68414] http-in app/api-07 5203/0/467/467/5203 200 8578 - - ---- 530/530/14/14/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:21:32.344031-07:00 web-03 sshd[7372]: Received disconnect from 10.201.234.247 port 17609:11: Bye Bye [preauth] 2026-10-09T13:21:32.434632-07:00 bastion postgres[24773]: LOG: duration: 7763.73 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:32.471192-07:00 db-primary haproxy[917]: 91.36.221.135:34797 [76857] http-in app/edge-fr-1 6963/0/716/716/6963 200 57130 - - ---- 410/410/57/57/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:21:32.833752-07:00 web-03 cron[58890]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:21:32.854755-07:00 edge-fr-1 postgres[11915]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 87002 remain, 8118 scanned (14% of total) 2026-10-09T13:21:32.933942-07:00 db-replica nginx[1200]: 10.62.28.118 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 60478 "-" "curl/8.4.0" 2026-10-09T13:21:32.978420-07:00 worker-12 nginx[1207]: 45.136.191.22 - - "GET /api/v2/orders HTTP/1.1" 302 24340 "-" "kube-probe/1.31" 2026-10-09T13:21:33.061647-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577293.257:44398): pid=44398 uid=0 auid=8515 ses=985 msg='op=login id=8515 exe="/usr/sbin/sshd" hostname=? addr=10.167.242.193 terminal=/dev/pts/0 res=success' 2026-10-09T13:21:33.091455-07:00 api-07 app[30325]: INFO request_id=af9bc04b4f904573 method=GET path=/api/v2/orders/8841 status=204 duration=3450ms 2026-10-09T13:21:33.175201-07:00 web-01 haproxy[903]: 91.121.205.232:25305 [91344] http-in app/web-01 2079/0/885/885/2079 404 86123 - - ---- 305/305/45/45/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:21:33.204721-07:00 db-replica postgres[5974]: LOG: duration: 2673.495 ms statement: SELECT * FROM orders WHERE customer_id = 16874 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:33.218086-07:00 bastion app[30309]: DEBUG cache hit ratio 52% over the last minute (63959 lookups) 2026-10-09T13:21:33.286902-07:00 edge-fr-1 sshd[57414]: pam_unix(sshd:session): session opened for user ci(uid=5792) by (uid=0) 2026-10-09T13:21:33.301181-07:00 api-07 kernel: [58146.269218] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.110.4.34 DST=10.0.625.625 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=58146 DF PROTO=TCP SPT=30127 DPT=30127 WINDOW=58146 RES=0x00 SYN URGP=0 2026-10-09T13:21:33.549564-07:00 worker-12 app[30912]: INFO order 21059 confirmed for root in 2066 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:21:33.678213-07:00 edge-fr-1 systemd[1]: Started Session 67102 of User ci. 2026-10-09T13:21:33.710637-07:00 bastion nginx[1207]: 192.164.12.251 - - "GET /metrics HTTP/1.1" 204 69649 "-" "curl/8.4.0" 2026-10-09T13:21:34.038005-07:00 bastion nginx[1202]: 91.128.39.234 - - "GET /api/v2/orders HTTP/1.1" 200 13921 "-" "Go-http-client/1.1" 2026-10-09T13:21:34.123323-07:00 db-replica app[30180]: INFO request_id=62a2dbf4e4d8152c method=GET path=/api/v2/users status=301 duration=5575ms 2026-10-09T13:21:34.169514-07:00 api-07 sshd[2322]: Invalid user sørensen from 203.169.248.197 port 4313 2026-10-09T13:21:34.369083-07:00 api-08 nginx[1203]: 10.164.58.123 - - "GET /static/main.css HTTP/1.1" 200 9349 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:34.444816-07:00 web-01 nginx[1200]: 91.231.171.57 - - "GET /login HTTP/1.1" 200 63268 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:34.511806-07:00 web-03 app[30878]: WARN retrying upstream 203.205.140.125:55135 after timeout (6207 ms), attempt 1 of 3 2026-10-09T13:21:34.661151-07:00 edge-fr-1 app[30281]: INFO order 75161 confirmed for deploy in 9161 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:21:34.686064-07:00 db-primary nginx[1200]: 192.64.239.131 - - "GET /api/v2/orders HTTP/1.1" 401 27950 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:34.753707-07:00 api-08 sshd[33230]: Accepted publickey for akira from 45.179.21.251 port 26687 ssh2: ED25519 SHA256:d3fa676052e7a2fd 2026-10-09T13:21:34.782131-07:00 db-replica app[30407]: INFO request_id=862d9fa945a86e28 method=GET path=/favicon.ico status=500 duration=5181ms 2026-10-09T13:21:34.878624-07:00 api-08 kubelet[800]: I1009 13:21:34.240537 5385 kubelet.go:5385] "Pod is terminating, skipping pod status update" pod="default/api-3ae6b629cf5a8d89" 2026-10-09T13:21:34.882924-07:00 edge-fr-1 nginx[1205]: 203.1.62.58 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 85441 "-" "curl/8.4.0" 2026-10-09T13:21:35.184627-07:00 web-03 app[30548]: INFO request_id=1377426ac878e7eb method=GET path=/api/v2/search?q=invoice status=500 duration=6024ms 2026-10-09T13:21:35.306563-07:00 edge-fr-1 nginx[1203]: 192.160.173.49 - backup "POST /static/app.js HTTP/1.1" 302 82674 "-" "python-requests/2.32.3" 2026-10-09T13:21:35.517924-07:00 bastion postgres[3224]: LOG: duration: 7251.367 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:35.570396-07:00 edge-fr-1 app[30573]: INFO worker 52 finished job 23dfefdb8cc01291 in 7670 ms 2026-10-09T13:21:35.621009-07:00 db-primary nginx[1200]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.78.172.25, server: app.example.com, request: "GET /api/v2/search?q=invoice HTTP/1.1", upstream: "http://10.0.414.414:8080/api/v2/search?q=invoice" 2026-10-09T13:21:35.794640-07:00 cache-3 postgres[2436]: LOG: duration: 4150.66 ms statement: SELECT * FROM orders WHERE customer_id = 99603 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:36.109563-07:00 edge-fr-1 app[30941]: INFO worker 13 finished job 6b724e3d67bbdecf in 9249 ms 2026-10-09T13:21:36.160419-07:00 web-02 nginx[1205]: 192.206.82.242 - - "GET /.env HTTP/1.1" 200 82471 "-" "python-requests/2.32.3" 2026-10-09T13:21:36.246735-07:00 web-03 haproxy[916]: 203.83.54.66:7404 [65226] http-in app/api-07 3359/0/253/253/3359 404 38049 - - ---- 659/659/68/68/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:21:36.321777-07:00 api-07 app[30268]: INFO order 41521 confirmed for akira in 3280 ms (region us-east-1, queue webhooks) 2026-10-09T13:21:36.346735-07:00 bastion systemd[1]: session-49994.scope: Deactivated successfully. 2026-10-09T13:21:36.541637-07:00 cache-3 systemd[1]: Started Session 74795 of User zoë. 2026-10-09T13:21:36.591076-07:00 web-03 app[30324]: WARN slow query (8087 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '24 minutes' 2026-10-09T13:21:36.613149-07:00 edge-fr-1 app[30203]: INFO worker 42 picked job 91da9b3249a90b1b from queue webhooks 2026-10-09T13:21:36.672217-07:00 db-replica app[30152]: INFO order 12114 confirmed for priya in 7385 ms (region us-east-1, queue webhooks) 2026-10-09T13:21:36.802972-07:00 worker-12 sshd[64600]: pam_unix(sshd:session): session opened for user sørensen(uid=6362) by (uid=0) 2026-10-09T13:21:36.969718-07:00 bastion sshd[17165]: Failed password for invalid user deploy from 203.4.179.39 port 1272 ssh2 2026-10-09T13:21:37.211905-07:00 worker-12 app[30092]: INFO request_id=e41a2a1fd6f0d6eb method=GET path=/health status=204 duration=1448ms 2026-10-09T13:21:37.260826-07:00 web-01 nginx[1200]: 10.175.149.193 - - "GET /api/v2/orders HTTP/1.1" 200 28369 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:37.510317-07:00 cache-3 app[30235]: INFO request_id=d1eb15df3a4c8224 method=GET path=/static/app.js status=200 duration=8819ms 2026-10-09T13:21:37.564846-07:00 web-01 nginx[1204]: 172.232.99.151 - - "GET /health HTTP/1.1" 301 21115 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:37.615112-07:00 api-07 app[30431]: INFO worker 25 finished job 594d998769ede6a8 in 8126 ms 2026-10-09T13:21:37.628924-07:00 bastion haproxy[920]: 45.209.74.164:47999 [47676] http-in app/cache-3 998/0/745/745/998 200 2612 - - ---- 392/392/12/12/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:21:37.633913-07:00 cache-3 app[30890]: INFO order 13094 confirmed for sørensen in 5953 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:21:37.934771-07:00 db-replica app[30560]: INFO request_id=a97b2d75dd2e3e3f method=GET path=/health status=204 duration=3164ms 2026-10-09T13:21:37.997989-07:00 edge-fr-1 app[30344]: INFO order 80594 confirmed for ci in 7080 ms (region ap-northeast-1, queue emails) 2026-10-09T13:21:38.298392-07:00 edge-fr-1 haproxy[933]: 10.12.51.56:34728 [90632] http-in app/api-07 4180/0/327/327/4180 200 82937 - - ---- 475/475/35/35/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:21:38.351559-07:00 web-03 nginx[1201]: 10.107.170.196 - - "GET /login HTTP/1.1" 200 67802 "-" "kube-probe/1.31" 2026-10-09T13:21:38.422132-07:00 api-08 app[30003]: INFO request_id=e09bb6b29cc8f991 method=GET path=/metrics status=302 duration=371ms 2026-10-09T13:21:38.664117-07:00 db-primary kernel: [56481.640864] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.126.193.140 DST=10.0.124.124 LEN=97 TOS=0x00 PREC=0x00 TTL=97 ID=56481 DF PROTO=TCP SPT=39369 DPT=39369 WINDOW=56481 RES=0x00 SYN URGP=0 2026-10-09T13:21:38.969872-07:00 worker-12 app[30593]: INFO worker 38 picked job d1d0cd4eb95f408d from queue webhooks 2026-10-09T13:21:39.066236-07:00 api-07 app[30890]: INFO health check ok: db 997 ms, cache 997 ms, queue depth 58 2026-10-09T13:21:39.091046-07:00 api-07 haproxy[909]: 91.184.27.136:55884 [65711] http-in app/api-08 5048/0/536/536/5048 401 62216 - - ---- 220/220/25/25/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:39.123172-07:00 api-08 systemd[1]: session-27876.scope: Deactivated successfully. 2026-10-09T13:21:39.200391-07:00 bastion postgres[14339]: LOG: duration: 6325.140 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:39.559144-07:00 web-03 systemd[1]: Started Session 10779 of User françois. 2026-10-09T13:21:39.832543-07:00 web-01 app[30245]: INFO worker 93 picked job 5fb80b6d290d4dea from queue webhooks 2026-10-09T13:21:39.932563-07:00 worker-12 app[30843]: WARN retrying upstream 45.175.181.177:2154 after timeout (2887 ms), attempt 2 of 3 2026-10-09T13:21:40.095004-07:00 db-replica kernel: [70637.780594] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.44.165.103 DST=10.0.309.309 LEN=54 TOS=0x00 PREC=0x00 TTL=54 ID=70637 DF PROTO=TCP SPT=32998 DPT=32998 WINDOW=70637 RES=0x00 SYN URGP=0 2026-10-09T13:21:40.235289-07:00 db-replica nginx[1202]: 192.133.243.8 - - "GET /metrics HTTP/1.1" 404 26493 "-" "kube-probe/1.31" 2026-10-09T13:21:40.530169-07:00 web-01 app[30480]: INFO request_id=7c78d451c6e681a6 method=GET path=/metrics status=301 duration=3232ms 2026-10-09T13:21:40.775049-07:00 worker-12 kernel: [58658.846951] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.197.145.89 DST=10.0.474.474 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=58658 DF PROTO=TCP SPT=7996 DPT=7996 WINDOW=58658 RES=0x00 SYN URGP=0 2026-10-09T13:21:40.908537-07:00 api-08 nginx[1201]: 203.123.190.154 - - "GET /api/v2/orders HTTP/1.1" 200 71446 "-" "python-requests/2.32.3" 2026-10-09T13:21:40.923110-07:00 api-07 nginx[1210]: 203.46.252.223 - - "GET /static/app.js HTTP/1.1" 200 52420 "-" "kube-probe/1.31" 2026-10-09T13:21:41.028925-07:00 web-01 sshd[49840]: Accepted publickey for priya from 45.32.3.249 port 19020 ssh2: ED25519 SHA256:a7c0abfb7aba6321 2026-10-09T13:21:41.066532-07:00 db-primary postgres[31521]: LOG: duration: 9805.865 ms statement: SELECT * FROM orders WHERE customer_id = 90591 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:41.095307-07:00 api-07 sshd[28672]: Received disconnect from 192.176.69.67 port 41221:11: Bye Bye [preauth] 2026-10-09T13:21:41.320455-07:00 db-replica app[30328]: INFO worker 67 picked job 6fe6e52e540ad63a from queue emails 2026-10-09T13:21:41.927706-07:00 web-02 haproxy[937]: 172.153.117.42:44750 [43179] http-in app/db-replica 484/0/738/738/484 404 54459 - - ---- 756/756/86/86/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:21:42.203721-07:00 web-01 nginx[1200]: 10.240.115.196 - - "GET /health HTTP/1.1" 302 73665 "-" "kube-probe/1.31" 2026-10-09T13:21:42.229517-07:00 edge-fr-1 sshd[35160]: Accepted publickey for sørensen from 91.180.246.150 port 25897 ssh2: ED25519 SHA256:c46586c13e8db84d 2026-10-09T13:21:42.447872-07:00 web-03 nginx[1203]: 172.96.178.202 - - "GET /favicon.ico HTTP/1.1" 200 13510 "-" "python-requests/2.32.3" 2026-10-09T13:21:42.556868-07:00 api-08 app[30815]: INFO worker 70 finished job 087868198467bba3 in 3494 ms 2026-10-09T13:21:42.900949-07:00 edge-fr-1 haproxy[929]: 203.43.91.205:6852 [66501] http-in app/db-primary 3211/0/201/201/3211 502 8715 - - ---- 937/937/14/14/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:21:42.936261-07:00 edge-fr-1 app[30432]: WARN retrying upstream 203.32.200.251:4429 after timeout (5225 ms), attempt 3 of 3 2026-10-09T13:21:42.948258-07:00 api-08 app[30660]: INFO request_id=03f5e584b7178b70 method=GET path=/admin status=502 duration=1305ms 2026-10-09T13:21:43.004866-07:00 db-primary sshd[36124]: pam_unix(sshd:session): session opened for user zoë(uid=8716) by (uid=0) 2026-10-09T13:21:43.007351-07:00 worker-12 haproxy[932]: 10.147.27.224:7118 [84949] http-in app/edge-fr-1 5543/0/665/665/5543 404 2703 - - ---- 858/858/27/27/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:43.087129-07:00 web-02 postgres[8945]: LOG: duration: 8087.706 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:43.383518-07:00 worker-12 postgres[7145]: LOG: duration: 2199.270 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:43.406350-07:00 cache-3 app[30891]: INFO request_id=65f60dad83790740 method=GET path=/api/v2/search?q=invoice status=401 duration=8410ms 2026-10-09T13:21:43.457980-07:00 db-primary nginx[1202]: 172.181.202.107 - - "GET /health HTTP/1.1" 502 24159 "-" "kube-probe/1.31" 2026-10-09T13:21:43.773340-07:00 worker-12 systemd[1]: Started Session 41167 of User backup. 2026-10-09T13:21:43.868152-07:00 worker-12 sshd[62076]: Connection closed by 172.0.101.40 port 8204 [preauth] 2026-10-09T13:21:43.881105-07:00 api-07 app[30266]: INFO worker 72 finished job 31d70829b856fb34 in 3273 ms 2026-10-09T13:21:44.225461-07:00 web-01 sshd[18575]: Received disconnect from 45.151.247.67 port 11604:11: Bye Bye [preauth] 2026-10-09T13:21:44.284596-07:00 db-replica app[30476]: INFO order 80348 confirmed for backup in 8607 ms (region us-east-1, queue invoices) 2026-10-09T13:21:44.300781-07:00 db-primary haproxy[916]: 91.250.255.126:53406 [71602] http-in app/db-primary 5119/0/118/118/5119 204 82456 - - ---- 271/271/42/42/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:21:44.446978-07:00 edge-fr-1 postgres[22466]: LOG: checkpoint complete: wrote 9714 buffers (89%); 0 WAL file(s) added, 0 removed, 72 recycled; write=8101.856 s, sync=0.856 s, total=8101.856 s 2026-10-09T13:21:44.530681-07:00 bastion app[30222]: INFO worker 66 picked job 5ddae94c8b87cf6e from queue emails 2026-10-09T13:21:44.608712-07:00 web-02 nginx[1203]: 10.76.211.69 - ci "POST /login HTTP/1.1" 500 56815 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:45.096075-07:00 bastion app[30294]: INFO worker 90 picked job f3366563e2e1fc56 from queue orders 2026-10-09T13:21:45.137234-07:00 web-01 app[30081]: INFO request_id=906dba1ca70c00ca method=GET path=/login status=200 duration=980ms 2026-10-09T13:21:45.379042-07:00 api-07 app[30649]: INFO worker 13 picked job 42b6cad5e60ddbe5 from queue invoices 2026-10-09T13:21:45.404171-07:00 web-01 sshd[27285]: Invalid user priya from 91.147.89.204 port 49227 2026-10-09T13:21:45.517370-07:00 cache-3 app[30702]: INFO request_id=9462a8ed254650e9 method=GET path=/metrics status=502 duration=5161ms 2026-10-09T13:21:45.621393-07:00 db-replica cron[7900]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:21:45.794337-07:00 cache-3 app[30701]: INFO order 65354 confirmed for akira in 2273 ms (region ap-northeast-1, queue emails) 2026-10-09T13:21:45.809578-07:00 edge-fr-1 haproxy[942]: 10.89.179.222:41330 [56128] http-in app/web-02 249/0/332/332/249 301 16610 - - ---- 261/261/97/97/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:21:45.880300-07:00 edge-fr-1 app[30715]: INFO request_id=a2044e9d9bff9bdb method=GET path=/api/v2/users status=200 duration=8780ms 2026-10-09T13:21:46.022657-07:00 web-01 sshd[17283]: Received disconnect from 10.186.196.47 port 50003:11: Bye Bye [preauth] 2026-10-09T13:21:46.083353-07:00 bastion nginx[1208]: 10.147.144.171 - - "GET /login HTTP/1.1" 200 24657 "-" "curl/8.4.0" 2026-10-09T13:21:46.196363-07:00 bastion sshd[33214]: Accepted publickey for priya from 192.89.121.49 port 57394 ssh2: ED25519 SHA256:2c2e00714d71a3d9 2026-10-09T13:21:46.510755-07:00 cache-3 sshd[57854]: Accepted publickey for deploy from 10.91.159.38 port 5538 ssh2: ED25519 SHA256:c794399641fcd1df 2026-10-09T13:21:46.714641-07:00 db-primary sshd[29869]: Connection closed by 203.207.14.12 port 12853 [preauth] 2026-10-09T13:21:46.730508-07:00 edge-fr-1 app[30355]: INFO worker 59 finished job 16ec2e408dc1de04 in 707 ms 2026-10-09T13:21:46.844346-07:00 db-primary nginx[1201]: 91.124.189.248 - - "GET /login HTTP/1.1" 401 70299 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:46.899193-07:00 web-01 nginx[1205]: 172.166.112.58 - françois "POST /.env HTTP/1.1" 500 89768 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:21:46.936305-07:00 api-08 nginx[1202]: 192.27.125.52 - - "GET /health HTTP/1.1" 200 77362 "-" "curl/8.4.0" 2026-10-09T13:21:46.962890-07:00 db-replica sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:21:47.067062-07:00 bastion app[30468]: INFO worker 95 picked job e654c0103e6ad95f from queue webhooks 2026-10-09T13:21:47.096714-07:00 web-01 app[30227]: INFO worker 95 picked job c1a2c5cf0656423d from queue orders 2026-10-09T13:21:47.272856-07:00 api-08 nginx[1205]: 203.141.16.201 - - "GET /favicon.ico HTTP/1.1" 302 33550 "-" "Go-http-client/1.1" 2026-10-09T13:21:47.277709-07:00 edge-fr-1 app[30988]: INFO order 47766 confirmed for müller in 1205 ms (region ap-northeast-1, queue orders) 2026-10-09T13:21:47.325884-07:00 edge-fr-1 postgres[14775]: LOG: duration: 708.890 ms statement: SELECT * FROM orders WHERE customer_id = 63760 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:47.354009-07:00 edge-fr-1 kernel: [35509.824727] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.170.252.97 DST=10.0.283.283 LEN=13 TOS=0x00 PREC=0x00 TTL=13 ID=35509 DF PROTO=TCP SPT=60146 DPT=60146 WINDOW=35509 RES=0x00 SYN URGP=0 2026-10-09T13:21:47.361522-07:00 worker-12 app[30689]: INFO request_id=e4ca1d5b3dd195a7 method=GET path=/api/v2/orders/8841 status=404 duration=8848ms 2026-10-09T13:21:47.368061-07:00 db-replica app[30897]: INFO health check ok: db 353 ms, cache 353 ms, queue depth 27 2026-10-09T13:21:47.460020-07:00 api-07 app[30954]: INFO request_id=e1fa1e85690b8009 method=GET path=/static/main.css status=301 duration=9744ms 2026-10-09T13:21:47.498627-07:00 cache-3 postgres[13338]: LOG: duration: 2797.691 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:47.780176-07:00 db-replica app[30211]: INFO health check ok: db 157 ms, cache 157 ms, queue depth 94 2026-10-09T13:21:48.123335-07:00 web-01 app[30508]: INFO worker 51 finished job a2c2e67ea8c2fe33 in 6272 ms 2026-10-09T13:21:48.162083-07:00 edge-fr-1 nginx[1210]: 192.8.123.21 - - "GET /static/app.js HTTP/1.1" 200 6963 "-" "curl/8.4.0" 2026-10-09T13:21:48.372452-07:00 api-07 sshd[15660]: Connection closed by 192.66.161.194 port 57070 [preauth] 2026-10-09T13:21:48.401824-07:00 worker-12 sshd[2863]: Received disconnect from 172.114.91.86 port 1967:11: Bye Bye [preauth] 2026-10-09T13:21:48.467372-07:00 web-03 app[30095]: ERROR payment declined for order 89324: card_declined (code 31), customer notified 2026-10-09T13:21:48.510119-07:00 bastion cron[36553]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:21:48.616074-07:00 web-01 nginx[1210]: 192.133.244.120 - deploy "POST /api/v2/orders HTTP/1.1" 301 8047 "-" "python-requests/2.32.3" 2026-10-09T13:21:48.669551-07:00 bastion app[30080]: INFO request_id=14b0122f470d1450 method=GET path=/admin status=404 duration=5813ms 2026-10-09T13:21:49.012839-07:00 api-08 sshd[28080]: pam_unix(sshd:session): session opened for user sørensen(uid=3667) by (uid=0) 2026-10-09T13:21:49.451594-07:00 edge-fr-1 sshd[20630]: Accepted publickey for backup from 203.231.174.240 port 29341 ssh2: ED25519 SHA256:26d29561df11f55e 2026-10-09T13:21:49.479255-07:00 api-07 dockerd[700]: time="2026-10-09T13:21:49.479255-07:00" level=warning msg="Health check for container 45a462449f532668 error: context deadline exceeded" 2026-10-09T13:21:49.693957-07:00 api-07 app[30068]: INFO order 54710 confirmed for ci in 9238 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:21:49.832117-07:00 edge-fr-1 sshd[12237]: pam_unix(sshd:session): session opened for user müller(uid=8683) by (uid=0) 2026-10-09T13:21:50.004275-07:00 web-03 app[30528]: INFO worker 76 finished job e691f2f74bbaab3b in 47 ms 2026-10-09T13:21:50.005053-07:00 web-01 nginx[1209]: 172.19.117.16 - - "GET /static/main.css HTTP/1.1" 404 25131 "-" "kube-probe/1.31" 2026-10-09T13:21:50.025430-07:00 web-01 app[30116]: INFO request_id=8cfe8d518abd5cef method=GET path=/metrics status=500 duration=6715ms 2026-10-09T13:21:50.306290-07:00 cache-3 app[30890]: INFO worker 45 finished job 9c6d9b32ae3fba78 in 1437 ms 2026-10-09T13:21:50.312964-07:00 api-08 systemd[1]: session-26610.scope: Deactivated successfully. 2026-10-09T13:21:50.538494-07:00 web-02 postgres[7589]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 69508 remain, 4146 scanned (55% of total) 2026-10-09T13:21:50.741567-07:00 web-01 nginx[1208]: 203.108.242.122 - - "GET /.env HTTP/1.1" 200 15068 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:50.841652-07:00 bastion postgres[13624]: LOG: duration: 552.656 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:21:50.853791-07:00 web-01 app[30773]: INFO worker 38 picked job 064ac79bef80d8c3 from queue webhooks 2026-10-09T13:21:50.920195-07:00 web-01 nginx[1201]: 172.148.71.35 - - "GET /.env HTTP/1.1" 200 64627 "-" "Go-http-client/1.1" 2026-10-09T13:21:51.081506-07:00 cache-3 sshd[17091]: Accepted publickey for françois from 91.159.123.147 port 44650 ssh2: ED25519 SHA256:a7a33b9e3f4c51d0 2026-10-09T13:21:51.262707-07:00 db-primary app[30930]: DEBUG cache hit ratio 21% over the last minute (90846 lookups) 2026-10-09T13:21:51.432867-07:00 api-08 app[30666]: INFO worker 56 finished job 8487af37c579fb21 in 3165 ms 2026-10-09T13:21:51.559768-07:00 web-02 nginx[1208]: 172.176.27.30 - - "GET /health HTTP/1.1" 500 25074 "-" "curl/8.4.0" 2026-10-09T13:21:51.885856-07:00 db-primary haproxy[931]: 91.239.132.224:50200 [65785] http-in app/edge-fr-1 130/0/743/743/130 502 56904 - - ---- 100/100/90/90/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:21:51.919083-07:00 api-08 sshd[6994]: pam_unix(sshd:session): session opened for user zoë(uid=7324) by (uid=0) 2026-10-09T13:21:51.958918-07:00 cache-3 sshd[11493]: Invalid user priya from 91.115.208.54 port 21662 2026-10-09T13:21:52.023137-07:00 bastion app[30710]: INFO request_id=14ec811cb3e85b58 method=GET path=/api/v2/orders status=200 duration=5236ms 2026-10-09T13:21:52.102775-07:00 api-07 app[30045]: INFO request_id=9be01b93527f54d0 method=GET path=/api/v2/orders/8841 status=204 duration=3239ms 2026-10-09T13:21:52.122971-07:00 db-primary sshd[53204]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:21:52.169042-07:00 web-01 sshd[3376]: Accepted publickey for sørensen from 45.83.65.247 port 49497 ssh2: ED25519 SHA256:6a2da27d11a5a679 2026-10-09T13:21:52.350492-07:00 edge-fr-1 postgres[6732]: LOG: duration: 6154.506 ms statement: SELECT * FROM orders WHERE customer_id = 62624 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:52.381709-07:00 edge-fr-1 app[30452]: INFO request_id=fd036589bf24af93 method=GET path=/login status=500 duration=5038ms 2026-10-09T13:21:52.410406-07:00 db-primary app[30816]: INFO worker 71 finished job 33a56156ace5e8da in 2024 ms 2026-10-09T13:21:52.587611-07:00 web-01 app[30467]: INFO request_id=e6bbf7746e99c050 method=GET path=/.env status=404 duration=7538ms 2026-10-09T13:21:52.668003-07:00 api-07 app[30279]: INFO request_id=50140f5773a20391 method=GET path=/api/v2/search?q=invoice status=200 duration=9090ms 2026-10-09T13:21:52.850846-07:00 db-primary nginx[1200]: 45.178.12.190 - - "GET /.env HTTP/1.1" 301 764 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:52.851942-07:00 api-07 nginx[1205]: 192.162.9.110 - - "GET /.env HTTP/1.1" 204 12327 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:52.982645-07:00 web-01 sshd[811]: Failed password for invalid user backup from 45.139.232.228 port 26447 ssh2 2026-10-09T13:21:53.230488-07:00 worker-12 cron[19297]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:21:53.302794-07:00 web-01 app[30601]: INFO request_id=c0413ea04d280a1b method=GET path=/health status=401 duration=44ms 2026-10-09T13:21:53.377332-07:00 web-02 postgres[19134]: LOG: duration: 9992.618 ms statement: SELECT * FROM orders WHERE customer_id = 56983 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:21:53.542036-07:00 edge-fr-1 sudo: ci : TTY=pts/0 ; PWD=/home/ci ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:21:53.625311-07:00 cache-3 app[30355]: INFO worker 53 finished job 6bd42debff11119b in 1065 ms 2026-10-09T13:21:53.857762-07:00 edge-fr-1 systemd[1]: Started Session 61612 of User deploy. 2026-10-09T13:21:53.895883-07:00 edge-fr-1 haproxy[933]: 91.114.157.10:18585 [70505] http-in app/bastion 8494/0/84/84/8494 200 19487 - - ---- 253/253/84/84/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:21:54.036289-07:00 db-primary nginx[1210]: 91.215.104.224 - - "GET /api/v2/users HTTP/1.1" 404 38043 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:54.207382-07:00 db-primary sshd[31780]: Received disconnect from 10.157.5.136 port 38505:11: Bye Bye [preauth] 2026-10-09T13:21:54.460619-07:00 web-03 haproxy[912]: 45.251.165.38:8231 [43570] http-in app/web-01 8474/0/537/537/8474 200 8745 - - ---- 965/965/30/30/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:21:54.497254-07:00 web-03 sshd[38421]: Connection closed by 45.99.100.241 port 45023 [preauth] 2026-10-09T13:21:54.854835-07:00 cache-3 postgres[29106]: LOG: checkpoint complete: wrote 7859 buffers (39%); 0 WAL file(s) added, 0 removed, 27 recycled; write=8398.652 s, sync=0.652 s, total=8398.652 s 2026-10-09T13:21:55.080798-07:00 edge-fr-1 kernel: [75066.043043] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.127.207.219 DST=10.0.902.902 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=75066 DF PROTO=TCP SPT=31592 DPT=31592 WINDOW=75066 RES=0x00 SYN URGP=0 2026-10-09T13:21:55.178580-07:00 web-02 sshd[11095]: pam_unix(sshd:session): session opened for user ci(uid=7041) by (uid=0) 2026-10-09T13:21:55.852445-07:00 edge-fr-1 app[30096]: INFO worker 83 picked job e443fafb4a3ec3cf from queue invoices 2026-10-09T13:21:56.050261-07:00 edge-fr-1 kernel: [81369.119368] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.6.83.127 DST=10.0.248.248 LEN=38 TOS=0x00 PREC=0x00 TTL=38 ID=81369 DF PROTO=TCP SPT=11480 DPT=11480 WINDOW=81369 RES=0x00 SYN URGP=0 2026-10-09T13:21:56.310678-07:00 bastion haproxy[935]: 45.148.236.91:61002 [55914] http-in app/worker-12 6788/0/177/177/6788 200 13774 - - ---- 908/908/82/82/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:21:56.313467-07:00 api-07 systemd[1]: session-61991.scope: Deactivated successfully. 2026-10-09T13:21:56.702488-07:00 api-08 app[30444]: INFO health check ok: db 29 ms, cache 29 ms, queue depth 35 2026-10-09T13:21:56.771377-07:00 bastion haproxy[913]: 91.211.187.179:11711 [13055] http-in app/api-07 711/0/701/701/711 204 5881 - - ---- 863/863/28/28/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:21:56.908380-07:00 cache-3 app[30094]: INFO order 51962 confirmed for ci in 1957 ms (region us-east-1, queue invoices) 2026-10-09T13:21:57.004474-07:00 web-02 app[30953]: INFO order 84140 confirmed for sørensen in 264 ms (region eu-west-1, queue orders) 2026-10-09T13:21:57.034734-07:00 db-primary nginx[1207]: 10.113.94.174 - - "GET /admin HTTP/1.1" 404 19504 "-" "python-requests/2.32.3" 2026-10-09T13:21:57.082351-07:00 cache-3 sshd[19759]: Connection closed by 172.116.121.86 port 20506 [preauth] 2026-10-09T13:21:57.212706-07:00 api-08 sshd[57486]: Failed password for invalid user backup from 172.189.105.63 port 26221 ssh2 2026-10-09T13:21:57.242498-07:00 bastion nginx[1207]: 172.209.67.98 - - "GET /.env HTTP/1.1" 404 70671 "-" "curl/8.4.0" 2026-10-09T13:21:57.574496-07:00 web-02 nginx[1202]: 172.66.94.45 - - "GET /metrics HTTP/1.1" 200 65215 "-" "Go-http-client/1.1" 2026-10-09T13:21:57.714946-07:00 db-replica systemd[1]: session-59484.scope: Deactivated successfully. 2026-10-09T13:21:58.295724-07:00 web-02 nginx[1200]: 172.187.67.107 - - "GET /health HTTP/1.1" 200 45634 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:21:58.302256-07:00 web-03 app[30357]: INFO request_id=bd131e9a88f33d8f method=GET path=/wp-login.php status=502 duration=1870ms 2026-10-09T13:21:58.553661-07:00 cache-3 haproxy[928]: 10.74.120.218:23989 [43983] http-in app/db-replica 701/0/191/191/701 200 88012 - - ---- 499/499/66/66/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:21:58.632679-07:00 db-replica app[30892]: INFO request_id=e9c7501c8c50970e method=GET path=/static/app.js status=200 duration=4855ms 2026-10-09T13:21:58.779715-07:00 db-primary app[30342]: INFO worker 49 finished job 5293e5d0569cfd8d in 9095 ms 2026-10-09T13:21:58.902152-07:00 worker-12 nginx[1202]: 192.128.156.125 - deploy "POST /api/v2/users HTTP/1.1" 404 19363 "-" "Go-http-client/1.1" 2026-10-09T13:21:58.998093-07:00 web-02 app[30670]: INFO health check ok: db 428 ms, cache 428 ms, queue depth 91 2026-10-09T13:21:59.130457-07:00 bastion systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:21:59.271648-07:00 web-03 app[30749]: INFO request_id=fa39a196e2c99c46 method=GET path=/admin status=200 duration=1823ms 2026-10-09T13:21:59.347677-07:00 worker-12 app[30982]: INFO worker 83 finished job 19f42bdbb9671346 in 5189 ms 2026-10-09T13:21:59.432939-07:00 worker-12 nginx[1201]: 10.130.39.155 - - "GET /api/v2/orders HTTP/1.1" 301 4175 "-" "curl/8.4.0" 2026-10-09T13:21:59.435688-07:00 edge-fr-1 haproxy[924]: 45.232.231.28:22526 [79026] http-in app/web-03 7607/0/653/653/7607 200 67889 - - ---- 712/712/85/85/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:21:59.441970-07:00 api-08 app[30150]: INFO health check ok: db 222 ms, cache 222 ms, queue depth 50 2026-10-09T13:21:59.876358-07:00 cache-3 app[30436]: INFO request_id=237f10ad1ecba1a7 method=GET path=/favicon.ico status=200 duration=3332ms 2026-10-09T13:21:59.966831-07:00 bastion app[30965]: INFO request_id=6a4bbd152fc44365 method=GET path=/login status=200 duration=9481ms 2026-10-09T13:22:00.088154-07:00 cache-3 nginx[1208]: 192.182.186.176 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 44428 "-" "python-requests/2.32.3" 2026-10-09T13:22:00.174079-07:00 db-primary app[30740]: INFO worker 25 picked job 5e1aea54f3f6c6e8 from queue emails 2026-10-09T13:22:00.285534-07:00 cache-3 app[30628]: INFO worker 90 picked job d63644e8bf62c6cd from queue emails 2026-10-09T13:22:00.289090-07:00 api-07 haproxy[941]: 192.236.168.229:23644 [79516] http-in app/api-08 4668/0/901/901/4668 500 30346 - - ---- 450/450/47/47/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:22:00.397226-07:00 worker-12 app[30037]: INFO request_id=a543baee4267772f method=GET path=/favicon.ico status=301 duration=6192ms 2026-10-09T13:22:00.539104-07:00 api-08 nginx[1201]: 91.162.208.248 - deploy "POST /favicon.ico HTTP/1.1" 200 41203 "-" "Go-http-client/1.1" 2026-10-09T13:22:00.828387-07:00 web-02 nginx[1201]: 192.216.105.228 - sørensen "POST /admin HTTP/1.1" 404 28213 "-" "python-requests/2.32.3" 2026-10-09T13:22:00.838934-07:00 db-replica app[30972]: INFO worker 23 picked job 5f75d60e3fe2a0e1 from queue invoices 2026-10-09T13:22:00.890623-07:00 db-replica app[30133]: DEBUG cache hit ratio 42% over the last minute (52363 lookups) 2026-10-09T13:22:00.918195-07:00 cache-3 cron[30688]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:01.035867-07:00 api-07 app[30722]: INFO worker 12 finished job 260250939c8bff19 in 8881 ms 2026-10-09T13:22:01.044707-07:00 api-07 dockerd[700]: time="2026-10-09T13:22:01.044707-07:00" level=info msg="Container 325d31b7ec911b2e exited with code 0" 2026-10-09T13:22:01.183369-07:00 worker-12 systemd[1]: Started Session 79669 of User deploy. 2026-10-09T13:22:01.189500-07:00 worker-12 haproxy[907]: 203.112.66.229:63383 [78517] http-in app/db-primary 8301/0/811/811/8301 200 28385 - - ---- 161/161/53/53/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:22:01.426072-07:00 web-02 app[30749]: INFO order 46602 confirmed for françois in 772 ms (region eu-west-1, queue invoices) 2026-10-09T13:22:01.907514-07:00 cache-3 app[30636]: INFO request_id=9495da4411de476e method=GET path=/admin status=404 duration=2251ms 2026-10-09T13:22:02.023661-07:00 db-primary systemd[1]: session-32040.scope: Deactivated successfully. 2026-10-09T13:22:02.089833-07:00 api-08 kernel: [24261.563359] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.130.225.110 DST=10.0.766.766 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=24261 DF PROTO=TCP SPT=36843 DPT=36843 WINDOW=24261 RES=0x00 SYN URGP=0 2026-10-09T13:22:02.453615-07:00 web-01 app[30849]: INFO request_id=21241ea83a07a423 method=GET path=/favicon.ico status=404 duration=3869ms 2026-10-09T13:22:02.538674-07:00 db-primary nginx[1205]: 10.92.236.132 - - "GET /static/main.css HTTP/1.1" 200 55788 "-" "python-requests/2.32.3" 2026-10-09T13:22:02.582397-07:00 db-primary haproxy[904]: 203.158.215.172:53138 [36605] http-in app/edge-fr-1 4440/0/748/748/4440 200 68683 - - ---- 504/504/46/46/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:22:02.698888-07:00 cache-3 dockerd[700]: time="2026-10-09T13:22:02.698888-07:00" level=info msg="Container 3296f8c3bfa1abc9 exited with code 0" 2026-10-09T13:22:03.089578-07:00 web-02 app[30797]: INFO order 10859 confirmed for françois in 5244 ms (region eu-west-1, queue emails) 2026-10-09T13:22:03.470733-07:00 api-07 nginx[1210]: 91.112.184.130 - - "GET /static/main.css HTTP/1.1" 404 89610 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:03.512301-07:00 db-primary systemd[1]: Started Session 27177 of User sørensen. 2026-10-09T13:22:03.529289-07:00 api-08 nginx[1205]: 203.44.252.235 - - "GET /admin HTTP/1.1" 502 58935 "-" "kube-probe/1.31" 2026-10-09T13:22:03.580134-07:00 db-replica cron[53732]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:03.600139-07:00 worker-12 haproxy[944]: 203.3.126.65:62324 [60999] http-in app/db-replica 4979/0/62/62/4979 200 45061 - - ---- 227/227/26/26/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:03.690610-07:00 worker-12 app[30291]: INFO worker 73 picked job 3f4f1e54331d8784 from queue orders 2026-10-09T13:22:03.718746-07:00 bastion app[30915]: WARN slow query (4261 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '94 minutes' 2026-10-09T13:22:03.810062-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577323.549:50908): pid=50908 uid=0 auid=8509 ses=645 msg='op=login id=8509 exe="/usr/sbin/sshd" hostname=? addr=10.123.95.251 terminal=/dev/pts/0 res=success' 2026-10-09T13:22:03.840671-07:00 bastion app[30102]: INFO worker 17 picked job c4b66cbc5466997f from queue emails 2026-10-09T13:22:03.968376-07:00 api-07 app[30005]: INFO worker 55 picked job d4313dbc7b065c54 from queue orders 2026-10-09T13:22:04.272980-07:00 edge-fr-1 haproxy[934]: 203.130.172.137:58851 [23024] http-in app/worker-12 8156/0/294/294/8156 404 34787 - - ---- 103/103/82/82/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:22:04.721265-07:00 cache-3 app[30244]: INFO request_id=e0a60709a8417942 method=GET path=/.env status=200 duration=8308ms 2026-10-09T13:22:04.822448-07:00 api-07 sshd[16910]: Accepted publickey for zoë from 172.91.126.109 port 55496 ssh2: ED25519 SHA256:0562d238a4a3ff90 2026-10-09T13:22:05.061897-07:00 api-07 app[30190]: INFO order 39317 confirmed for akira in 5212 ms (region eu-west-1, queue orders) 2026-10-09T13:22:05.189061-07:00 web-01 haproxy[930]: 172.160.40.108:63705 [92593] http-in app/web-02 2276/0/203/203/2276 404 5490 - - ---- 731/731/39/39/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:05.301964-07:00 api-07 sshd[14200]: Accepted publickey for backup from 203.219.173.71 port 39027 ssh2: ED25519 SHA256:ba75570611ead72c 2026-10-09T13:22:05.577371-07:00 api-08 app[30897]: ERROR payment declined for order 25584: card_declined (code 32), customer notified 2026-10-09T13:22:05.605087-07:00 db-replica app[30201]: INFO order 36782 confirmed for ci in 4381 ms (region us-east-1, queue orders) 2026-10-09T13:22:05.780984-07:00 edge-fr-1 kernel: [66885.175343] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.39.35.26 DST=10.0.899.899 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=66885 DF PROTO=TCP SPT=29787 DPT=29787 WINDOW=66885 RES=0x00 SYN URGP=0 2026-10-09T13:22:05.784448-07:00 bastion postgres[19605]: LOG: duration: 5961.69 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:22:06.173897-07:00 api-07 sshd[14995]: Invalid user akira from 172.163.249.96 port 23999 2026-10-09T13:22:06.323615-07:00 api-07 nginx[1204]: 192.62.5.230 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 15353 "-" "kube-probe/1.31" 2026-10-09T13:22:06.548566-07:00 web-03 haproxy[915]: 10.54.231.21:9415 [64963] http-in app/web-01 1810/0/848/848/1810 401 69556 - - ---- 605/605/12/12/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:22:07.058201-07:00 edge-fr-1 nginx[1202]: 10.55.96.105 - zoë "POST /api/v2/users HTTP/1.1" 404 7573 "-" "python-requests/2.32.3" 2026-10-09T13:22:07.098343-07:00 web-01 app[30812]: INFO health check ok: db 462 ms, cache 462 ms, queue depth 49 2026-10-09T13:22:07.862649-07:00 bastion app[30932]: INFO worker 72 finished job 4a92491defc7afbd in 6475 ms 2026-10-09T13:22:07.927042-07:00 db-primary nginx[1203]: 10.175.185.116 - zoë "POST /api/v2/search?q=invoice HTTP/1.1" 401 26186 "-" "python-requests/2.32.3" 2026-10-09T13:22:08.232645-07:00 api-07 nginx[1206]: 91.60.211.176 - - "GET /metrics HTTP/1.1" 200 3439 "-" "curl/8.4.0" 2026-10-09T13:22:08.844952-07:00 worker-12 app[30942]: INFO request_id=3d6b28519330ea13 method=GET path=/login status=200 duration=2567ms 2026-10-09T13:22:08.874271-07:00 edge-fr-1 sshd[26803]: Connection closed by 203.102.226.224 port 51592 [preauth] 2026-10-09T13:22:08.936945-07:00 edge-fr-1 app[30114]: INFO order 54172 confirmed for backup in 2159 ms (region us-east-1, queue emails) 2026-10-09T13:22:08.950616-07:00 db-primary haproxy[937]: 91.196.216.213:53644 [58997] http-in app/api-08 6191/0/338/338/6191 200 76008 - - ---- 304/304/81/81/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:22:08.971329-07:00 web-03 kernel: [24905.457014] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.186.115.6 DST=10.0.468.468 LEN=63 TOS=0x00 PREC=0x00 TTL=63 ID=24905 DF PROTO=TCP SPT=53737 DPT=53737 WINDOW=24905 RES=0x00 SYN URGP=0 2026-10-09T13:22:09.193717-07:00 worker-12 app[30449]: INFO worker 51 finished job 751d286ff5e07a95 in 4415 ms 2026-10-09T13:22:09.381881-07:00 web-02 kernel: [79940.802290] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.172.178.214 DST=10.0.349.349 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=79940 DF PROTO=TCP SPT=26214 DPT=26214 WINDOW=79940 RES=0x00 SYN URGP=0 2026-10-09T13:22:09.780814-07:00 worker-12 nginx[1209]: 172.45.242.218 - françois "POST /api/v2/orders/8841 HTTP/1.1" 401 62350 "-" "Go-http-client/1.1" 2026-10-09T13:22:09.837282-07:00 api-07 sshd[9387]: Invalid user root from 172.169.93.189 port 8490 2026-10-09T13:22:09.846411-07:00 web-03 nginx[1206]: 192.36.42.19 - - "GET /login HTTP/1.1" 204 40568 "-" "Go-http-client/1.1" 2026-10-09T13:22:10.036744-07:00 api-08 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:22:10.067451-07:00 web-03 haproxy[945]: 192.89.20.155:37654 [24408] http-in app/bastion 7321/0/228/228/7321 502 25475 - - ---- 349/349/42/42/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:10.513983-07:00 web-02 app[30842]: INFO request_id=4b8561ed02392af4 method=GET path=/api/v2/orders/8841 status=200 duration=3298ms 2026-10-09T13:22:10.654675-07:00 worker-12 app[30693]: INFO request_id=c51b26cbb4a8a64e method=GET path=/static/main.css status=200 duration=7987ms 2026-10-09T13:22:10.670571-07:00 web-02 haproxy[921]: 45.24.245.133:55567 [84599] http-in app/cache-3 9803/0/521/521/9803 204 27206 - - ---- 932/932/26/26/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:10.837091-07:00 cache-3 app[30495]: INFO worker 95 finished job 0f786254defe5bc1 in 1404 ms 2026-10-09T13:22:10.968211-07:00 db-primary nginx[1207]: 45.42.202.229 - - "GET /favicon.ico HTTP/1.1" 301 69518 "-" "python-requests/2.32.3" 2026-10-09T13:22:11.127221-07:00 api-07 app[30410]: INFO order 30952 confirmed for priya in 563 ms (region eu-west-1, queue webhooks) 2026-10-09T13:22:11.493821-07:00 web-01 app[30018]: INFO request_id=f2f1ce5f4ca4b62e method=GET path=/favicon.ico status=200 duration=7569ms 2026-10-09T13:22:11.591612-07:00 web-01 sshd[64636]: Received disconnect from 203.254.248.55 port 24444:11: Bye Bye [preauth] 2026-10-09T13:22:11.606756-07:00 db-primary cron[39963]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:11.971759-07:00 api-08 app[30221]: INFO request_id=247d5602b17df0d2 method=GET path=/api/v2/users status=200 duration=8961ms 2026-10-09T13:22:12.055924-07:00 api-08 nginx[1205]: 10.206.159.45 - - "GET /static/app.js HTTP/1.1" 401 39752 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:12.286387-07:00 api-07 systemd[1]: session-22719.scope: Deactivated successfully. 2026-10-09T13:22:12.386850-07:00 api-07 app[30181]: INFO request_id=b29612c08f2d0402 method=GET path=/health status=200 duration=8231ms 2026-10-09T13:22:12.453695-07:00 worker-12 systemd[1]: Started Session 96856 of User ci. 2026-10-09T13:22:12.701115-07:00 db-primary haproxy[934]: 45.9.243.3:34936 [60113] http-in app/web-02 2635/0/248/248/2635 200 12085 - - ---- 624/624/26/26/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:22:12.770717-07:00 cache-3 postgres[16351]: LOG: duration: 4095.637 ms statement: SELECT * FROM orders WHERE customer_id = 72408 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:12.868371-07:00 api-08 app[30396]: INFO order 10888 confirmed for akira in 7286 ms (region ap-northeast-1, queue orders) 2026-10-09T13:22:12.878068-07:00 cache-3 haproxy[905]: 10.171.207.127:63726 [38534] http-in app/api-08 1719/0/772/772/1719 404 9734 - - ---- 792/792/88/88/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:22:13.160358-07:00 cache-3 sshd[50275]: Connection closed by 10.51.215.219 port 22604 [preauth] 2026-10-09T13:22:13.302407-07:00 edge-fr-1 app[30007]: ERROR unhandled exception in worker 81 while processing job e7cee7a1781ff239 java.lang.NullPointerException: Cannot invoke "com.example.billing.Invoice.getTotal()" because "invoice" is null at com.example.billing.InvoiceService.charge(InvoiceService.java:584) at com.example.billing.InvoiceService.process(InvoiceService.java:39) at com.example.jobs.Worker.run(Worker.java:117) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:840) 2026-10-09T13:22:13.394806-07:00 worker-12 systemd[1]: session-44392.scope: Deactivated successfully. 2026-10-09T13:22:13.680820-07:00 cache-3 app[30227]: INFO worker 52 picked job 8d8755a227e51cfe from queue emails 2026-10-09T13:22:13.821855-07:00 web-01 nginx[1203]: 91.37.206.20 - - "GET /static/app.js HTTP/1.1" 204 73959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:13.821954-07:00 edge-fr-1 nginx[1210]: 172.74.22.156 - - "GET /.env HTTP/1.1" 200 30886 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:13.951956-07:00 cache-3 nginx[1203]: 10.95.10.102 - backup "POST /static/app.js HTTP/1.1" 200 24667 "-" "curl/8.4.0" 2026-10-09T13:22:13.957589-07:00 api-07 postgres[28486]: LOG: duration: 5057.554 ms statement: SELECT * FROM orders WHERE customer_id = 51265 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:14.123632-07:00 cache-3 app[30808]: INFO order 21950 confirmed for zoë in 4892 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:22:14.187299-07:00 web-02 haproxy[929]: 10.57.140.211:40296 [15017] http-in app/edge-fr-1 3357/0/130/130/3357 404 85109 - - ---- 346/346/94/94/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:22:14.301706-07:00 edge-fr-1 kubelet[800]: E1009 13:22:14.996853 7747 pod_workers.go:7747] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-24c983262a61c4d2" 2026-10-09T13:22:14.374061-07:00 cache-3 app[30779]: INFO worker 81 finished job 05afb74d6cab5991 in 2730 ms 2026-10-09T13:22:14.486471-07:00 cache-3 app[30604]: INFO request_id=5f01fc5d775462f2 method=GET path=/api/v2/search?q=invoice status=502 duration=184ms 2026-10-09T13:22:15.057489-07:00 web-01 app[30087]: INFO order 14734 confirmed for deploy in 6529 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:22:15.102455-07:00 cache-3 app[30267]: INFO worker 47 picked job 33867d989847e161 from queue emails 2026-10-09T13:22:15.171621-07:00 db-replica app[30044]: INFO worker 57 finished job ea29c00bd3feb244 in 3689 ms 2026-10-09T13:22:15.230064-07:00 db-replica app[30533]: INFO order 87535 confirmed for backup in 2340 ms (region us-east-1, queue orders) 2026-10-09T13:22:15.346147-07:00 web-03 nginx[1206]: 192.196.43.74 - - "GET /.env HTTP/1.1" 204 82043 "-" "curl/8.4.0" 2026-10-09T13:22:15.424323-07:00 db-replica app[30454]: INFO request_id=3f76f3c0e53c730e method=GET path=/wp-login.php status=500 duration=9084ms 2026-10-09T13:22:15.538584-07:00 web-02 sshd[44333]: Accepted publickey for root from 91.8.22.29 port 26302 ssh2: ED25519 SHA256:626b707814b1e2fa 2026-10-09T13:22:16.030255-07:00 bastion postgres[6799]: LOG: duration: 2857.590 ms statement: SELECT * FROM orders WHERE customer_id = 75293 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:16.108947-07:00 api-07 app[30385]: INFO health check ok: db 293 ms, cache 293 ms, queue depth 45 2026-10-09T13:22:16.187821-07:00 bastion systemd[1]: session-40219.scope: Deactivated successfully. 2026-10-09T13:22:16.378582-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577336.923:74990): pid=74990 uid=0 auid=4969 ses=224 msg='op=login id=4969 exe="/usr/sbin/sshd" hostname=? addr=192.60.2.149 terminal=/dev/pts/0 res=success' 2026-10-09T13:22:16.469705-07:00 worker-12 app[30436]: INFO health check ok: db 977 ms, cache 977 ms, queue depth 63 2026-10-09T13:22:16.606991-07:00 edge-fr-1 app[30469]: WARN slow query (2026 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '73 minutes' 2026-10-09T13:22:16.689662-07:00 api-08 app[30742]: ERROR payment declined for order 15247: card_declined (code 61), customer notified 2026-10-09T13:22:16.787036-07:00 worker-12 haproxy[907]: 203.213.21.17:14643 [83634] http-in app/db-primary 6479/0/299/299/6479 500 79510 - - ---- 930/930/64/64/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:16.809103-07:00 bastion nginx[1203]: 10.211.69.198 - - "GET /metrics HTTP/1.1" 200 55322 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:16.969347-07:00 cache-3 nginx[1210]: 45.245.211.46 - deploy "POST /favicon.ico HTTP/1.1" 200 8437 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:16.997277-07:00 web-03 haproxy[949]: 192.199.151.114:10231 [21889] http-in app/api-07 3361/0/453/453/3361 401 87038 - - ---- 733/733/55/55/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:17.063595-07:00 web-02 sshd[43551]: pam_unix(sshd:session): session opened for user françois(uid=7194) by (uid=0) 2026-10-09T13:22:17.179704-07:00 bastion sshd[26520]: Received disconnect from 203.117.205.109 port 19607:11: Bye Bye [preauth] 2026-10-09T13:22:17.420864-07:00 api-08 app[30460]: INFO worker 80 finished job 3d23ed3961dfcb84 in 2725 ms 2026-10-09T13:22:17.469021-07:00 edge-fr-1 nginx[1210]: 192.187.160.6 - - "GET /metrics HTTP/1.1" 502 15094 "-" "curl/8.4.0" 2026-10-09T13:22:17.484534-07:00 web-02 kernel: [86294.588999] TCP: request_sock_TCP: Possible SYN flooding on port 51557. Sending cookies. Check SNMP counters. 2026-10-09T13:22:17.498420-07:00 web-03 postgres[7582]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 99047 remain, 6259 scanned (57% of total) 2026-10-09T13:22:17.640754-07:00 web-03 app[30534]: INFO order 27491 confirmed for root in 1305 ms (region eu-west-1, queue emails) 2026-10-09T13:22:17.645690-07:00 web-02 sshd[481]: Accepted publickey for sørensen from 45.220.99.90 port 3069 ssh2: ED25519 SHA256:e5bc4657675b4c65 2026-10-09T13:22:18.102246-07:00 db-replica app[30698]: DEBUG cache hit ratio 90% over the last minute (15221 lookups) 2026-10-09T13:22:18.179588-07:00 db-replica haproxy[935]: 203.139.89.140:65304 [16224] http-in app/api-07 1259/0/832/832/1259 502 10396 - - ---- 257/257/80/80/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:22:18.239092-07:00 api-08 sshd[35639]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:22:18.357946-07:00 api-07 app[30107]: INFO worker 12 finished job 2fa1e49c3bad9724 in 2303 ms 2026-10-09T13:22:18.596749-07:00 web-03 sshd[15296]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:22:18.600316-07:00 bastion haproxy[949]: 203.205.31.150:55222 [44034] http-in app/worker-12 2666/0/438/438/2666 502 13449 - - ---- 310/310/80/80/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:22:18.743330-07:00 worker-12 nginx[1206]: 192.78.71.173 - - "GET /metrics HTTP/1.1" 200 14572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:18.866032-07:00 web-02 haproxy[928]: 91.143.197.206:18818 [41193] http-in app/web-03 9359/0/718/718/9359 502 57898 - - ---- 958/958/15/15/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:22:19.089412-07:00 api-08 app[30955]: INFO worker 29 finished job 4fff8cd500a28d46 in 2185 ms 2026-10-09T13:22:19.097638-07:00 web-01 app[30771]: INFO worker 65 finished job e369b1b2d9fc201b in 8980 ms 2026-10-09T13:22:19.190557-07:00 edge-fr-1 systemd[1]: Started Session 67646 of User müller. 2026-10-09T13:22:19.375445-07:00 web-03 app[30467]: INFO request_id=130aaf0e184933fe method=GET path=/wp-login.php status=200 duration=679ms 2026-10-09T13:22:19.496642-07:00 db-primary app[30637]: INFO request_id=2d146a5fc619c94b method=GET path=/api/v2/orders/8841 status=204 duration=1966ms 2026-10-09T13:22:19.514411-07:00 api-08 app[30369]: INFO order 81733 confirmed for zoë in 8799 ms (region ap-northeast-1, queue orders) 2026-10-09T13:22:19.529672-07:00 web-01 app[30768]: INFO request_id=994ae337dcf136ac method=GET path=/api/v2/orders status=200 duration=5443ms 2026-10-09T13:22:19.658014-07:00 bastion app[30742]: INFO health check ok: db 307 ms, cache 307 ms, queue depth 52 2026-10-09T13:22:19.700312-07:00 web-03 app[30605]: INFO health check ok: db 101 ms, cache 101 ms, queue depth 91 2026-10-09T13:22:20.212689-07:00 edge-fr-1 nginx[1201]: 10.248.30.119 - - "GET /favicon.ico HTTP/1.1" 200 46081 "-" "curl/8.4.0" 2026-10-09T13:22:20.221419-07:00 db-replica postgres[8097]: LOG: duration: 481.846 ms statement: SELECT * FROM orders WHERE customer_id = 69501 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:20.557351-07:00 cache-3 nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.221.59.165, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.271.271:8080/metrics" 2026-10-09T13:22:20.594996-07:00 api-08 app[30261]: INFO request_id=6da7039437d4708b method=GET path=/favicon.ico status=404 duration=7143ms 2026-10-09T13:22:20.704457-07:00 web-03 app[30887]: INFO request_id=f286addc190ca8eb method=GET path=/favicon.ico status=502 duration=4333ms 2026-10-09T13:22:20.708220-07:00 worker-12 sshd[46590]: Received disconnect from 45.36.222.125 port 10657:11: Bye Bye [preauth] 2026-10-09T13:22:20.726967-07:00 bastion nginx[1203]: 10.32.221.68 - - "GET /health HTTP/1.1" 404 71636 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:20.979584-07:00 web-02 sshd[500]: Accepted publickey for deploy from 10.11.135.95 port 4222 ssh2: ED25519 SHA256:cbc7db8ef2e74094 2026-10-09T13:22:21.222942-07:00 api-07 nginx[1208]: 45.166.36.32 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 9633 "-" "python-requests/2.32.3" 2026-10-09T13:22:21.278425-07:00 edge-fr-1 nginx[1205]: 192.186.148.190 - - "GET /admin HTTP/1.1" 502 43611 "-" "curl/8.4.0" 2026-10-09T13:22:21.282996-07:00 web-01 sshd[15456]: Failed password for invalid user zoë from 192.44.106.35 port 18803 ssh2 2026-10-09T13:22:21.766079-07:00 worker-12 sshd[41434]: Failed password for invalid user müller from 172.209.73.32 port 46146 ssh2 2026-10-09T13:22:21.905596-07:00 worker-12 nginx[1203]: 192.49.94.156 - - "GET /health HTTP/1.1" 502 63883 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:22.023013-07:00 db-primary nginx[1206]: 192.225.16.25 - - "GET /metrics HTTP/1.1" 502 68491 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:22.277806-07:00 api-07 app[30310]: INFO request_id=69a3dc2aa32052de method=GET path=/login status=204 duration=9866ms 2026-10-09T13:22:22.339802-07:00 db-primary haproxy[902]: 203.111.247.223:32403 [95769] http-in app/cache-3 5627/0/595/595/5627 204 69526 - - ---- 550/550/25/25/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:22:22.997007-07:00 web-03 nginx[1200]: 172.173.47.12 - - "GET /api/v2/users HTTP/1.1" 204 36825 "-" "Go-http-client/1.1" 2026-10-09T13:22:23.098955-07:00 cache-3 app[30771]: INFO worker 38 finished job 102137a92b50ce1d in 3854 ms 2026-10-09T13:22:23.167222-07:00 web-01 app[30780]: INFO request_id=91b351189c10a94f method=GET path=/static/main.css status=401 duration=2766ms 2026-10-09T13:22:23.236194-07:00 web-03 kernel: [56174.151747] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.233.22.34 DST=10.0.263.263 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=56174 DF PROTO=TCP SPT=37442 DPT=37442 WINDOW=56174 RES=0x00 SYN URGP=0 2026-10-09T13:22:23.408760-07:00 api-08 app[30532]: INFO worker 73 finished job a0eb0720e178a618 in 7527 ms 2026-10-09T13:22:23.491965-07:00 cache-3 app[30595]: INFO request_id=a27f0eec2d994b62 method=GET path=/static/app.js status=500 duration=3133ms 2026-10-09T13:22:23.538230-07:00 bastion app[30044]: INFO request_id=07cc6784b6d1b726 method=GET path=/static/app.js status=200 duration=1871ms 2026-10-09T13:22:23.548960-07:00 bastion nginx[1201]: 45.25.164.185 - - "GET /api/v2/users HTTP/1.1" 404 66798 "-" "kube-probe/1.31" 2026-10-09T13:22:23.664031-07:00 web-03 kernel: [58062.137096] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.4.116.183 DST=10.0.778.778 LEN=55 TOS=0x00 PREC=0x00 TTL=55 ID=58062 DF PROTO=TCP SPT=41839 DPT=41839 WINDOW=58062 RES=0x00 SYN URGP=0 2026-10-09T13:22:23.675295-07:00 web-03 nginx[1209]: 45.106.176.217 - - "GET /wp-login.php HTTP/1.1" 200 86404 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:23.870186-07:00 worker-12 sshd[53051]: Accepted publickey for priya from 203.92.228.248 port 31628 ssh2: ED25519 SHA256:15d5b3c9d8769d06 2026-10-09T13:22:23.887340-07:00 cache-3 app[30549]: DEBUG cache hit ratio 56% over the last minute (72814 lookups) 2026-10-09T13:22:24.068947-07:00 web-02 app[30746]: INFO health check ok: db 353 ms, cache 353 ms, queue depth 73 2026-10-09T13:22:24.169785-07:00 edge-fr-1 nginx[1210]: 91.107.206.156 - - "GET /api/v2/orders HTTP/1.1" 502 70076 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:24.178730-07:00 api-07 app[30290]: INFO request_id=ec858002cae466fe method=GET path=/metrics status=404 duration=5117ms 2026-10-09T13:22:24.205856-07:00 api-07 sshd[12851]: Failed password for invalid user zoë from 203.94.144.127 port 59127 ssh2 2026-10-09T13:22:24.239264-07:00 web-03 nginx[1202]: 203.146.109.233 - backup "POST /api/v2/search?q=invoice HTTP/1.1" 200 42473 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:24.269652-07:00 web-02 sshd[10675]: Connection closed by 192.149.252.183 port 49021 [preauth] 2026-10-09T13:22:24.402426-07:00 db-replica nginx[1205]: 91.41.255.163 - - "GET /wp-login.php HTTP/1.1" 404 69526 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:24.407142-07:00 bastion postgres[14417]: LOG: duration: 3518.76 ms statement: SELECT * FROM orders WHERE customer_id = 94151 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:24.591658-07:00 worker-12 nginx[1210]: 172.217.255.36 - müller "POST /favicon.ico HTTP/1.1" 200 12292 "-" "Go-http-client/1.1" 2026-10-09T13:22:24.614856-07:00 api-08 nginx[1203]: 172.47.27.94 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 36267 "-" "kube-probe/1.31" 2026-10-09T13:22:24.753715-07:00 api-08 app[30671]: INFO order 37511 confirmed for zoë in 7436 ms (region us-east-1, queue invoices) 2026-10-09T13:22:24.903456-07:00 cache-3 app[30784]: INFO request_id=b60866e501d9fde4 method=GET path=/wp-login.php status=200 duration=1571ms 2026-10-09T13:22:25.247579-07:00 worker-12 dockerd[700]: time="2026-10-09T13:22:25.247579-07:00" level=info msg="Container 40e5282768f0a87b exited with code 0" 2026-10-09T13:22:25.273337-07:00 web-01 app[30397]: INFO worker 87 picked job a4722bb01cb73987 from queue emails 2026-10-09T13:22:25.407455-07:00 web-03 app[30450]: INFO worker 26 picked job dbe738f730b8d4bc from queue invoices 2026-10-09T13:22:25.450311-07:00 api-07 app[30158]: INFO worker 80 picked job 12559890dfbcf440 from queue emails 2026-10-09T13:22:25.688252-07:00 bastion app[30036]: INFO order 92898 confirmed for akira in 4410 ms (region us-east-1, queue webhooks) 2026-10-09T13:22:25.775867-07:00 web-02 app[30029]: INFO order 18755 confirmed for sørensen in 2757 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:22:25.879569-07:00 db-primary nginx[1206]: 192.244.105.221 - - "GET /static/app.js HTTP/1.1" 302 75815 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:25.931932-07:00 api-08 app[30673]: INFO health check ok: db 631 ms, cache 631 ms, queue depth 27 2026-10-09T13:22:25.949864-07:00 db-replica sshd[2847]: Accepted publickey for deploy from 203.222.66.162 port 18917 ssh2: ED25519 SHA256:0f81a9ca256f7c37 2026-10-09T13:22:26.195451-07:00 api-08 app[30071]: INFO worker 20 finished job 4fdba49a6da22922 in 703 ms 2026-10-09T13:22:26.361124-07:00 web-02 systemd[1]: session-47691.scope: Deactivated successfully. 2026-10-09T13:22:26.597713-07:00 worker-12 nginx[1207]: 172.139.244.27 - - "GET /wp-login.php HTTP/1.1" 500 33340 "-" "kube-probe/1.31" 2026-10-09T13:22:26.670706-07:00 api-07 sshd[29463]: Received disconnect from 192.60.123.76 port 25653:11: Bye Bye [preauth] 2026-10-09T13:22:26.733379-07:00 web-01 haproxy[901]: 91.220.16.110:54786 [61844] http-in app/web-02 8145/0/644/644/8145 301 8495 - - ---- 280/280/25/25/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:22:27.034582-07:00 db-replica sshd[30992]: Invalid user akira from 203.121.26.118 port 25046 2026-10-09T13:22:27.115293-07:00 api-08 app[30163]: WARN slow query (2639 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '97 minutes' 2026-10-09T13:22:27.322651-07:00 web-01 app[30868]: INFO order 97856 confirmed for zoë in 6452 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:22:27.327347-07:00 web-03 app[30568]: INFO order 67016 confirmed for priya in 4782 ms (region ap-northeast-1, queue orders) 2026-10-09T13:22:27.438524-07:00 worker-12 app[30852]: INFO worker 59 picked job f3ab1496490a52f3 from queue webhooks 2026-10-09T13:22:27.445491-07:00 web-01 kernel: [12771.591043] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.148.33.254 DST=10.0.160.160 LEN=75 TOS=0x00 PREC=0x00 TTL=75 ID=12771 DF PROTO=TCP SPT=27821 DPT=27821 WINDOW=12771 RES=0x00 SYN URGP=0 2026-10-09T13:22:27.501175-07:00 bastion app[30548]: INFO worker 97 picked job eee3abc9af02c8d1 from queue invoices 2026-10-09T13:22:27.546112-07:00 cache-3 haproxy[912]: 91.132.157.225:53426 [39407] http-in app/worker-12 6439/0/595/595/6439 204 26416 - - ---- 632/632/76/76/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:22:27.643794-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577347.291:18087): pid=18087 uid=0 auid=5921 ses=342 msg='op=login id=5921 exe="/usr/sbin/sshd" hostname=? addr=192.54.65.190 terminal=/dev/pts/0 res=success' 2026-10-09T13:22:27.685114-07:00 cache-3 nginx[1210]: 45.128.46.235 - - "GET /wp-login.php HTTP/1.1" 404 36134 "-" "curl/8.4.0" 2026-10-09T13:22:27.709414-07:00 db-replica app[30667]: INFO order 90642 confirmed for root in 6600 ms (region eu-west-1, queue invoices) 2026-10-09T13:22:27.840079-07:00 db-primary nginx[1209]: 45.214.148.49 - - "GET /health HTTP/1.1" 301 26013 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:27.905945-07:00 db-replica systemd[1]: Started Session 73921 of User root. 2026-10-09T13:22:28.081811-07:00 api-08 sshd[42564]: Invalid user françois from 192.100.81.27 port 59462 2026-10-09T13:22:28.193144-07:00 db-primary nginx[1207]: 45.58.96.107 - sørensen "POST /api/v2/orders HTTP/1.1" 500 81803 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:28.500159-07:00 web-02 app[30600]: INFO request_id=825c1c97789c1e0c method=GET path=/admin status=404 duration=5443ms 2026-10-09T13:22:28.504002-07:00 edge-fr-1 app[30913]: INFO worker 80 finished job de78b4967e9fa9eb in 3402 ms 2026-10-09T13:22:28.509444-07:00 web-01 app[30936]: INFO worker 63 finished job c9b3bfe609112ebc in 932 ms 2026-10-09T13:22:28.566038-07:00 web-03 sshd[15003]: Accepted publickey for root from 172.59.58.233 port 32857 ssh2: ED25519 SHA256:3f8527ca1936f64a 2026-10-09T13:22:28.675675-07:00 cache-3 postgres[9598]: LOG: duration: 5434.660 ms statement: SELECT * FROM orders WHERE customer_id = 23936 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:28.779407-07:00 api-08 sshd[31067]: Invalid user ci from 172.191.164.68 port 22184 2026-10-09T13:22:28.843681-07:00 web-02 app[30339]: INFO health check ok: db 969 ms, cache 969 ms, queue depth 42 2026-10-09T13:22:28.854053-07:00 db-primary app[30012]: INFO request_id=b85bd6d3d150f495 method=GET path=/api/v2/orders status=301 duration=6222ms 2026-10-09T13:22:28.901765-07:00 worker-12 sshd[63013]: Accepted publickey for priya from 203.157.76.203 port 8187 ssh2: ED25519 SHA256:3855e3dbf448dc41 2026-10-09T13:22:29.023254-07:00 web-02 app[30441]: WARN retrying upstream 10.151.106.215:40670 after timeout (8031 ms), attempt 3 of 3 2026-10-09T13:22:29.039585-07:00 bastion app[30928]: INFO request_id=2f5f87f4f0a227df method=GET path=/admin status=200 duration=2280ms 2026-10-09T13:22:29.063478-07:00 worker-12 cron[19802]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:29.208615-07:00 web-01 postgres[8502]: LOG: duration: 7665.148 ms statement: SELECT * FROM orders WHERE customer_id = 88540 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:29.385203-07:00 api-07 haproxy[906]: 45.222.253.40:51320 [94038] http-in app/bastion 8274/0/960/960/8274 404 59047 - - ---- 850/850/97/97/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:22:29.755286-07:00 db-replica sshd[23549]: Failed password for invalid user sørensen from 10.240.175.244 port 31505 ssh2 2026-10-09T13:22:29.858210-07:00 db-primary nginx[1208]: 10.109.162.48 - - "GET /wp-login.php HTTP/1.1" 200 41078 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:29.965696-07:00 web-01 nginx[1204]: 91.170.83.196 - - "GET /health HTTP/1.1" 200 72372 "-" "curl/8.4.0" 2026-10-09T13:22:30.417879-07:00 cache-3 app[30799]: INFO request_id=12068eb24c02ea0e method=GET path=/metrics status=404 duration=4655ms 2026-10-09T13:22:30.443864-07:00 cache-3 sshd[47610]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:22:30.576173-07:00 web-01 nginx[1206]: 91.117.63.39 - - "GET /api/v2/users HTTP/1.1" 204 55460 "-" "Go-http-client/1.1" 2026-10-09T13:22:30.577377-07:00 web-03 app[30365]: INFO request_id=92a0e96e547cb7ad method=GET path=/api/v2/orders/8841 status=302 duration=8426ms 2026-10-09T13:22:30.907483-07:00 api-08 app[30613]: INFO worker 18 picked job 8641821b15433ef3 from queue orders 2026-10-09T13:22:31.082117-07:00 web-01 app[30621]: INFO request_id=4424246ba422b26a method=GET path=/api/v2/users status=200 duration=5398ms 2026-10-09T13:22:31.284021-07:00 web-01 app[30279]: INFO worker 19 finished job fcb98679cc0c96d5 in 9725 ms 2026-10-09T13:22:31.567718-07:00 db-primary app[30266]: INFO health check ok: db 599 ms, cache 599 ms, queue depth 53 2026-10-09T13:22:31.585763-07:00 cache-3 systemd[1]: Started Session 50285 of User ci. 2026-10-09T13:22:31.945670-07:00 cache-3 app[30538]: INFO order 28497 confirmed for zoë in 564 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:22:31.992375-07:00 db-replica app[30858]: INFO worker 94 finished job 118af035095bebf4 in 3392 ms 2026-10-09T13:22:32.201721-07:00 edge-fr-1 haproxy[933]: 172.245.65.109:9121 [89993] http-in app/db-primary 3034/0/97/97/3034 404 43160 - - ---- 137/137/79/79/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:32.241614-07:00 bastion nginx[1207]: 10.26.181.156 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 6627 "-" "kube-probe/1.31" 2026-10-09T13:22:32.285340-07:00 db-primary postgres[7085]: LOG: checkpoint complete: wrote 5347 buffers (56%); 0 WAL file(s) added, 0 removed, 46 recycled; write=6021.711 s, sync=0.711 s, total=6021.711 s 2026-10-09T13:22:32.391627-07:00 web-03 app[30985]: INFO request_id=10bb2e359b5f0e77 method=GET path=/favicon.ico status=204 duration=7231ms 2026-10-09T13:22:32.416483-07:00 db-primary nginx[1204]: 45.212.217.193 - françois "POST /api/v2/users HTTP/1.1" 200 58711 "-" "Go-http-client/1.1" 2026-10-09T13:22:32.486451-07:00 web-02 nginx[1200]: 172.75.80.12 - - "GET /api/v2/users HTTP/1.1" 204 44070 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:32.567500-07:00 web-01 app[30522]: INFO request_id=c62539dbec444679 method=GET path=/.env status=200 duration=8268ms 2026-10-09T13:22:32.572655-07:00 db-replica app[30903]: INFO worker 64 finished job ff2ef17ce9df3c10 in 3375 ms 2026-10-09T13:22:32.584760-07:00 edge-fr-1 sshd[6507]: Accepted publickey for deploy from 192.171.190.23 port 57536 ssh2: ED25519 SHA256:bb8d0057f22fa830 2026-10-09T13:22:32.645167-07:00 api-07 haproxy[921]: 192.148.148.131:55459 [49143] http-in app/db-primary 6239/0/557/557/6239 200 16168 - - ---- 522/522/65/65/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:32.803085-07:00 api-08 sshd[52419]: pam_unix(sshd:session): session opened for user root(uid=3637) by (uid=0) 2026-10-09T13:22:32.830331-07:00 web-01 app[30701]: INFO request_id=2ab574f048317d0b method=GET path=/health status=200 duration=8290ms 2026-10-09T13:22:32.849563-07:00 db-replica app[30456]: INFO request_id=9e8ec5bab2fe7e00 method=GET path=/static/app.js status=200 duration=8833ms 2026-10-09T13:22:32.856121-07:00 api-07 nginx[1209]: 172.141.243.216 - - "GET /admin HTTP/1.1" 404 86059 "-" "kube-probe/1.31" 2026-10-09T13:22:33.011332-07:00 bastion postgres[17624]: LOG: duration: 1535.473 ms statement: SELECT * FROM orders WHERE customer_id = 75269 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:33.238239-07:00 api-08 app[30186]: INFO request_id=51cc6ae24f32b6c8 method=GET path=/wp-login.php status=404 duration=7630ms 2026-10-09T13:22:33.711768-07:00 api-08 app[30281]: INFO worker 59 finished job 0b2d8e59b4cbc1ee in 6430 ms 2026-10-09T13:22:33.863738-07:00 web-02 sshd[63910]: Connection closed by 192.136.196.109 port 10591 [preauth] 2026-10-09T13:22:33.893294-07:00 db-replica nginx[1206]: 203.64.198.152 - müller "POST /api/v2/orders HTTP/1.1" 204 76240 "-" "python-requests/2.32.3" 2026-10-09T13:22:34.063383-07:00 api-07 app[30166]: INFO request_id=880c9d5c5f55057d method=GET path=/wp-login.php status=200 duration=1046ms 2026-10-09T13:22:34.101855-07:00 db-primary postgres[24626]: LOG: duration: 6721.514 ms statement: SELECT * FROM orders WHERE customer_id = 85239 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:34.139103-07:00 db-replica haproxy[912]: 91.25.171.9:56414 [51024] http-in app/api-08 6997/0/153/153/6997 301 5967 - - ---- 447/447/31/31/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:34.253374-07:00 api-07 app[30658]: INFO request_id=1f495592e364c990 method=GET path=/favicon.ico status=204 duration=6050ms 2026-10-09T13:22:34.609211-07:00 worker-12 nginx[1201]: 91.237.63.38 - - "GET /.env HTTP/1.1" 502 15854 "-" "Go-http-client/1.1" 2026-10-09T13:22:34.666597-07:00 edge-fr-1 nginx[1207]: 172.236.162.188 - - "GET /api/v2/users HTTP/1.1" 301 27612 "-" "curl/8.4.0" 2026-10-09T13:22:34.701291-07:00 web-02 app[30649]: INFO worker 54 picked job 8b1fdfa197f6ddbc from queue orders 2026-10-09T13:22:34.818633-07:00 worker-12 app[30378]: INFO worker 88 finished job 46af4c1f338c1c74 in 4283 ms 2026-10-09T13:22:34.912924-07:00 worker-12 nginx[1202]: 91.30.114.237 - - "GET /static/app.js HTTP/1.1" 204 16117 "-" "kube-probe/1.31" 2026-10-09T13:22:35.112265-07:00 db-primary app[30125]: INFO worker 99 finished job 32b1778cbebb95b4 in 8021 ms 2026-10-09T13:22:35.224687-07:00 api-07 nginx[1202]: 172.238.241.68 - - "GET /.env HTTP/1.1" 204 59498 "-" "python-requests/2.32.3" 2026-10-09T13:22:35.231213-07:00 bastion app[30492]: INFO order 11797 confirmed for backup in 4736 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:22:35.363420-07:00 db-replica nginx[1202]: 203.85.208.174 - - "GET /favicon.ico HTTP/1.1" 401 70342 "-" "curl/8.4.0" 2026-10-09T13:22:35.365401-07:00 web-03 systemd[1]: session-36216.scope: Deactivated successfully. 2026-10-09T13:22:35.398484-07:00 web-01 postgres[2030]: LOG: duration: 9692.813 ms statement: SELECT * FROM orders WHERE customer_id = 16486 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:35.639960-07:00 web-03 app[30897]: INFO worker 39 finished job cc7eeb5c4f020317 in 719 ms 2026-10-09T13:22:35.810203-07:00 api-08 app[30323]: INFO worker 82 picked job d5f6463c9c066a09 from queue orders 2026-10-09T13:22:35.881219-07:00 edge-fr-1 haproxy[929]: Server app/web-03 is UP, reason: Layer7 check passed, code: 200, check duration: 615ms. 42 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:22:35.916935-07:00 api-07 app[30018]: INFO worker 73 finished job 72a93154b0df6443 in 8298 ms 2026-10-09T13:22:35.952813-07:00 cache-3 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:22:36.001934-07:00 api-07 app[30550]: INFO request_id=46b91ca3471e5930 method=GET path=/wp-login.php status=200 duration=2096ms 2026-10-09T13:22:36.237889-07:00 worker-12 app[30511]: INFO request_id=da2badecd17a21a3 method=GET path=/static/main.css status=502 duration=4022ms 2026-10-09T13:22:36.246739-07:00 edge-fr-1 app[30115]: DEBUG cache hit ratio 66% over the last minute (84443 lookups) 2026-10-09T13:22:36.400448-07:00 bastion nginx[1203]: 91.122.68.235 - françois "POST /static/main.css HTTP/1.1" 200 62220 "-" "python-requests/2.32.3" 2026-10-09T13:22:36.491330-07:00 web-03 app[30907]: WARN retrying upstream 192.250.184.180:37007 after timeout (9811 ms), attempt 2 of 3 2026-10-09T13:22:36.514541-07:00 worker-12 sshd[15946]: Invalid user deploy from 91.14.92.198 port 40707 2026-10-09T13:22:36.703480-07:00 web-01 app[30598]: INFO order 48388 confirmed for müller in 8908 ms (region eu-west-1, queue invoices) 2026-10-09T13:22:36.759231-07:00 bastion app[30946]: INFO request_id=548ef3c598507002 method=GET path=/favicon.ico status=404 duration=161ms 2026-10-09T13:22:36.833971-07:00 db-replica systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:22:36.932229-07:00 web-03 app[30119]: INFO worker 15 picked job 461f04e24219bb73 from queue webhooks 2026-10-09T13:22:36.956729-07:00 api-08 nginx[1209]: 45.229.173.251 - sørensen "POST /metrics HTTP/1.1" 200 68792 "-" "kube-probe/1.31" 2026-10-09T13:22:37.334322-07:00 worker-12 app[30431]: INFO request_id=5579095a4c8af4ff method=GET path=/api/v2/orders status=200 duration=4036ms 2026-10-09T13:22:37.420256-07:00 web-01 sshd[8759]: Failed password for invalid user sørensen from 45.111.202.76 port 25843 ssh2 2026-10-09T13:22:37.449889-07:00 worker-12 app[30117]: WARN slow query (9713 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '68 minutes' 2026-10-09T13:22:37.466249-07:00 web-03 nginx[1204]: 10.226.212.54 - müller "POST /api/v2/search?q=invoice HTTP/1.1" 200 48221 "-" "Go-http-client/1.1" 2026-10-09T13:22:37.473860-07:00 api-08 sshd[31620]: Connection closed by 45.26.203.157 port 35687 [preauth] 2026-10-09T13:22:37.578710-07:00 cache-3 nginx[1207]: 45.63.87.148 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 60169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:37.836695-07:00 web-01 nginx[1209]: 203.14.132.3 - - "GET /api/v2/orders HTTP/1.1" 200 53354 "-" "Go-http-client/1.1" 2026-10-09T13:22:37.955854-07:00 api-07 nginx[1203]: 192.43.11.245 - - "GET /admin HTTP/1.1" 404 82202 "-" "Go-http-client/1.1" 2026-10-09T13:22:38.132185-07:00 web-01 app[30352]: INFO request_id=92f84bd907ade5eb method=GET path=/login status=500 duration=9097ms 2026-10-09T13:22:38.145918-07:00 web-01 sshd[7178]: Received disconnect from 203.79.6.162 port 56235:11: Bye Bye [preauth] 2026-10-09T13:22:38.269427-07:00 web-01 kernel: [90831.927626] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.20.58.71 DST=10.0.435.435 LEN=72 TOS=0x00 PREC=0x00 TTL=72 ID=90831 DF PROTO=TCP SPT=59793 DPT=59793 WINDOW=90831 RES=0x00 SYN URGP=0 2026-10-09T13:22:38.573367-07:00 db-replica sshd[37582]: Connection closed by 172.147.209.157 port 34958 [preauth] 2026-10-09T13:22:38.786385-07:00 web-02 haproxy[914]: 91.168.81.202:37796 [99340] http-in app/worker-12 873/0/142/142/873 200 50044 - - ---- 901/901/38/38/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:38.796812-07:00 worker-12 app[30261]: INFO request_id=378acc59190ebce9 method=GET path=/.env status=204 duration=81ms 2026-10-09T13:22:38.862666-07:00 web-03 haproxy[916]: 10.219.14.213:18403 [50908] http-in app/api-07 6514/0/202/202/6514 204 75152 - - ---- 672/672/54/54/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:38.893578-07:00 db-primary app[30724]: INFO order 43503 confirmed for ci in 5715 ms (region us-east-1, queue webhooks) 2026-10-09T13:22:38.918778-07:00 edge-fr-1 nginx[1201]: 45.180.163.83 - ci "POST /static/app.js HTTP/1.1" 204 82305 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:38.928569-07:00 worker-12 app[30297]: INFO worker 96 finished job 96b87fceee55e9b6 in 1589 ms 2026-10-09T13:22:39.090528-07:00 bastion kernel: [38984.003919] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.11.146.118 DST=10.0.819.819 LEN=76 TOS=0x00 PREC=0x00 TTL=76 ID=38984 DF PROTO=TCP SPT=33208 DPT=33208 WINDOW=38984 RES=0x00 SYN URGP=0 2026-10-09T13:22:39.184618-07:00 api-08 postgres[5046]: LOG: duration: 8396.451 ms statement: SELECT * FROM orders WHERE customer_id = 20890 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:39.230035-07:00 api-07 nginx[1207]: 172.69.188.26 - root "POST /metrics HTTP/1.1" 204 27061 "-" "kube-probe/1.31" 2026-10-09T13:22:39.271625-07:00 api-07 app[30240]: INFO worker 41 finished job 3cda62486cefbe05 in 9832 ms 2026-10-09T13:22:39.388591-07:00 web-01 nginx[1206]: 192.199.178.53 - - "GET /api/v2/orders HTTP/1.1" 204 76650 "-" "Go-http-client/1.1" 2026-10-09T13:22:39.548992-07:00 web-01 nginx[1201]: 172.55.13.229 - - "GET /api/v2/orders HTTP/1.1" 200 17733 "-" "python-requests/2.32.3" 2026-10-09T13:22:39.579247-07:00 edge-fr-1 haproxy[927]: 91.243.194.50:39804 [65880] http-in app/db-primary 7634/0/298/298/7634 502 30602 - - ---- 323/323/17/17/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:22:39.681755-07:00 web-02 nginx[1210]: 45.135.255.252 - françois "POST /static/main.css HTTP/1.1" 200 16707 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:39.685608-07:00 web-02 nginx[1203]: 10.24.79.241 - - "GET /api/v2/users HTTP/1.1" 502 25789 "-" "Go-http-client/1.1" 2026-10-09T13:22:39.709775-07:00 api-08 haproxy[932]: 91.219.99.197:53571 [75547] http-in app/web-01 6349/0/884/884/6349 301 85958 - - ---- 978/978/46/46/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:22:39.738469-07:00 worker-12 postgres[13394]: LOG: duration: 8452.321 ms statement: SELECT * FROM orders WHERE customer_id = 26047 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:39.761404-07:00 web-02 app[30005]: INFO request_id=f20035386f7c23b8 method=GET path=/api/v2/search?q=invoice status=502 duration=9742ms 2026-10-09T13:22:40.046730-07:00 db-primary app[30621]: INFO worker 35 finished job ce189faacc88b7c5 in 9407 ms 2026-10-09T13:22:40.101731-07:00 web-03 app[30618]: INFO worker 69 picked job 40eedc3a4ea5f8c2 from queue orders 2026-10-09T13:22:40.102113-07:00 web-03 nginx[1208]: 45.14.184.138 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 54561 "-" "curl/8.4.0" 2026-10-09T13:22:40.110826-07:00 api-07 postgres[28258]: LOG: duration: 44.590 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:22:40.563505-07:00 worker-12 app[30762]: INFO order 65020 confirmed for akira in 9887 ms (region us-east-1, queue emails) 2026-10-09T13:22:40.643249-07:00 web-03 sshd[48925]: Received disconnect from 203.218.167.94 port 11399:11: Bye Bye [preauth] 2026-10-09T13:22:40.815517-07:00 bastion app[30201]: INFO worker 89 picked job a92d6e17bc2b07a8 from queue webhooks 2026-10-09T13:22:40.828724-07:00 web-03 dockerd[700]: time="2026-10-09T13:22:40.828724-07:00" level=info msg="Container f9aa6c959c1ed9d0 exited with code 0" 2026-10-09T13:22:40.897485-07:00 cache-3 app[30042]: INFO worker 60 finished job 5b9c535ac4781438 in 5581 ms 2026-10-09T13:22:40.946337-07:00 edge-fr-1 sshd[49306]: Failed password for invalid user backup from 192.183.155.249 port 64526 ssh2 2026-10-09T13:22:40.982413-07:00 api-07 systemd[1]: session-43287.scope: Deactivated successfully. 2026-10-09T13:22:41.147710-07:00 web-01 postgres[14791]: LOG: checkpoint complete: wrote 3613 buffers (21%); 0 WAL file(s) added, 0 removed, 61 recycled; write=8412.552 s, sync=0.552 s, total=8412.552 s 2026-10-09T13:22:41.393831-07:00 worker-12 postgres[12014]: LOG: duration: 1109.768 ms statement: SELECT * FROM orders WHERE customer_id = 10621 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:41.502580-07:00 worker-12 nginx[1200]: 45.124.211.98 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 12784 "-" "curl/8.4.0" 2026-10-09T13:22:41.774101-07:00 web-02 haproxy[910]: 10.44.102.150:17946 [48853] http-in app/db-primary 9108/0/741/741/9108 500 21016 - - ---- 381/381/31/31/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:22:42.090863-07:00 web-02 sshd[3009]: Accepted publickey for müller from 45.120.27.191 port 26804 ssh2: ED25519 SHA256:d3a882de1e6dc682 2026-10-09T13:22:42.254474-07:00 bastion systemd[1]: session-62533.scope: Deactivated successfully. 2026-10-09T13:22:42.414539-07:00 cache-3 kubelet[800]: E1009 13:22:42.584050 9444 pod_workers.go:9444] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-ea1fe2a037fad5fe" 2026-10-09T13:22:42.468036-07:00 cache-3 app[30118]: INFO request_id=23ad54dc019abc1d method=GET path=/api/v2/orders status=200 duration=4591ms 2026-10-09T13:22:42.661135-07:00 web-03 cron[5291]: (zoë) CMD (/usr/bin/backup --quiet --target /srv/zoë) 2026-10-09T13:22:42.680904-07:00 edge-fr-1 postgres[12265]: LOG: duration: 5423.605 ms statement: SELECT * FROM orders WHERE customer_id = 81239 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:42.686284-07:00 web-01 sshd[14361]: Received disconnect from 45.92.222.38 port 36480:11: Bye Bye [preauth] 2026-10-09T13:22:42.725551-07:00 db-primary sshd[42015]: Failed password for invalid user sørensen from 192.39.181.94 port 63961 ssh2 2026-10-09T13:22:42.955234-07:00 edge-fr-1 nginx[1202]: 172.11.147.248 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 77498 "-" "python-requests/2.32.3" 2026-10-09T13:22:43.300456-07:00 api-07 kernel: [43494.377660] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.242.73.104 DST=10.0.406.406 LEN=99 TOS=0x00 PREC=0x00 TTL=99 ID=43494 DF PROTO=TCP SPT=24648 DPT=24648 WINDOW=43494 RES=0x00 SYN URGP=0 2026-10-09T13:22:43.448380-07:00 web-02 sshd[46981]: Failed password for invalid user ci from 203.179.175.157 port 57533 ssh2 2026-10-09T13:22:43.491251-07:00 worker-12 nginx[1200]: 172.227.170.199 - ci "POST /login HTTP/1.1" 404 39278 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:43.503595-07:00 worker-12 nginx[1200]: 172.216.201.233 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 85625 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:43.527889-07:00 db-replica haproxy[938]: 172.71.19.42:13783 [23713] http-in app/web-03 7672/0/713/713/7672 301 38464 - - ---- 423/423/52/52/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:22:43.569388-07:00 api-08 cron[39585]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:43.622431-07:00 api-08 app[30703]: INFO health check ok: db 428 ms, cache 428 ms, queue depth 59 2026-10-09T13:22:43.769553-07:00 bastion nginx[1210]: 45.149.87.234 - - "GET /.env HTTP/1.1" 204 5310 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:44.138931-07:00 api-08 app[30458]: INFO worker 31 finished job e9c021b3b8686f2d in 6421 ms 2026-10-09T13:22:44.319330-07:00 cache-3 cron[11318]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:22:44.683981-07:00 web-02 nginx[1204]: 192.177.119.234 - - "GET /static/main.css HTTP/1.1" 404 12079 "-" "kube-probe/1.31" 2026-10-09T13:22:44.795298-07:00 cache-3 app[30121]: INFO worker 42 finished job 26cf3208f412569e in 1679 ms 2026-10-09T13:22:44.858333-07:00 web-02 nginx[1204]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.110.165.219, server: app.example.com, request: "GET /health HTTP/1.1", upstream: "http://10.0.661.661:8080/health" 2026-10-09T13:22:44.888891-07:00 web-01 app[30864]: INFO request_id=c4f92f5cab3acb54 method=GET path=/admin status=502 duration=3322ms 2026-10-09T13:22:44.938735-07:00 bastion nginx[1200]: 192.131.76.31 - - "GET /wp-login.php HTTP/1.1" 200 72499 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:44.999818-07:00 worker-12 sshd[59050]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:22:45.078195-07:00 api-08 dockerd[700]: time="2026-10-09T13:22:45.078195-07:00" level=info msg="Container b91640b4387dbadc exited with code 0" 2026-10-09T13:22:45.096986-07:00 api-07 sshd[28825]: Connection closed by 91.104.184.212 port 7386 [preauth] 2026-10-09T13:22:45.149854-07:00 web-02 nginx[1210]: 192.99.210.200 - - "GET /metrics HTTP/1.1" 200 45989 "-" "Go-http-client/1.1" 2026-10-09T13:22:45.221464-07:00 web-02 app[30728]: INFO request_id=04688f2943e451bc method=GET path=/health status=200 duration=1423ms 2026-10-09T13:22:45.266516-07:00 cache-3 app[30815]: INFO worker 84 finished job f2134d6b30f7d548 in 5579 ms 2026-10-09T13:22:45.272600-07:00 db-primary nginx[1210]: 203.154.152.72 - - "GET /favicon.ico HTTP/1.1" 500 2440 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:45.280054-07:00 api-08 nginx[1202]: 192.184.158.129 - - "GET /health HTTP/1.1" 500 56283 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:45.629421-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577365.126:75823): pid=75823 uid=0 auid=3123 ses=366 msg='op=login id=3123 exe="/usr/sbin/sshd" hostname=? addr=192.244.126.83 terminal=/dev/pts/0 res=success' 2026-10-09T13:22:45.663178-07:00 db-replica app[30809]: INFO worker 68 finished job 41ad69bb7c957bba in 8405 ms 2026-10-09T13:22:45.913656-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577365.377:82209): pid=82209 uid=0 auid=9760 ses=738 msg='op=login id=9760 exe="/usr/sbin/sshd" hostname=? addr=172.104.181.134 terminal=/dev/pts/0 res=success' 2026-10-09T13:22:45.926049-07:00 edge-fr-1 postgres[24229]: LOG: duration: 4850.208 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:22:46.033899-07:00 edge-fr-1 kernel: [84954.812981] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.138.55.203 DST=10.0.758.758 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=84954 DF PROTO=TCP SPT=55673 DPT=55673 WINDOW=84954 RES=0x00 SYN URGP=0 2026-10-09T13:22:46.385680-07:00 db-primary app[30089]: INFO worker 86 finished job 305ce8e1b55a2c30 in 499 ms 2026-10-09T13:22:46.409695-07:00 edge-fr-1 postgres[18603]: LOG: duration: 1554.411 ms statement: SELECT * FROM orders WHERE customer_id = 88183 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:46.432683-07:00 db-replica kernel: [91310.874865] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.233.248.5 DST=10.0.276.276 LEN=95 TOS=0x00 PREC=0x00 TTL=95 ID=91310 DF PROTO=TCP SPT=5112 DPT=5112 WINDOW=91310 RES=0x00 SYN URGP=0 2026-10-09T13:22:46.442088-07:00 cache-3 sshd[35692]: Accepted publickey for priya from 91.207.62.104 port 58239 ssh2: ED25519 SHA256:d90f34c70766e120 2026-10-09T13:22:46.482315-07:00 bastion app[30196]: WARN slow query (2048 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '96 minutes' 2026-10-09T13:22:46.540583-07:00 web-01 haproxy[910]: 203.131.143.70:56668 [21902] http-in app/api-07 3439/0/584/584/3439 404 72807 - - ---- 308/308/47/47/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:22:46.640652-07:00 edge-fr-1 nginx[1200]: 172.249.97.111 - - "GET /static/main.css HTTP/1.1" 200 17156 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:46.902154-07:00 cache-3 cron[16585]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:22:47.010366-07:00 web-02 app[30573]: INFO worker 98 picked job 19ec9c3223840891 from queue webhooks 2026-10-09T13:22:47.245177-07:00 cache-3 app[30867]: INFO request_id=93dda7a828293604 method=GET path=/wp-login.php status=200 duration=9034ms 2026-10-09T13:22:47.519967-07:00 db-primary nginx[1204]: 172.242.185.99 - - "GET /admin HTTP/1.1" 200 9663 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:47.581174-07:00 api-07 nginx[1202]: 10.179.189.155 - - "GET /api/v2/users HTTP/1.1" 200 50195 "-" "Go-http-client/1.1" 2026-10-09T13:22:47.595163-07:00 db-primary sshd[30221]: Invalid user priya from 192.229.47.107 port 7024 2026-10-09T13:22:47.680098-07:00 web-02 kernel: [46129.195716] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.37.69.159 DST=10.0.776.776 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=46129 DF PROTO=TCP SPT=3702 DPT=3702 WINDOW=46129 RES=0x00 SYN URGP=0 2026-10-09T13:22:47.889246-07:00 cache-3 haproxy[926]: 10.194.118.101:36344 [66416] http-in app/web-02 2284/0/338/338/2284 200 75800 - - ---- 343/343/83/83/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:22:48.497825-07:00 bastion app[30857]: INFO worker 26 picked job 4279fe0def3d7e6a from queue emails 2026-10-09T13:22:48.792615-07:00 api-07 haproxy[948]: 192.151.214.48:65019 [81609] http-in app/db-replica 602/0/5/5/602 204 65053 - - ---- 840/840/22/22/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:22:48.860542-07:00 db-replica haproxy[940]: 45.238.185.201:6412 [34125] http-in app/api-08 7779/0/313/313/7779 200 25057 - - ---- 292/292/90/90/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:22:48.904991-07:00 api-08 nginx[1208]: 45.5.72.125 - deploy "POST /.env HTTP/1.1" 200 53118 "-" "python-requests/2.32.3" 2026-10-09T13:22:48.944915-07:00 api-07 cron[20188]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:22:49.009497-07:00 web-01 haproxy[948]: 45.161.78.254:54573 [23222] http-in app/api-08 2344/0/503/503/2344 204 87322 - - ---- 597/597/22/22/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:22:49.149824-07:00 db-replica postgres[30594]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 79434 remain, 3537 scanned (89% of total) 2026-10-09T13:22:49.198994-07:00 worker-12 nginx[1200]: 91.101.51.223 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 32933 "-" "Go-http-client/1.1" 2026-10-09T13:22:49.307664-07:00 web-01 sshd[44976]: Failed password for invalid user ci from 192.32.134.3 port 18399 ssh2 2026-10-09T13:22:49.380454-07:00 db-replica sshd[11557]: Invalid user ci from 91.144.156.114 port 62955 2026-10-09T13:22:49.381366-07:00 edge-fr-1 postgres[7236]: LOG: duration: 3178.190 ms statement: SELECT * FROM orders WHERE customer_id = 93136 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:49.416623-07:00 api-08 sshd[32760]: Connection closed by 192.249.214.227 port 49651 [preauth] 2026-10-09T13:22:49.595362-07:00 db-replica haproxy[938]: 192.2.23.47:24627 [50038] http-in app/web-03 3184/0/746/746/3184 200 23988 - - ---- 183/183/55/55/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:22:49.609400-07:00 edge-fr-1 nginx[1204]: 91.174.238.167 - - "GET /api/v2/users HTTP/1.1" 404 66624 "-" "python-requests/2.32.3" 2026-10-09T13:22:49.848547-07:00 cache-3 app[30253]: INFO health check ok: db 185 ms, cache 185 ms, queue depth 94 2026-10-09T13:22:50.054054-07:00 cache-3 systemd[1]: Started Session 70654 of User zoë. 2026-10-09T13:22:50.101196-07:00 web-03 nginx[1208]: 45.91.207.178 - sørensen "POST /wp-login.php HTTP/1.1" 200 3710 "-" "curl/8.4.0" 2026-10-09T13:22:50.168724-07:00 db-replica app[30606]: INFO order 34046 confirmed for akira in 9660 ms (region eu-west-1, queue emails) 2026-10-09T13:22:50.740046-07:00 db-replica app[30545]: INFO request_id=b49993c9f93143b4 method=GET path=/api/v2/users status=301 duration=9316ms 2026-10-09T13:22:50.803357-07:00 web-02 nginx[1207]: 91.37.172.111 - akira "POST /api/v2/users HTTP/1.1" 401 33688 "-" "kube-probe/1.31" 2026-10-09T13:22:51.061396-07:00 cache-3 app[30469]: INFO request_id=505c7e93755c36ae method=GET path=/wp-login.php status=200 duration=6869ms 2026-10-09T13:22:51.064158-07:00 web-03 nginx[1204]: 203.209.6.95 - - "GET /.env HTTP/1.1" 200 3711 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:51.110376-07:00 edge-fr-1 sshd[27277]: Invalid user françois from 10.182.73.186 port 48378 2026-10-09T13:22:51.282564-07:00 cache-3 nginx[1208]: 10.83.167.38 - - "GET /admin HTTP/1.1" 404 50923 "-" "python-requests/2.32.3" 2026-10-09T13:22:51.401903-07:00 api-07 haproxy[926]: Server app/web-02 is DOWN, reason: Layer4 timeout, check duration: 1370ms. 43 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:22:51.421325-07:00 worker-12 sshd[59660]: Invalid user backup from 203.154.99.234 port 64690 2026-10-09T13:22:51.563068-07:00 db-replica nginx[1209]: 172.187.92.91 - - "GET /.env HTTP/1.1" 301 38081 "-" "python-requests/2.32.3" 2026-10-09T13:22:51.706461-07:00 web-03 nginx[1207]: 10.237.164.38 - root "POST /.env HTTP/1.1" 502 65829 "-" "Go-http-client/1.1" 2026-10-09T13:22:51.789920-07:00 api-08 nginx[1201]: 45.109.37.118 - - "GET /api/v2/orders HTTP/1.1" 200 15465 "-" "python-requests/2.32.3" 2026-10-09T13:22:51.808948-07:00 web-01 sshd[14313]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:22:52.069939-07:00 web-03 nginx[1203]: 91.194.201.107 - - "GET /api/v2/orders HTTP/1.1" 404 72659 "-" "Go-http-client/1.1" 2026-10-09T13:22:52.180926-07:00 db-primary postgres[9764]: LOG: duration: 2101.65 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:22:52.280941-07:00 cache-3 sshd[8370]: Accepted publickey for root from 91.245.233.76 port 51850 ssh2: ED25519 SHA256:820c9317c7dd3169 2026-10-09T13:22:52.295714-07:00 worker-12 haproxy[909]: 10.101.230.138:26603 [78779] http-in app/bastion 8534/0/524/524/8534 302 32241 - - ---- 672/672/21/21/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:22:52.324451-07:00 web-01 nginx[1205]: 172.214.115.206 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 35087 "-" "kube-probe/1.31" 2026-10-09T13:22:52.491784-07:00 db-primary app[30197]: INFO order 25572 confirmed for backup in 1456 ms (region eu-west-1, queue emails) 2026-10-09T13:22:52.697326-07:00 cache-3 app[30446]: INFO health check ok: db 76 ms, cache 76 ms, queue depth 57 2026-10-09T13:22:52.785500-07:00 cache-3 nginx[1200]: 10.141.242.124 - - "GET /api/v2/users HTTP/1.1" 204 27970 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:52.890684-07:00 web-01 postgres[13741]: ERROR: deadlock detected 2026-10-09T13:22:52.899480-07:00 db-primary postgres[25346]: LOG: duration: 9701.668 ms statement: SELECT * FROM orders WHERE customer_id = 39325 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:22:52.923848-07:00 web-03 app[30091]: INFO worker 11 finished job e6fc1a9f3e822fcf in 8812 ms 2026-10-09T13:22:53.124721-07:00 edge-fr-1 app[30231]: WARN slow query (1550 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '83 minutes' 2026-10-09T13:22:53.176844-07:00 api-07 sshd[1572]: Failed password for invalid user sørensen from 45.110.1.21 port 11975 ssh2 2026-10-09T13:22:53.431889-07:00 db-primary app[30084]: INFO request_id=5d56f0d5afd85e95 method=GET path=/health status=301 duration=9822ms 2026-10-09T13:22:53.482928-07:00 web-03 app[30767]: INFO order 25494 confirmed for zoë in 9679 ms (region ap-northeast-1, queue orders) 2026-10-09T13:22:53.510769-07:00 api-07 nginx[1209]: 192.241.223.1 - - "GET /login HTTP/1.1" 404 59726 "-" "kube-probe/1.31" 2026-10-09T13:22:53.603180-07:00 web-03 nginx[1207]: 203.145.214.58 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 46631 "-" "python-requests/2.32.3" 2026-10-09T13:22:53.704219-07:00 web-03 nginx[1204]: 203.235.39.121 - - "GET /wp-login.php HTTP/1.1" 301 47166 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:53.876221-07:00 api-08 app[30594]: INFO worker 70 picked job 90837e936714daec from queue orders 2026-10-09T13:22:53.895616-07:00 web-03 sshd[14522]: Accepted publickey for akira from 203.133.113.77 port 49875 ssh2: ED25519 SHA256:191615cb4fc965b0 2026-10-09T13:22:54.015181-07:00 api-08 sshd[57532]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:22:54.141087-07:00 web-02 sshd[62542]: Connection closed by 45.144.83.144 port 7872 [preauth] 2026-10-09T13:22:54.266701-07:00 web-02 sshd[666]: Connection closed by 10.215.209.10 port 53729 [preauth] 2026-10-09T13:22:54.425109-07:00 db-primary dockerd[700]: time="2026-10-09T13:22:54.425109-07:00" level=info msg="Container cf1230f19af94007 exited with code 0" 2026-10-09T13:22:54.474481-07:00 cache-3 sshd[14657]: Failed password for invalid user akira from 192.53.228.9 port 31938 ssh2 2026-10-09T13:22:54.515666-07:00 edge-fr-1 app[30995]: INFO request_id=49bb0e19add7d2f9 method=GET path=/favicon.ico status=200 duration=3230ms 2026-10-09T13:22:54.614124-07:00 edge-fr-1 nginx[1209]: 172.245.163.244 - - "GET /.env HTTP/1.1" 500 9778 "-" "Go-http-client/1.1" 2026-10-09T13:22:54.644883-07:00 db-primary app[30085]: INFO request_id=d13610d347136a69 method=GET path=/wp-login.php status=404 duration=408ms 2026-10-09T13:22:55.098246-07:00 web-02 nginx[1209]: 172.8.222.76 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 45490 "-" "kube-probe/1.31" 2026-10-09T13:22:55.193333-07:00 web-03 nginx[1200]: 172.36.251.67 - - "GET /metrics HTTP/1.1" 200 33621 "-" "kube-probe/1.31" 2026-10-09T13:22:55.329916-07:00 db-primary app[30808]: INFO worker 12 picked job db8fc8eb03862055 from queue webhooks 2026-10-09T13:22:55.505928-07:00 web-02 app[30636]: INFO request_id=791db7ee416d9fa9 method=GET path=/api/v2/users status=200 duration=7632ms 2026-10-09T13:22:55.619748-07:00 edge-fr-1 app[30226]: INFO worker 97 finished job 76b24c9bb11a1e73 in 1783 ms 2026-10-09T13:22:55.729611-07:00 cache-3 app[30533]: INFO worker 76 finished job d651840c44849d51 in 9900 ms 2026-10-09T13:22:55.968645-07:00 web-01 nginx[1208]: 91.27.101.80 - - "GET /login HTTP/1.1" 302 86048 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:22:56.000459-07:00 web-01 app[30016]: INFO worker 32 picked job 34344a79aa2ba458 from queue invoices 2026-10-09T13:22:56.154223-07:00 web-01 sshd[14772]: Invalid user root from 91.117.11.28 port 19995 2026-10-09T13:22:56.468923-07:00 web-02 kernel: [49349.003991] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.75.241.25 DST=10.0.658.658 LEN=45 TOS=0x00 PREC=0x00 TTL=45 ID=49349 DF PROTO=TCP SPT=3951 DPT=3951 WINDOW=49349 RES=0x00 SYN URGP=0 2026-10-09T13:22:56.777134-07:00 web-01 sshd[41693]: Connection closed by 203.52.133.214 port 37217 [preauth] 2026-10-09T13:22:57.182832-07:00 bastion sshd[62817]: Connection closed by 192.85.150.46 port 60400 [preauth] 2026-10-09T13:22:57.366004-07:00 api-07 sshd[44130]: Accepted publickey for backup from 10.228.233.12 port 28681 ssh2: ED25519 SHA256:2263a1478a34730a 2026-10-09T13:22:57.402971-07:00 web-03 nginx[1202]: 192.207.86.23 - - "GET /favicon.ico HTTP/1.1" 500 71857 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:22:57.750312-07:00 web-02 haproxy[944]: 192.6.232.188:37682 [38344] http-in app/edge-fr-1 8228/0/437/437/8228 404 86760 - - ---- 159/159/14/14/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:22:57.769707-07:00 db-replica app[30128]: INFO request_id=106483b351c7a354 method=GET path=/static/app.js status=204 duration=8849ms 2026-10-09T13:22:57.777629-07:00 web-02 kernel: [37419.865061] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.235.1.135 DST=10.0.248.248 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=37419 DF PROTO=TCP SPT=43162 DPT=43162 WINDOW=37419 RES=0x00 SYN URGP=0 2026-10-09T13:22:57.971592-07:00 cache-3 sshd[2744]: Received disconnect from 192.29.234.249 port 46193:11: Bye Bye [preauth] 2026-10-09T13:22:58.023595-07:00 web-01 haproxy[912]: 91.83.99.162:30724 [42818] http-in app/cache-3 6107/0/690/690/6107 502 87796 - - ---- 131/131/23/23/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:22:58.063922-07:00 web-01 haproxy[912]: Server app/edge-fr-1 is UP, reason: Layer7 check passed, code: 200, check duration: 475ms. 94 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:22:58.151172-07:00 db-primary sshd[1670]: pam_unix(sshd:session): session opened for user sørensen(uid=8347) by (uid=0) 2026-10-09T13:22:58.187684-07:00 cache-3 app[30084]: INFO health check ok: db 105 ms, cache 105 ms, queue depth 30 2026-10-09T13:22:58.223781-07:00 cache-3 kernel: [38725.988525] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.219.8.244 DST=10.0.300.300 LEN=23 TOS=0x00 PREC=0x00 TTL=23 ID=38725 DF PROTO=TCP SPT=59674 DPT=59674 WINDOW=38725 RES=0x00 SYN URGP=0 2026-10-09T13:22:58.319628-07:00 web-02 sshd[10380]: Connection closed by 91.27.3.12 port 43661 [preauth] 2026-10-09T13:22:58.459372-07:00 db-primary postgres[25842]: LOG: duration: 8338.803 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:22:58.555396-07:00 api-08 kernel: [27074.894160] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.244.57.15 DST=10.0.996.996 LEN=54 TOS=0x00 PREC=0x00 TTL=54 ID=27074 DF PROTO=TCP SPT=38358 DPT=38358 WINDOW=27074 RES=0x00 SYN URGP=0 2026-10-09T13:22:58.593731-07:00 web-03 nginx[1200]: 172.177.145.235 - - "GET /login HTTP/1.1" 404 85069 "-" "kube-probe/1.31" 2026-10-09T13:22:59.001484-07:00 cache-3 app[30928]: DEBUG cache hit ratio 46% over the last minute (93441 lookups) 2026-10-09T13:22:59.189976-07:00 bastion sshd[7834]: Received disconnect from 203.113.60.120 port 4195:11: Bye Bye [preauth] 2026-10-09T13:22:59.435559-07:00 web-01 sshd[11902]: Invalid user backup from 45.146.159.24 port 38843 2026-10-09T13:22:59.484042-07:00 web-01 haproxy[946]: 91.243.122.196:45149 [75114] http-in app/db-replica 5091/0/345/345/5091 301 58653 - - ---- 957/957/37/37/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:22:59.607791-07:00 web-03 sshd[33470]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:22:59.795349-07:00 api-08 app[30647]: INFO worker 59 finished job 64bafa015aa2e8be in 8131 ms 2026-10-09T13:22:59.853829-07:00 api-08 app[30852]: INFO worker 35 picked job e3a3d618927c0913 from queue emails 2026-10-09T13:23:00.271638-07:00 db-replica nginx[1206]: 172.166.101.127 - - "GET /api/v2/users HTTP/1.1" 200 34916 "-" "Go-http-client/1.1" 2026-10-09T13:23:00.507637-07:00 web-01 sshd[41954]: Invalid user priya from 45.69.16.175 port 49016 2026-10-09T13:23:00.917140-07:00 api-08 nginx[1200]: 45.7.141.33 - - "GET /health HTTP/1.1" 502 3536 "-" "kube-probe/1.31" 2026-10-09T13:23:01.122554-07:00 api-07 sshd[36040]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:23:01.152039-07:00 web-01 sshd[36735]: Connection closed by 172.41.58.54 port 51351 [preauth] 2026-10-09T13:23:01.510769-07:00 api-07 nginx[1201]: 45.50.202.163 - - "GET /static/main.css HTTP/1.1" 204 8670 "-" "curl/8.4.0" 2026-10-09T13:23:01.572666-07:00 web-02 postgres[24742]: LOG: duration: 7899.671 ms statement: SELECT * FROM orders WHERE customer_id = 30276 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:01.606071-07:00 edge-fr-1 postgres[28205]: LOG: duration: 2719.395 ms statement: SELECT * FROM orders WHERE customer_id = 71652 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:01.927656-07:00 web-01 app[30158]: INFO worker 16 finished job 2c662588e379bc7a in 9580 ms 2026-10-09T13:23:02.105905-07:00 web-02 postgres[17430]: LOG: duration: 6027.925 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:02.264198-07:00 api-07 app[30490]: INFO request_id=2dac51c482dce742 method=GET path=/static/app.js status=200 duration=3539ms 2026-10-09T13:23:02.301492-07:00 edge-fr-1 app[30052]: INFO request_id=9961fa1bc2ae743c method=GET path=/api/v2/search?q=invoice status=500 duration=5355ms 2026-10-09T13:23:02.316267-07:00 web-03 nginx[1209]: 172.145.152.66 - - "GET /.env HTTP/1.1" 404 56833 "-" "kube-probe/1.31" 2026-10-09T13:23:02.464774-07:00 api-08 sshd[39754]: pam_unix(sshd:session): session opened for user ci(uid=6468) by (uid=0) 2026-10-09T13:23:02.497123-07:00 web-02 app[30947]: INFO request_id=2990ad1b1731322b method=GET path=/api/v2/search?q=invoice status=500 duration=5870ms 2026-10-09T13:23:02.551936-07:00 web-03 sshd[17567]: pam_unix(sshd:session): session opened for user müller(uid=2959) by (uid=0) 2026-10-09T13:23:02.609511-07:00 cache-3 haproxy[910]: 172.226.190.232:57221 [75495] http-in app/web-03 1253/0/587/587/1253 204 30540 - - ---- 156/156/57/57/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:23:02.818447-07:00 edge-fr-1 haproxy[909]: 91.64.55.221:16281 [50408] http-in app/web-02 1851/0/4/4/1851 404 86541 - - ---- 486/486/87/87/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:23:03.136215-07:00 bastion app[30041]: INFO request_id=efb4357c9e2ddb9c method=GET path=/login status=204 duration=1220ms 2026-10-09T13:23:03.282375-07:00 api-08 haproxy[923]: 192.112.222.95:62091 [19292] http-in app/bastion 5199/0/686/686/5199 502 21578 - - ---- 799/799/87/87/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:23:03.401399-07:00 bastion app[30155]: INFO worker 37 picked job d15ec8b978fb021d from queue orders 2026-10-09T13:23:03.466787-07:00 web-02 nginx[1203]: 91.211.107.177 - - "GET /metrics HTTP/1.1" 404 14995 "-" "kube-probe/1.31" 2026-10-09T13:23:03.594391-07:00 web-02 app[30126]: INFO order 97931 confirmed for sørensen in 8027 ms (region eu-west-1, queue webhooks) 2026-10-09T13:23:03.828136-07:00 api-07 kernel: [76708.286880] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.61.71.2 DST=10.0.491.491 LEN=49 TOS=0x00 PREC=0x00 TTL=49 ID=76708 DF PROTO=TCP SPT=48895 DPT=48895 WINDOW=76708 RES=0x00 SYN URGP=0 2026-10-09T13:23:03.853568-07:00 web-03 app[30195]: INFO worker 30 picked job 86fa23306be5e639 from queue emails 2026-10-09T13:23:04.309361-07:00 db-primary sshd[38452]: Connection closed by 10.162.156.19 port 21856 [preauth] 2026-10-09T13:23:04.321181-07:00 db-primary sshd[17611]: pam_unix(sshd:session): session opened for user müller(uid=2933) by (uid=0) 2026-10-09T13:23:04.511146-07:00 db-replica app[30022]: INFO worker 51 finished job c0e0a4fe0b6a37e2 in 9025 ms 2026-10-09T13:23:04.831170-07:00 web-01 nginx[1209]: 203.217.244.200 - - "GET /health HTTP/1.1" 502 65577 "-" "python-requests/2.32.3" 2026-10-09T13:23:04.935672-07:00 bastion nginx[1200]: 203.76.194.199 - - "GET /api/v2/orders HTTP/1.1" 200 39738 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:04.960465-07:00 worker-12 sshd[52157]: Accepted publickey for deploy from 10.135.108.118 port 65297 ssh2: ED25519 SHA256:7322906dc2faaf1d 2026-10-09T13:23:04.968852-07:00 web-01 dockerd[700]: time="2026-10-09T13:23:04.968852-07:00" level=info msg="Container d1c5e93bc0540ffc exited with code 0" 2026-10-09T13:23:05.020035-07:00 db-replica kubelet[800]: I1009 13:23:05.744968 6891 kubelet.go:6891] "Pod is terminating, skipping pod status update" pod="default/api-2ebf65f2d6b08bde" 2026-10-09T13:23:05.238792-07:00 bastion postgres[6930]: LOG: duration: 7571.323 ms statement: SELECT * FROM orders WHERE customer_id = 88814 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:05.292454-07:00 web-03 systemd[1]: session-45721.scope: Deactivated successfully. 2026-10-09T13:23:05.300715-07:00 web-01 kernel: [15976.845921] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.86.105.233 DST=10.0.607.607 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=15976 DF PROTO=TCP SPT=49512 DPT=49512 WINDOW=15976 RES=0x00 SYN URGP=0 2026-10-09T13:23:05.369603-07:00 web-01 nginx[1202]: 203.110.173.249 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 71289 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:05.406435-07:00 db-replica app[30241]: INFO order 89644 confirmed for akira in 6395 ms (region us-east-1, queue orders) 2026-10-09T13:23:05.428210-07:00 api-08 sshd[31248]: Connection closed by 172.163.169.74 port 41936 [preauth] 2026-10-09T13:23:05.446544-07:00 db-primary app[30647]: ERROR cache miss storm: 3502 misses in 6674 ms, key prefix session:backup 2026-10-09T13:23:05.488277-07:00 web-01 app[30453]: INFO request_id=4851392ae6c221a6 method=GET path=/api/v2/orders status=401 duration=5431ms 2026-10-09T13:23:05.514343-07:00 api-07 app[30530]: INFO request_id=199cbc61ddc19e77 method=GET path=/static/main.css status=404 duration=3612ms 2026-10-09T13:23:05.660039-07:00 db-replica sshd[1035]: Failed password for invalid user akira from 172.91.18.236 port 3600 ssh2 2026-10-09T13:23:05.671829-07:00 worker-12 kernel: [66188.739943] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.211.111.157 DST=10.0.329.329 LEN=89 TOS=0x00 PREC=0x00 TTL=89 ID=66188 DF PROTO=TCP SPT=50706 DPT=50706 WINDOW=66188 RES=0x00 SYN URGP=0 2026-10-09T13:23:05.762532-07:00 worker-12 nginx[1210]: 10.90.229.236 - françois "POST /static/main.css HTTP/1.1" 200 69395 "-" "Go-http-client/1.1" 2026-10-09T13:23:05.850722-07:00 web-03 app[30371]: INFO worker 91 picked job 92ee749868d33c29 from queue orders 2026-10-09T13:23:05.916213-07:00 edge-fr-1 nginx[1203]: 10.236.193.58 - - "GET /metrics HTTP/1.1" 200 65895 "-" "kube-probe/1.31" 2026-10-09T13:23:05.965113-07:00 cache-3 systemd[1]: Started Session 51167 of User zoë. 2026-10-09T13:23:06.045344-07:00 edge-fr-1 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:23:06.166207-07:00 worker-12 app[30436]: INFO worker 50 finished job a5a04db6005c161f in 7282 ms 2026-10-09T13:23:06.218778-07:00 db-primary app[30357]: INFO health check ok: db 817 ms, cache 817 ms, queue depth 34 2026-10-09T13:23:06.447566-07:00 db-replica sshd[30508]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:23:06.461299-07:00 api-07 sshd[50807]: Invalid user priya from 172.30.248.17 port 49661 2026-10-09T13:23:06.512158-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577386.768:35903): pid=35903 uid=0 auid=1526 ses=387 msg='op=login id=1526 exe="/usr/sbin/sshd" hostname=? addr=192.214.72.81 terminal=/dev/pts/0 res=success' 2026-10-09T13:23:06.834379-07:00 cache-3 sshd[8042]: Connection closed by 192.5.182.243 port 55596 [preauth] 2026-10-09T13:23:06.962447-07:00 edge-fr-1 postgres[2049]: LOG: duration: 5727.144 ms statement: SELECT * FROM orders WHERE customer_id = 44912 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:07.115615-07:00 bastion nginx[1204]: 45.113.125.69 - - "GET /wp-login.php HTTP/1.1" 200 87999 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:07.190262-07:00 api-08 app[30760]: INFO worker 62 picked job 38500499cf32a8ac from queue invoices 2026-10-09T13:23:07.214190-07:00 web-02 nginx[1210]: 10.190.43.82 - - "GET /health HTTP/1.1" 404 32309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:07.291532-07:00 web-02 nginx[1202]: 203.72.156.227 - - "GET /favicon.ico HTTP/1.1" 200 37064 "-" "curl/8.4.0" 2026-10-09T13:23:07.368762-07:00 api-07 systemd[1]: session-95073.scope: Deactivated successfully. 2026-10-09T13:23:07.418312-07:00 db-replica app[30962]: INFO request_id=fee5707bfcc4dd22 method=GET path=/login status=500 duration=3008ms 2026-10-09T13:23:07.451304-07:00 api-08 cron[50882]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:23:07.505469-07:00 worker-12 dockerd[700]: time="2026-10-09T13:23:07.505469-07:00" level=info msg="Container 86e7d468bae24d04 exited with code 0" 2026-10-09T13:23:07.613727-07:00 web-03 sshd[27464]: Connection closed by 91.228.237.168 port 12345 [preauth] 2026-10-09T13:23:07.677191-07:00 web-01 app[30907]: INFO order 81608 confirmed for deploy in 3475 ms (region ap-northeast-1, queue emails) 2026-10-09T13:23:07.741455-07:00 bastion nginx[1208]: 172.245.68.95 - - "GET /static/app.js HTTP/1.1" 200 71435 "-" "curl/8.4.0" 2026-10-09T13:23:07.745815-07:00 worker-12 haproxy[941]: 91.193.20.174:37903 [82754] http-in app/bastion 8169/0/298/298/8169 200 69016 - - ---- 922/922/92/92/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:07.753111-07:00 cache-3 app[30665]: INFO health check ok: db 674 ms, cache 674 ms, queue depth 21 2026-10-09T13:23:07.791520-07:00 bastion sshd[30223]: Invalid user priya from 91.239.32.28 port 14269 2026-10-09T13:23:07.965904-07:00 cache-3 systemd[1]: Started Session 45915 of User backup. 2026-10-09T13:23:08.111208-07:00 worker-12 systemd[1]: Started Session 24248 of User akira. 2026-10-09T13:23:08.247413-07:00 db-primary cron[15121]: (zoë) CMD (/usr/bin/backup --quiet --target /srv/zoë) 2026-10-09T13:23:08.295907-07:00 web-03 sshd[36746]: pam_unix(sshd:session): session opened for user deploy(uid=9891) by (uid=0) 2026-10-09T13:23:08.393756-07:00 web-02 app[30811]: INFO worker 76 finished job 3db9fbe636a0436c in 3146 ms 2026-10-09T13:23:08.443573-07:00 db-primary systemd[1]: Started Session 61473 of User deploy. 2026-10-09T13:23:08.645355-07:00 web-02 nginx[1204]: 203.190.69.118 - - "GET /metrics HTTP/1.1" 204 68252 "-" "curl/8.4.0" 2026-10-09T13:23:08.938886-07:00 bastion app[30959]: INFO worker 13 picked job be15b12ef2268191 from queue webhooks 2026-10-09T13:23:08.952945-07:00 db-replica app[30576]: INFO request_id=e919a5b5f7b21871 method=GET path=/api/v2/orders status=500 duration=8511ms 2026-10-09T13:23:09.063284-07:00 edge-fr-1 cron[13329]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:09.144089-07:00 db-primary sshd[40397]: Accepted publickey for akira from 203.91.32.167 port 6129 ssh2: ED25519 SHA256:246fb9a74e3eb107 2026-10-09T13:23:09.257049-07:00 cache-3 nginx[1210]: 172.54.231.38 - - "GET /favicon.ico HTTP/1.1" 404 66383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:09.342961-07:00 worker-12 app[30559]: INFO worker 90 picked job a7e211820a3be0b0 from queue invoices 2026-10-09T13:23:09.391820-07:00 web-01 nginx[1201]: 192.236.39.9 - müller "POST /health HTTP/1.1" 301 29843 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:09.442696-07:00 web-02 kernel: [72645.808687] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.221.6.113 DST=10.0.524.524 LEN=95 TOS=0x00 PREC=0x00 TTL=95 ID=72645 DF PROTO=TCP SPT=19351 DPT=19351 WINDOW=72645 RES=0x00 SYN URGP=0 2026-10-09T13:23:09.513356-07:00 cache-3 systemd[1]: session-70138.scope: Deactivated successfully. 2026-10-09T13:23:09.571800-07:00 bastion app[30883]: INFO order 76847 confirmed for deploy in 9266 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:23:09.748411-07:00 edge-fr-1 haproxy[948]: 91.77.252.157:3761 [23542] http-in app/edge-fr-1 6603/0/513/513/6603 200 80878 - - ---- 325/325/84/84/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:23:09.762363-07:00 web-03 nginx[1204]: 45.122.191.170 - - "GET /admin HTTP/1.1" 200 49929 "-" "curl/8.4.0" 2026-10-09T13:23:09.763892-07:00 worker-12 systemd[1]: Started Session 14673 of User root. 2026-10-09T13:23:09.766835-07:00 web-01 app[30174]: INFO request_id=d0463d1b52151f77 method=GET path=/.env status=404 duration=1528ms 2026-10-09T13:23:09.807495-07:00 db-primary systemd[1]: session-65549.scope: Deactivated successfully. 2026-10-09T13:23:09.896855-07:00 edge-fr-1 haproxy[919]: 172.253.217.200:57846 [70550] http-in app/db-primary 9813/0/277/277/9813 204 17681 - - ---- 913/913/48/48/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:23:09.996122-07:00 web-01 app[30550]: INFO worker 58 finished job f22163a988b580c0 in 6251 ms 2026-10-09T13:23:10.113042-07:00 bastion cron[22345]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:23:10.149597-07:00 web-03 kernel: [56457.969506] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.2.51.103 DST=10.0.491.491 LEN=39 TOS=0x00 PREC=0x00 TTL=39 ID=56457 DF PROTO=TCP SPT=12124 DPT=12124 WINDOW=56457 RES=0x00 SYN URGP=0 2026-10-09T13:23:10.150121-07:00 edge-fr-1 haproxy[915]: 203.206.13.196:63409 [89068] http-in app/api-07 9848/0/235/235/9848 200 12765 - - ---- 709/709/33/33/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:23:10.351299-07:00 web-01 nginx[1205]: 192.61.188.239 - - "GET /api/v2/orders HTTP/1.1" 404 35187 "-" "Go-http-client/1.1" 2026-10-09T13:23:10.752756-07:00 cache-3 haproxy[919]: 192.58.6.53:3431 [82002] http-in app/api-08 7673/0/20/20/7673 404 27982 - - ---- 665/665/93/93/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:23:10.835708-07:00 web-02 app[30059]: INFO order 59226 confirmed for zoë in 9461 ms (region us-east-1, queue orders) 2026-10-09T13:23:11.353618-07:00 web-02 sshd[26456]: Received disconnect from 203.184.216.45 port 24103:11: Bye Bye [preauth] 2026-10-09T13:23:11.404661-07:00 bastion app[30958]: INFO worker 36 finished job 1c6f3926f5436ef5 in 6157 ms 2026-10-09T13:23:11.489881-07:00 web-03 haproxy[943]: 192.171.55.225:35021 [40302] http-in app/bastion 5827/0/804/804/5827 404 5741 - - ---- 195/195/53/53/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:23:11.553430-07:00 api-08 app[30550]: INFO health check ok: db 355 ms, cache 355 ms, queue depth 51 2026-10-09T13:23:11.679088-07:00 web-01 kernel: [99497.468328] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.76.56.152 DST=10.0.851.851 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=99497 DF PROTO=TCP SPT=3700 DPT=3700 WINDOW=99497 RES=0x00 SYN URGP=0 2026-10-09T13:23:11.819434-07:00 db-primary app[30352]: INFO order 17828 confirmed for sørensen in 1942 ms (region eu-west-1, queue webhooks) 2026-10-09T13:23:11.840363-07:00 web-01 nginx[1209]: 10.148.130.124 - - "GET /api/v2/users HTTP/1.1" 502 74723 "-" "curl/8.4.0" 2026-10-09T13:23:12.091223-07:00 web-03 app[30818]: INFO request_id=81145f0ee6bf3c9f method=GET path=/api/v2/orders/8841 status=502 duration=8046ms 2026-10-09T13:23:12.362124-07:00 web-03 app[30622]: INFO request_id=2a7e82be2285ce0f method=GET path=/favicon.ico status=301 duration=9871ms 2026-10-09T13:23:12.465086-07:00 web-01 haproxy[935]: 203.114.9.141:35438 [37652] http-in app/api-08 5851/0/517/517/5851 200 6334 - - ---- 414/414/22/22/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:12.803929-07:00 db-primary systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:23:12.820628-07:00 api-08 app[30092]: INFO worker 68 picked job d2638b74dd2a4b57 from queue webhooks 2026-10-09T13:23:12.875705-07:00 web-02 nginx[1201]: 192.170.180.242 - backup "POST /.env HTTP/1.1" 200 62421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:13.005655-07:00 db-replica haproxy[946]: 10.214.192.230:53933 [88657] http-in app/web-01 1322/0/138/138/1322 401 41901 - - ---- 182/182/89/89/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:23:13.009219-07:00 edge-fr-1 sshd[30267]: Invalid user zoë from 45.178.70.237 port 51257 2026-10-09T13:23:13.250302-07:00 db-primary app[30140]: INFO request_id=9e37fda1ee32fc8a method=GET path=/admin status=301 duration=6226ms 2026-10-09T13:23:13.279733-07:00 api-08 sshd[50353]: Invalid user zoë from 203.7.104.18 port 57696 2026-10-09T13:23:13.473877-07:00 edge-fr-1 sshd[9150]: Failed password for invalid user root from 203.157.201.150 port 25285 ssh2 2026-10-09T13:23:13.619655-07:00 worker-12 app[30751]: INFO request_id=e1a579751f322330 method=GET path=/api/v2/users status=200 duration=4056ms 2026-10-09T13:23:13.652493-07:00 web-03 sshd[42447]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:23:13.862796-07:00 db-replica app[30106]: INFO worker 17 picked job abd175e269e7963a from queue emails 2026-10-09T13:23:13.930175-07:00 web-02 sshd[432]: Received disconnect from 45.154.35.111 port 1376:11: Bye Bye [preauth] 2026-10-09T13:23:14.051230-07:00 api-08 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:23:14.085842-07:00 api-08 kernel: [96263.536712] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.196.249.180 DST=10.0.872.872 LEN=83 TOS=0x00 PREC=0x00 TTL=83 ID=96263 DF PROTO=TCP SPT=55804 DPT=55804 WINDOW=96263 RES=0x00 SYN URGP=0 2026-10-09T13:23:14.218832-07:00 db-primary postgres[30071]: LOG: duration: 4943.445 ms statement: SELECT * FROM orders WHERE customer_id = 26032 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:14.319587-07:00 edge-fr-1 app[30582]: INFO health check ok: db 459 ms, cache 459 ms, queue depth 75 2026-10-09T13:23:14.355358-07:00 worker-12 app[30695]: INFO health check ok: db 964 ms, cache 964 ms, queue depth 94 2026-10-09T13:23:14.791511-07:00 api-08 sshd[50291]: Failed password for invalid user akira from 172.34.13.123 port 35420 ssh2 2026-10-09T13:23:14.838809-07:00 api-07 nginx[1208]: 203.39.205.100 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 16075 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:14.875410-07:00 edge-fr-1 nginx[1208]: 172.79.60.90 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 37478 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:14.883323-07:00 bastion sshd[47026]: Invalid user müller from 91.63.239.248 port 17381 2026-10-09T13:23:14.910874-07:00 web-02 app[30905]: INFO worker 69 finished job 464afb20b79024ac in 9355 ms 2026-10-09T13:23:14.984234-07:00 cache-3 nginx[1209]: 91.246.169.89 - - "GET /admin HTTP/1.1" 200 11800 "-" "kube-probe/1.31" 2026-10-09T13:23:15.079596-07:00 web-01 app[30413]: INFO health check ok: db 253 ms, cache 253 ms, queue depth 36 2026-10-09T13:23:15.194216-07:00 api-07 app[30731]: INFO order 46649 confirmed for sørensen in 7915 ms (region us-east-1, queue invoices) 2026-10-09T13:23:15.227727-07:00 web-01 app[30463]: INFO worker 57 finished job ac434729dd51d8ea in 2172 ms 2026-10-09T13:23:15.248072-07:00 web-02 app[30160]: INFO worker 58 picked job f6428828ae2bd759 from queue invoices 2026-10-09T13:23:15.536561-07:00 worker-12 cron[6459]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:15.583618-07:00 db-primary sshd[46133]: Received disconnect from 10.241.54.152 port 35319:11: Bye Bye [preauth] 2026-10-09T13:23:15.716602-07:00 web-02 app[30901]: INFO request_id=cc95303fb482d80b method=GET path=/api/v2/orders/8841 status=200 duration=9531ms 2026-10-09T13:23:15.915025-07:00 db-primary app[30316]: INFO request_id=6d14fce82839252b method=GET path=/health status=500 duration=343ms 2026-10-09T13:23:16.161804-07:00 edge-fr-1 app[30982]: INFO request_id=54da7b3af746530f method=GET path=/login status=301 duration=8292ms 2026-10-09T13:23:16.361087-07:00 db-primary nginx[1204]: 91.56.125.28 - - "GET /static/app.js HTTP/1.1" 204 72860 "-" "python-requests/2.32.3" 2026-10-09T13:23:16.517754-07:00 web-03 sshd[7473]: Received disconnect from 10.90.69.36 port 64807:11: Bye Bye [preauth] 2026-10-09T13:23:16.559262-07:00 web-01 postgres[12418]: LOG: duration: 3118.759 ms statement: SELECT * FROM orders WHERE customer_id = 53757 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:16.920645-07:00 bastion nginx[1205]: 45.77.175.55 - - "GET /.env HTTP/1.1" 302 36559 "-" "Go-http-client/1.1" 2026-10-09T13:23:16.930929-07:00 db-primary app[30892]: INFO request_id=0f3637f205827ee7 method=GET path=/favicon.ico status=401 duration=6536ms 2026-10-09T13:23:16.985853-07:00 db-replica postgres[4798]: LOG: duration: 8225.693 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:17.376612-07:00 worker-12 haproxy[910]: 10.27.73.3:18194 [52746] http-in app/web-02 5734/0/544/544/5734 404 35040 - - ---- 184/184/97/97/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:17.433516-07:00 cache-3 haproxy[947]: 203.154.140.106:17998 [96269] http-in app/edge-fr-1 2187/0/673/673/2187 401 65187 - - ---- 725/725/59/59/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:17.513739-07:00 web-02 sshd[15195]: pam_unix(sshd:session): session opened for user backup(uid=3501) by (uid=0) 2026-10-09T13:23:17.618637-07:00 edge-fr-1 app[30587]: INFO worker 90 picked job bb52b039d359f7eb from queue invoices 2026-10-09T13:23:17.893313-07:00 api-07 sshd[35508]: Invalid user akira from 172.35.84.41 port 57249 2026-10-09T13:23:18.049965-07:00 edge-fr-1 sshd[16429]: Accepted publickey for sørensen from 172.64.90.31 port 16366 ssh2: ED25519 SHA256:3858df49099fba64 2026-10-09T13:23:18.094937-07:00 worker-12 nginx[1206]: 203.201.29.169 - - "GET /static/main.css HTTP/1.1" 204 3438 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:18.115442-07:00 web-03 app[30383]: INFO health check ok: db 413 ms, cache 413 ms, queue depth 86 2026-10-09T13:23:18.373211-07:00 edge-fr-1 nginx[1200]: 45.46.114.168 - - "GET /wp-login.php HTTP/1.1" 200 1081 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:18.385366-07:00 bastion postgres[25801]: LOG: duration: 3490.240 ms statement: SELECT * FROM orders WHERE customer_id = 56624 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:18.568605-07:00 web-03 sshd[13590]: Invalid user priya from 203.236.37.137 port 19514 2026-10-09T13:23:18.591627-07:00 bastion sshd[21134]: Invalid user backup from 10.173.207.133 port 24681 2026-10-09T13:23:18.596675-07:00 web-03 nginx[1208]: 45.141.154.14 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 54297 "-" "curl/8.4.0" 2026-10-09T13:23:18.616175-07:00 db-replica app[30926]: INFO worker 17 finished job 7f1478d09333accc in 3143 ms 2026-10-09T13:23:18.743408-07:00 api-08 postgres[9661]: LOG: duration: 877.761 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:19.135879-07:00 web-01 app[30525]: INFO order 30277 confirmed for müller in 5383 ms (region eu-west-1, queue emails) 2026-10-09T13:23:19.565569-07:00 web-01 kernel: [16699.150233] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.24.232.97 DST=10.0.500.500 LEN=24 TOS=0x00 PREC=0x00 TTL=24 ID=16699 DF PROTO=TCP SPT=18968 DPT=18968 WINDOW=16699 RES=0x00 SYN URGP=0 2026-10-09T13:23:19.584515-07:00 cache-3 app[30318]: INFO request_id=8c5010fda6ee2f22 method=GET path=/wp-login.php status=200 duration=3649ms 2026-10-09T13:23:19.765328-07:00 cache-3 nginx[1210]: 192.218.144.181 - - "GET /health HTTP/1.1" 204 55734 "-" "python-requests/2.32.3" 2026-10-09T13:23:19.789328-07:00 worker-12 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 45.230.19.75, server: app.example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.230.230:8080/favicon.ico" 2026-10-09T13:23:19.819347-07:00 web-03 kernel: [96000.058618] TCP: request_sock_TCP: Possible SYN flooding on port 49545. Sending cookies. Check SNMP counters. 2026-10-09T13:23:19.834358-07:00 web-02 sshd[24013]: Failed password for invalid user zoë from 203.121.99.80 port 32153 ssh2 2026-10-09T13:23:20.027477-07:00 cache-3 systemd[1]: session-84104.scope: Deactivated successfully. 2026-10-09T13:23:20.769025-07:00 web-02 app[30079]: WARN retrying upstream 45.230.120.44:42260 after timeout (1208 ms), attempt 1 of 3 2026-10-09T13:23:20.795600-07:00 cache-3 postgres[26453]: LOG: duration: 5962.655 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:20.915917-07:00 web-02 haproxy[947]: 192.86.27.164:3433 [11844] http-in app/web-03 7134/0/210/210/7134 200 50616 - - ---- 688/688/53/53/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:21.086072-07:00 api-08 cron[7091]: (müller) CMD (/usr/bin/backup --quiet --target /srv/müller) 2026-10-09T13:23:21.245401-07:00 cache-3 sshd[51678]: pam_unix(sshd:session): session opened for user sørensen(uid=7059) by (uid=0) 2026-10-09T13:23:21.269033-07:00 edge-fr-1 app[30954]: INFO request_id=854d3659036d9dae method=GET path=/static/main.css status=302 duration=2166ms 2026-10-09T13:23:21.277028-07:00 edge-fr-1 sshd[59265]: Accepted publickey for priya from 172.212.231.204 port 39472 ssh2: ED25519 SHA256:b14dd67ee975a805 2026-10-09T13:23:21.347871-07:00 web-02 nginx[1200]: 203.19.2.166 - - "GET /favicon.ico HTTP/1.1" 200 51670 "-" "Go-http-client/1.1" 2026-10-09T13:23:21.372005-07:00 db-primary app[30641]: INFO worker 91 picked job c3c37e3c6d223b59 from queue invoices 2026-10-09T13:23:21.473578-07:00 web-03 app[30524]: INFO health check ok: db 169 ms, cache 169 ms, queue depth 76 2026-10-09T13:23:21.496221-07:00 web-03 nginx[1205]: 172.167.1.39 - sørensen "POST /wp-login.php HTTP/1.1" 302 86625 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:21.563944-07:00 web-01 dockerd[700]: time="2026-10-09T13:23:21.563944-07:00" level=info msg="Container 5797055a733cf694 exited with code 0" 2026-10-09T13:23:21.648314-07:00 web-03 sshd[42846]: Invalid user ci from 172.249.145.250 port 19213 2026-10-09T13:23:21.677214-07:00 bastion app[30065]: INFO worker 51 picked job 1d3dc280dec5ee93 from queue invoices 2026-10-09T13:23:21.815588-07:00 api-07 app[30361]: INFO request_id=e7bd757b29b0fb47 method=GET path=/favicon.ico status=502 duration=4342ms 2026-10-09T13:23:21.827262-07:00 api-07 nginx[1206]: 45.213.82.12 - - "GET /wp-login.php HTTP/1.1" 200 82601 "-" "kube-probe/1.31" 2026-10-09T13:23:21.936776-07:00 web-01 cron[52615]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:22.025477-07:00 db-primary app[30777]: INFO health check ok: db 724 ms, cache 724 ms, queue depth 17 2026-10-09T13:23:22.095788-07:00 web-03 kernel: [40618.367087] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.138.89.251 DST=10.0.369.369 LEN=85 TOS=0x00 PREC=0x00 TTL=85 ID=40618 DF PROTO=TCP SPT=60098 DPT=60098 WINDOW=40618 RES=0x00 SYN URGP=0 2026-10-09T13:23:22.096750-07:00 edge-fr-1 nginx[1204]: 91.222.71.118 - - "GET /favicon.ico HTTP/1.1" 200 257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:22.131716-07:00 web-01 haproxy[917]: 172.15.133.75:50636 [15722] http-in app/cache-3 4916/0/478/478/4916 404 78401 - - ---- 135/135/57/57/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:23:22.263387-07:00 bastion postgres[29505]: LOG: duration: 9224.809 ms statement: SELECT * FROM orders WHERE customer_id = 28073 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:22.344851-07:00 db-primary app[30379]: INFO request_id=06a91c961a716778 method=GET path=/api/v2/orders status=200 duration=8791ms 2026-10-09T13:23:22.539970-07:00 api-08 haproxy[950]: 45.214.223.16:35801 [60327] http-in app/edge-fr-1 9650/0/249/249/9650 500 8716 - - ---- 754/754/41/41/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:23:22.558587-07:00 web-01 app[30796]: INFO order 23743 confirmed for françois in 6286 ms (region eu-west-1, queue emails) 2026-10-09T13:23:22.558840-07:00 api-08 cron[32201]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:22.586040-07:00 web-02 nginx[1210]: 203.109.221.138 - - "GET /wp-login.php HTTP/1.1" 502 490 "-" "Go-http-client/1.1" 2026-10-09T13:23:22.669877-07:00 edge-fr-1 haproxy[946]: 192.100.15.115:8981 [88369] http-in app/bastion 7907/0/262/262/7907 301 64982 - - ---- 109/109/71/71/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:23:23.139497-07:00 web-01 nginx[1204]: 203.241.8.251 - - "GET /.env HTTP/1.1" 500 55356 "-" "Go-http-client/1.1" 2026-10-09T13:23:23.184127-07:00 web-01 postgres[31129]: LOG: checkpoint complete: wrote 8944 buffers (62%); 0 WAL file(s) added, 0 removed, 94 recycled; write=2627.150 s, sync=0.150 s, total=2627.150 s 2026-10-09T13:23:23.394694-07:00 api-07 app[30684]: INFO order 88166 confirmed for ci in 3340 ms (region ap-northeast-1, queue emails) 2026-10-09T13:23:23.395734-07:00 web-01 postgres[21186]: LOG: duration: 7083.996 ms statement: SELECT * FROM orders WHERE customer_id = 64068 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:23.703802-07:00 edge-fr-1 nginx[1203]: 172.183.228.247 - - "GET /login HTTP/1.1" 200 10439 "-" "curl/8.4.0" 2026-10-09T13:23:23.732908-07:00 web-02 cron[27553]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:23:23.769456-07:00 api-07 nginx[1201]: 172.113.99.86 - - "GET /health HTTP/1.1" 204 17613 "-" "python-requests/2.32.3" 2026-10-09T13:23:23.832472-07:00 db-replica nginx[1207]: 203.109.29.222 - - "GET /api/v2/orders HTTP/1.1" 200 78936 "-" "python-requests/2.32.3" 2026-10-09T13:23:23.913494-07:00 web-02 app[30013]: INFO order 88911 confirmed for backup in 4898 ms (region eu-west-1, queue orders) 2026-10-09T13:23:24.027453-07:00 web-01 nginx[1210]: 192.147.239.117 - - "GET /api/v2/orders HTTP/1.1" 302 86962 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:24.138252-07:00 web-03 app[30964]: INFO request_id=c85e16158e140837 method=GET path=/static/main.css status=404 duration=9708ms 2026-10-09T13:23:24.218708-07:00 web-01 app[30477]: DEBUG cache hit ratio 2% over the last minute (28371 lookups) 2026-10-09T13:23:24.274430-07:00 web-03 app[30572]: INFO worker 39 picked job e176c76942cd9b56 from queue orders 2026-10-09T13:23:24.582186-07:00 api-07 sshd[3822]: pam_unix(sshd:session): session opened for user backup(uid=6391) by (uid=0) 2026-10-09T13:23:24.687494-07:00 db-primary nginx[1204]: 10.199.203.66 - - "GET /static/app.js HTTP/1.1" 200 64569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:24.740274-07:00 bastion sshd[13286]: Failed password for invalid user root from 192.84.126.248 port 13043 ssh2 2026-10-09T13:23:24.749958-07:00 cache-3 sshd[29173]: Connection closed by 192.190.56.49 port 20920 [preauth] 2026-10-09T13:23:24.802767-07:00 api-08 app[30978]: INFO worker 50 picked job d29e376b8fe802cd from queue webhooks 2026-10-09T13:23:24.903953-07:00 db-replica app[30525]: INFO order 23001 confirmed for deploy in 7577 ms (region us-east-1, queue orders) 2026-10-09T13:23:25.035571-07:00 web-03 haproxy[944]: 45.253.153.97:63750 [64034] http-in app/cache-3 189/0/890/890/189 404 83859 - - ---- 383/383/18/18/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:25.332515-07:00 cache-3 nginx[1208]: 91.1.128.72 - françois "POST /favicon.ico HTTP/1.1" 502 60523 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:25.382412-07:00 edge-fr-1 postgres[28909]: LOG: checkpoint complete: wrote 7543 buffers (36%); 0 WAL file(s) added, 0 removed, 97 recycled; write=1520.381 s, sync=0.381 s, total=1520.381 s 2026-10-09T13:23:25.411367-07:00 db-primary app[30302]: INFO worker 31 finished job 285a332e28e8b5ea in 379 ms 2026-10-09T13:23:25.486736-07:00 worker-12 sshd[27219]: Connection closed by 91.245.109.90 port 50033 [preauth] 2026-10-09T13:23:25.543760-07:00 web-02 app[30896]: INFO order 50974 confirmed for müller in 8258 ms (region us-east-1, queue orders) 2026-10-09T13:23:25.670835-07:00 web-03 nginx[1207]: 10.50.33.49 - deploy "POST /api/v2/orders HTTP/1.1" 404 76021 "-" "curl/8.4.0" 2026-10-09T13:23:25.695399-07:00 cache-3 nginx[1202]: 203.70.29.33 - françois "POST /static/main.css HTTP/1.1" 302 84031 "-" "curl/8.4.0" 2026-10-09T13:23:25.789058-07:00 bastion kernel: [52104.064647] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.116.146.228 DST=10.0.746.746 LEN=17 TOS=0x00 PREC=0x00 TTL=17 ID=52104 DF PROTO=TCP SPT=23539 DPT=23539 WINDOW=52104 RES=0x00 SYN URGP=0 2026-10-09T13:23:25.844450-07:00 cache-3 haproxy[921]: 10.128.106.204:1263 [56417] http-in app/db-replica 7103/0/552/552/7103 302 39230 - - ---- 632/632/47/47/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:23:25.978055-07:00 db-primary cron[9657]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:26.399640-07:00 api-07 app[30367]: INFO worker 12 finished job 02a6983dbb20bd04 in 227 ms 2026-10-09T13:23:26.420916-07:00 web-03 sshd[31106]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:23:26.570812-07:00 web-03 haproxy[932]: 192.239.115.15:38989 [21560] http-in app/bastion 5486/0/989/989/5486 404 60581 - - ---- 554/554/50/50/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:23:26.587233-07:00 edge-fr-1 sshd[38447]: Failed password for invalid user sørensen from 91.218.250.12 port 46420 ssh2 2026-10-09T13:23:26.866163-07:00 web-01 nginx[1200]: 91.110.20.196 - - "GET /metrics HTTP/1.1" 200 30118 "-" "curl/8.4.0" 2026-10-09T13:23:27.060354-07:00 cache-3 app[30474]: INFO worker 80 picked job c74a4e890d2deed6 from queue invoices 2026-10-09T13:23:27.932028-07:00 web-02 postgres[11710]: LOG: duration: 1299.661 ms statement: SELECT * FROM orders WHERE customer_id = 54656 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:28.223133-07:00 edge-fr-1 sshd[51355]: Invalid user akira from 192.52.49.160 port 4386 2026-10-09T13:23:28.273280-07:00 api-07 app[30882]: INFO worker 21 finished job d2f462d096a07a26 in 1487 ms 2026-10-09T13:23:28.294829-07:00 bastion systemd[1]: session-37022.scope: Deactivated successfully. 2026-10-09T13:23:28.422182-07:00 web-03 app[30170]: WARN retrying upstream 10.204.177.16:4953 after timeout (9990 ms), attempt 2 of 3 2026-10-09T13:23:28.498270-07:00 db-primary nginx[1206]: 203.126.231.152 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 9374 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:28.522395-07:00 api-08 app[30698]: INFO order 41255 confirmed for ci in 9373 ms (region us-east-1, queue invoices) 2026-10-09T13:23:28.524780-07:00 worker-12 app[30896]: INFO worker 35 picked job 047df9520cde4c50 from queue webhooks 2026-10-09T13:23:28.529653-07:00 bastion app[30420]: INFO worker 92 picked job 52a955391218b040 from queue webhooks 2026-10-09T13:23:28.607905-07:00 worker-12 nginx[1203]: 10.188.121.135 - - "GET /login HTTP/1.1" 401 48802 "-" "curl/8.4.0" 2026-10-09T13:23:28.661927-07:00 web-03 dockerd[700]: time="2026-10-09T13:23:28.661927-07:00" level=warning msg="Health check for container 8d3d747a991f91d8 error: context deadline exceeded" 2026-10-09T13:23:28.827086-07:00 worker-12 app[30694]: DEBUG cache hit ratio 42% over the last minute (22804 lookups) 2026-10-09T13:23:29.363491-07:00 web-02 haproxy[910]: 203.93.77.1:9045 [43899] http-in app/web-03 2825/0/904/904/2825 500 80276 - - ---- 901/901/60/60/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:23:29.397851-07:00 db-replica sshd[13017]: Accepted publickey for backup from 91.162.42.147 port 20203 ssh2: ED25519 SHA256:a4a43db60f11520a 2026-10-09T13:23:29.497026-07:00 edge-fr-1 app[30520]: INFO request_id=39b14fb18ce9ce2b method=GET path=/wp-login.php status=301 duration=1815ms 2026-10-09T13:23:29.556659-07:00 db-primary app[30739]: DEBUG cache hit ratio 9% over the last minute (64581 lookups) 2026-10-09T13:23:29.692084-07:00 api-08 app[30722]: INFO worker 35 finished job 58e19c3dfd294934 in 8946 ms 2026-10-09T13:23:29.973949-07:00 web-02 sshd[27768]: Connection closed by 10.38.75.28 port 8709 [preauth] 2026-10-09T13:23:30.016056-07:00 api-07 postgres[30033]: LOG: duration: 7461.301 ms statement: SELECT * FROM orders WHERE customer_id = 15892 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:30.045017-07:00 web-03 app[30171]: INFO request_id=3a0595d7e1d7d1f9 method=GET path=/favicon.ico status=401 duration=7302ms 2026-10-09T13:23:30.120007-07:00 worker-12 nginx[1203]: 192.228.135.106 - - "GET /api/v2/users HTTP/1.1" 500 44485 "-" "Go-http-client/1.1" 2026-10-09T13:23:30.183819-07:00 web-03 app[30843]: INFO worker 68 finished job 5944b9d001040a75 in 2793 ms 2026-10-09T13:23:30.185470-07:00 api-08 app[30633]: INFO worker 84 picked job b6fa32cf6a123046 from queue invoices 2026-10-09T13:23:30.732621-07:00 api-07 sshd[40748]: Accepted publickey for zoë from 10.38.131.119 port 13512 ssh2: ED25519 SHA256:b9998a0b828f1abd 2026-10-09T13:23:30.845774-07:00 worker-12 app[30201]: INFO health check ok: db 803 ms, cache 803 ms, queue depth 89 2026-10-09T13:23:30.861007-07:00 worker-12 sshd[60297]: Connection closed by 91.242.198.15 port 36011 [preauth] 2026-10-09T13:23:31.132455-07:00 cache-3 sshd[42461]: Failed password for invalid user sørensen from 10.253.38.140 port 17545 ssh2 2026-10-09T13:23:31.225802-07:00 web-03 app[30309]: INFO worker 82 picked job 756a766c3df63a08 from queue orders 2026-10-09T13:23:31.248992-07:00 db-replica sshd[19934]: Connection closed by 91.164.13.245 port 24229 [preauth] 2026-10-09T13:23:31.458837-07:00 web-01 systemd[1]: session-48330.scope: Deactivated successfully. 2026-10-09T13:23:31.575458-07:00 api-08 nginx[1205]: 10.188.95.60 - - "GET /login HTTP/1.1" 404 38552 "-" "python-requests/2.32.3" 2026-10-09T13:23:31.718135-07:00 worker-12 nginx[1200]: 10.245.40.75 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 17265 "-" "python-requests/2.32.3" 2026-10-09T13:23:31.751954-07:00 api-07 app[30510]: INFO worker 88 finished job d149c6560077789f in 6849 ms 2026-10-09T13:23:31.808931-07:00 web-03 nginx[1206]: 45.192.227.36 - ci "POST /static/app.js HTTP/1.1" 404 89336 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:31.870792-07:00 bastion dockerd[700]: time="2026-10-09T13:23:31.870792-07:00" level=info msg="Container a34ef28ec9338079 exited with code 0" 2026-10-09T13:23:31.945055-07:00 db-replica sshd[52053]: Received disconnect from 91.47.222.225 port 9550:11: Bye Bye [preauth] 2026-10-09T13:23:32.031291-07:00 web-02 sshd[30035]: Connection closed by 10.85.88.87 port 12749 [preauth] 2026-10-09T13:23:32.079945-07:00 api-07 haproxy[948]: 91.215.126.15:8499 [86034] http-in app/api-08 3475/0/3/3/3475 204 18768 - - ---- 482/482/27/27/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:32.150949-07:00 api-08 nginx[1206]: 192.182.243.167 - sørensen "POST /favicon.ico HTTP/1.1" 404 76222 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:32.260303-07:00 web-01 sshd[52372]: Received disconnect from 45.17.203.71 port 42918:11: Bye Bye [preauth] 2026-10-09T13:23:32.295487-07:00 db-primary app[30884]: WARN slow query (5393 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '78 minutes' 2026-10-09T13:23:32.314936-07:00 edge-fr-1 app[30542]: INFO worker 70 picked job 43f928436cf4fcba from queue orders 2026-10-09T13:23:32.323216-07:00 api-07 haproxy[912]: 203.187.0.63:1309 [63270] http-in app/web-01 2014/0/742/742/2014 200 79639 - - ---- 566/566/65/65/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:32.708448-07:00 web-03 app[30124]: INFO worker 23 finished job 7279c404f5b38caf in 2232 ms 2026-10-09T13:23:32.783315-07:00 api-07 app[30008]: WARN slow query (4674 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '29 minutes' 2026-10-09T13:23:32.900186-07:00 web-03 haproxy[904]: 91.61.177.37:11932 [54085] http-in app/bastion 5047/0/937/937/5047 200 594 - - ---- 972/972/39/39/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:23:33.087716-07:00 api-07 app[30592]: INFO request_id=89058c7415bd4620 method=GET path=/metrics status=404 duration=5950ms 2026-10-09T13:23:33.132051-07:00 api-08 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:23:33.434716-07:00 web-03 app[30348]: INFO worker 35 finished job b0d6974cad5fcae0 in 1121 ms 2026-10-09T13:23:33.444508-07:00 api-08 haproxy[916]: 10.26.142.20:50445 [97783] http-in app/edge-fr-1 5285/0/670/670/5285 502 65004 - - ---- 989/989/57/57/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:33.472095-07:00 db-primary app[30140]: INFO order 26955 confirmed for akira in 1295 ms (region eu-west-1, queue invoices) 2026-10-09T13:23:33.803188-07:00 api-08 app[30744]: INFO worker 50 picked job a63175153ed375e0 from queue invoices 2026-10-09T13:23:34.051590-07:00 web-03 app[30481]: INFO order 84033 confirmed for sørensen in 5940 ms (region ap-northeast-1, queue orders) 2026-10-09T13:23:34.074629-07:00 bastion app[30394]: INFO request_id=e54a16beef65ac05 method=GET path=/health status=200 duration=9187ms 2026-10-09T13:23:34.184876-07:00 db-primary haproxy[910]: 172.160.99.28:57100 [93458] http-in app/edge-fr-1 925/0/612/612/925 200 84251 - - ---- 367/367/52/52/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:34.222477-07:00 web-02 app[30755]: INFO worker 93 finished job 78cb7b5fc5940d3e in 8019 ms 2026-10-09T13:23:34.267849-07:00 web-03 systemd[1]: Started Session 91394 of User müller. 2026-10-09T13:23:34.279821-07:00 worker-12 haproxy[926]: 203.11.138.181:11630 [15831] http-in app/worker-12 1955/0/555/555/1955 500 64157 - - ---- 955/955/19/19/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:23:34.587607-07:00 web-01 postgres[24266]: LOG: duration: 180.930 ms statement: SELECT * FROM orders WHERE customer_id = 74186 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:34.709723-07:00 bastion app[30797]: INFO worker 67 finished job 6b5030e07b23ad7b in 8396 ms 2026-10-09T13:23:34.752220-07:00 api-08 app[30647]: INFO order 55743 confirmed for müller in 1132 ms (region ap-northeast-1, queue orders) 2026-10-09T13:23:34.859408-07:00 web-02 nginx[1200]: 203.33.137.127 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 79686 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:34.956613-07:00 db-primary app[30333]: INFO worker 35 finished job 216bf9724a71789c in 2671 ms 2026-10-09T13:23:35.406964-07:00 web-03 nginx[1206]: 10.43.81.37 - - "GET /static/app.js HTTP/1.1" 502 31166 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:35.441845-07:00 api-08 app[30942]: INFO health check ok: db 305 ms, cache 305 ms, queue depth 12 2026-10-09T13:23:35.571396-07:00 cache-3 cron[2405]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:23:35.873225-07:00 web-01 sshd[60658]: Received disconnect from 203.98.213.188 port 44617:11: Bye Bye [preauth] 2026-10-09T13:23:35.966731-07:00 web-01 nginx[1207]: 203.3.72.4 - - "GET /wp-login.php HTTP/1.1" 500 1867 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:36.277573-07:00 db-primary app[30399]: INFO order 23013 confirmed for akira in 4753 ms (region us-east-1, queue emails) 2026-10-09T13:23:36.286605-07:00 worker-12 haproxy[935]: 91.48.42.124:46799 [66320] http-in app/web-01 9317/0/758/758/9317 301 78544 - - ---- 807/807/28/28/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:23:36.302760-07:00 web-02 nginx[1209]: 172.39.180.68 - - "GET /static/main.css HTTP/1.1" 404 63587 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:36.336370-07:00 api-07 postgres[4616]: LOG: duration: 1582.92 ms statement: SELECT * FROM orders WHERE customer_id = 39609 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:36.392468-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577416.728:83586): pid=83586 uid=0 auid=4909 ses=749 msg='op=login id=4909 exe="/usr/sbin/sshd" hostname=? addr=192.131.74.58 terminal=/dev/pts/0 res=success' 2026-10-09T13:23:36.670067-07:00 bastion haproxy[934]: 45.27.94.242:23792 [36207] http-in app/edge-fr-1 8776/0/537/537/8776 200 18837 - - ---- 497/497/15/15/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:23:36.683742-07:00 web-01 app[30556]: INFO request_id=7ad87cab34cce3a7 method=GET path=/api/v2/search?q=invoice status=500 duration=8834ms 2026-10-09T13:23:36.791428-07:00 web-03 sshd[60378]: Connection closed by 172.108.118.144 port 50755 [preauth] 2026-10-09T13:23:37.065562-07:00 web-03 haproxy[929]: 45.250.0.36:2865 [54567] http-in app/web-01 1929/0/500/500/1929 502 35532 - - ---- 245/245/33/33/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:23:37.087569-07:00 api-07 nginx[1210]: 10.191.81.26 - - "GET /.env HTTP/1.1" 502 26363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:37.099214-07:00 api-08 kernel: [39446.140088] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.177.51.68 DST=10.0.890.890 LEN=68 TOS=0x00 PREC=0x00 TTL=68 ID=39446 DF PROTO=TCP SPT=58651 DPT=58651 WINDOW=39446 RES=0x00 SYN URGP=0 2026-10-09T13:23:37.243857-07:00 api-07 sshd[37473]: Invalid user priya from 45.16.182.97 port 13320 2026-10-09T13:23:37.306970-07:00 worker-12 app[30686]: INFO request_id=08fce5251b3d3dfe method=GET path=/favicon.ico status=301 duration=5534ms 2026-10-09T13:23:37.738884-07:00 edge-fr-1 nginx[1208]: 192.184.98.101 - - "GET /static/app.js HTTP/1.1" 401 30564 "-" "curl/8.4.0" 2026-10-09T13:23:37.963762-07:00 api-07 nginx[1204]: 45.156.207.150 - - "GET /metrics HTTP/1.1" 301 39249 "-" "kube-probe/1.31" 2026-10-09T13:23:37.998669-07:00 api-07 sshd[28398]: Accepted publickey for ci from 91.255.123.156 port 12837 ssh2: ED25519 SHA256:db455ef8b58e8147 2026-10-09T13:23:38.221585-07:00 cache-3 nginx[1201]: 91.132.167.83 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 80311 "-" "Go-http-client/1.1" 2026-10-09T13:23:38.235508-07:00 worker-12 sshd[45646]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:23:38.282927-07:00 web-02 app[30068]: INFO request_id=35f0653df8de2622 method=GET path=/wp-login.php status=200 duration=2622ms 2026-10-09T13:23:38.352601-07:00 web-02 sshd[21189]: Connection closed by 45.131.218.197 port 9647 [preauth] 2026-10-09T13:23:38.967116-07:00 web-01 nginx[1202]: 10.170.52.87 - - "GET /favicon.ico HTTP/1.1" 301 36777 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:39.106982-07:00 bastion app[30986]: INFO request_id=134d7e9e6ab43ce9 method=GET path=/static/app.js status=301 duration=5028ms 2026-10-09T13:23:39.126095-07:00 web-03 dockerd[700]: time="2026-10-09T13:23:39.126095-07:00" level=warning msg="Health check for container 3ba58b302b8a7000 error: context deadline exceeded" 2026-10-09T13:23:39.253096-07:00 web-01 sshd[63050]: Connection closed by 45.158.174.14 port 60017 [preauth] 2026-10-09T13:23:39.306379-07:00 web-01 postgres[23884]: LOG: duration: 2885.334 ms statement: SELECT * FROM orders WHERE customer_id = 43488 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:39.318902-07:00 api-08 app[30877]: INFO worker 98 picked job b4d4c58fb2d4c75c from queue webhooks 2026-10-09T13:23:39.367679-07:00 web-02 nginx[1209]: 10.67.240.58 - - "GET /static/app.js HTTP/1.1" 404 10259 "-" "kube-probe/1.31" 2026-10-09T13:23:39.380542-07:00 web-02 haproxy[949]: 91.238.215.62:52325 [29306] http-in app/api-07 1653/0/692/692/1653 404 51202 - - ---- 836/836/13/13/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:23:39.530072-07:00 db-primary haproxy[934]: 10.125.194.155:6360 [77160] http-in app/worker-12 4937/0/722/722/4937 500 32056 - - ---- 625/625/61/61/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:23:39.711053-07:00 worker-12 nginx[1202]: 192.194.71.201 - - "GET /health HTTP/1.1" 200 45874 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:39.742258-07:00 web-03 app[30589]: INFO health check ok: db 363 ms, cache 363 ms, queue depth 74 2026-10-09T13:23:40.010614-07:00 web-02 haproxy[902]: 172.117.97.3:62097 [52816] http-in app/db-primary 9741/0/573/573/9741 204 23619 - - ---- 771/771/20/20/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:23:40.029143-07:00 web-01 app[30531]: INFO request_id=11bc57e818dc8054 method=GET path=/api/v2/users status=500 duration=8550ms 2026-10-09T13:23:40.143875-07:00 db-replica nginx[1200]: 91.29.129.49 - sørensen "POST /api/v2/users HTTP/1.1" 502 41501 "-" "python-requests/2.32.3" 2026-10-09T13:23:40.264834-07:00 db-replica postgres[3240]: LOG: duration: 3986.358 ms statement: SELECT * FROM orders WHERE customer_id = 58736 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:40.316287-07:00 db-replica sshd[28987]: Invalid user backup from 203.52.223.254 port 21566 2026-10-09T13:23:40.407586-07:00 cache-3 nginx[1210]: 203.232.73.209 - - "GET /.env HTTP/1.1" 404 33449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:40.621693-07:00 web-01 nginx[1201]: 10.22.181.244 - - "GET /.env HTTP/1.1" 200 58677 "-" "Go-http-client/1.1" 2026-10-09T13:23:40.827115-07:00 api-08 sshd[36597]: Connection closed by 91.158.97.158 port 45736 [preauth] 2026-10-09T13:23:41.015638-07:00 db-primary sshd[33606]: Connection closed by 91.216.196.171 port 42038 [preauth] 2026-10-09T13:23:41.079538-07:00 bastion nginx[1204]: 10.210.62.152 - - "GET /api/v2/orders HTTP/1.1" 404 68576 "-" "Go-http-client/1.1" 2026-10-09T13:23:41.095937-07:00 web-03 app[30778]: INFO request_id=ad8d3a7df176d28f method=GET path=/wp-login.php status=200 duration=3231ms 2026-10-09T13:23:41.129534-07:00 bastion nginx[1207]: 203.138.22.106 - - "GET /.env HTTP/1.1" 200 62012 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:41.195506-07:00 web-03 nginx[1201]: 10.32.48.150 - - "GET /api/v2/users HTTP/1.1" 302 75004 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:41.228825-07:00 web-03 app[30032]: WARN retrying upstream 203.87.66.112:34039 after timeout (9790 ms), attempt 2 of 3 2026-10-09T13:23:41.256446-07:00 web-02 app[30049]: INFO request_id=9f0aab7832ef14a2 method=GET path=/wp-login.php status=502 duration=3608ms 2026-10-09T13:23:41.274784-07:00 web-01 haproxy[923]: 203.207.152.58:38199 [40956] http-in app/edge-fr-1 6835/0/858/858/6835 200 63817 - - ---- 145/145/59/59/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:23:41.288579-07:00 api-08 sudo: zoë : TTY=pts/0 ; PWD=/home/zoë ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:23:41.548051-07:00 web-02 nginx[1208]: 45.178.198.154 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 29759 "-" "Go-http-client/1.1" 2026-10-09T13:23:41.551206-07:00 web-02 postgres[11215]: LOG: duration: 6010.106 ms statement: SELECT * FROM orders WHERE customer_id = 29357 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:41.731302-07:00 worker-12 systemd[1]: session-52757.scope: Deactivated successfully. 2026-10-09T13:23:42.170068-07:00 db-replica nginx[1203]: 172.139.195.215 - akira "POST /static/app.js HTTP/1.1" 200 61130 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:42.513021-07:00 edge-fr-1 systemd[1]: session-51195.scope: Deactivated successfully. 2026-10-09T13:23:42.555562-07:00 web-03 postgres[18426]: LOG: duration: 3919.818 ms statement: SELECT * FROM orders WHERE customer_id = 80798 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:42.822485-07:00 bastion nginx[1200]: 203.84.85.86 - - "GET /api/v2/users HTTP/1.1" 301 27164 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:42.857972-07:00 api-08 sshd[54565]: Accepted publickey for ci from 192.112.158.22 port 14825 ssh2: ED25519 SHA256:d69023557abbcf16 2026-10-09T13:23:42.977564-07:00 web-03 nginx[1209]: 45.13.9.179 - - "GET /.env HTTP/1.1" 401 6291 "-" "python-requests/2.32.3" 2026-10-09T13:23:43.019929-07:00 api-08 app[30471]: INFO request_id=ee9dc683518f4d7e method=GET path=/api/v2/users status=200 duration=8795ms 2026-10-09T13:23:43.373947-07:00 web-02 app[30816]: WARN retrying upstream 10.193.0.116:16363 after timeout (2879 ms), attempt 2 of 3 2026-10-09T13:23:43.384292-07:00 web-01 postgres[17763]: LOG: duration: 2897.672 ms statement: SELECT * FROM orders WHERE customer_id = 35598 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:43.482123-07:00 worker-12 nginx[1203]: 10.204.57.199 - - "GET /login HTTP/1.1" 200 20395 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:43.609965-07:00 worker-12 nginx[1204]: 91.26.97.49 - - "GET /.env HTTP/1.1" 200 45483 "-" "Go-http-client/1.1" 2026-10-09T13:23:43.689090-07:00 web-03 app[30048]: INFO worker 11 picked job 995ff8e7e06c1780 from queue emails 2026-10-09T13:23:43.880119-07:00 web-02 app[30516]: INFO worker 85 picked job f5b590a721805c71 from queue webhooks 2026-10-09T13:23:43.892872-07:00 db-primary haproxy[934]: 91.201.12.48:5508 [42988] http-in app/web-02 987/0/430/430/987 204 26096 - - ---- 554/554/87/87/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:43.950352-07:00 api-08 app[30547]: INFO order 90507 confirmed for ci in 8222 ms (region us-east-1, queue emails) 2026-10-09T13:23:44.170095-07:00 edge-fr-1 nginx[1204]: 203.216.254.188 - - "GET /health HTTP/1.1" 200 11155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:44.263028-07:00 api-07 postgres[14552]: LOG: duration: 9555.86 ms statement: SELECT * FROM orders WHERE customer_id = 68121 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:44.438869-07:00 web-02 haproxy[948]: 172.70.151.96:42543 [83897] http-in app/db-replica 4112/0/826/826/4112 502 84246 - - ---- 507/507/17/17/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:23:44.681202-07:00 web-01 sshd[11840]: Accepted publickey for akira from 91.227.110.11 port 64319 ssh2: ED25519 SHA256:730d5b1ba457fcd5 2026-10-09T13:23:44.724326-07:00 edge-fr-1 kernel: [28642.851536] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.104.16.112 DST=10.0.642.642 LEN=32 TOS=0x00 PREC=0x00 TTL=32 ID=28642 DF PROTO=TCP SPT=10340 DPT=10340 WINDOW=28642 RES=0x00 SYN URGP=0 2026-10-09T13:23:45.283890-07:00 db-replica app[30702]: INFO request_id=7c88fb874538cc06 method=GET path=/api/v2/users status=200 duration=9703ms 2026-10-09T13:23:45.402359-07:00 edge-fr-1 app[30581]: INFO request_id=507dc899ece10760 method=GET path=/static/app.js status=200 duration=5496ms 2026-10-09T13:23:45.541258-07:00 edge-fr-1 nginx[1209]: 91.119.10.223 - - "GET /favicon.ico HTTP/1.1" 500 30956 "-" "Go-http-client/1.1" 2026-10-09T13:23:45.619260-07:00 bastion app[30648]: INFO worker 46 finished job 6626b2c96ce6f1d9 in 6890 ms 2026-10-09T13:23:45.988918-07:00 worker-12 app[30886]: INFO worker 73 finished job 39a6e50445902ff2 in 709 ms 2026-10-09T13:23:46.254920-07:00 api-07 app[30570]: INFO request_id=46349963e6d68432 method=GET path=/static/app.js status=502 duration=8787ms 2026-10-09T13:23:46.317335-07:00 edge-fr-1 postgres[5585]: LOG: duration: 3035.826 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:46.348132-07:00 web-02 kernel: [85763.911622] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.239.231.188 DST=10.0.664.664 LEN=91 TOS=0x00 PREC=0x00 TTL=91 ID=85763 DF PROTO=TCP SPT=2126 DPT=2126 WINDOW=85763 RES=0x00 SYN URGP=0 2026-10-09T13:23:46.396863-07:00 cache-3 app[30685]: DEBUG cache hit ratio 43% over the last minute (95557 lookups) 2026-10-09T13:23:46.468412-07:00 api-07 nginx[1201]: 45.226.217.212 - - "GET /login HTTP/1.1" 200 83774 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:46.627055-07:00 db-replica nginx[1205]: 91.142.234.161 - - "GET /wp-login.php HTTP/1.1" 502 23033 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:46.956208-07:00 api-07 nginx[1205]: 192.151.44.211 - - "GET /.env HTTP/1.1" 401 79786 "-" "curl/8.4.0" 2026-10-09T13:23:46.960029-07:00 web-01 sshd[18969]: Connection closed by 192.199.246.205 port 40805 [preauth] 2026-10-09T13:23:47.118041-07:00 api-07 nginx[1207]: 192.217.26.3 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 21652 "-" "kube-probe/1.31" 2026-10-09T13:23:47.121717-07:00 db-primary app[30247]: ERROR payment declined for order 28371: card_declined (code 59), customer notified 2026-10-09T13:23:47.166589-07:00 cache-3 haproxy[901]: 172.39.188.38:27619 [10604] http-in app/api-08 563/0/299/299/563 200 9713 - - ---- 254/254/68/68/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:23:47.380622-07:00 db-replica app[30217]: INFO worker 78 picked job ebf2ebf15e89eb03 from queue webhooks 2026-10-09T13:23:47.461383-07:00 edge-fr-1 app[30750]: INFO health check ok: db 773 ms, cache 773 ms, queue depth 38 2026-10-09T13:23:47.527957-07:00 api-08 nginx[1210]: 10.12.87.169 - - "GET /health HTTP/1.1" 200 38470 "-" "kube-probe/1.31" 2026-10-09T13:23:47.570425-07:00 db-primary systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:23:47.689433-07:00 web-03 haproxy[937]: 91.39.172.158:32636 [54630] http-in app/web-02 3446/0/968/968/3446 200 55512 - - ---- 396/396/50/50/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:47.765504-07:00 db-primary app[30781]: INFO request_id=7f606057a78b719b method=GET path=/metrics status=301 duration=9395ms 2026-10-09T13:23:47.865857-07:00 db-replica nginx[1202]: 192.11.54.84 - - "GET /static/app.js HTTP/1.1" 404 40294 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:47.937717-07:00 api-07 postgres[3180]: LOG: duration: 4037.597 ms statement: SELECT * FROM orders WHERE customer_id = 28288 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:47.942148-07:00 api-07 haproxy[907]: 172.182.46.155:6093 [96422] http-in app/api-08 1601/0/543/543/1601 204 19103 - - ---- 713/713/79/79/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:48.111920-07:00 bastion sshd[22207]: Connection closed by 172.7.224.197 port 49320 [preauth] 2026-10-09T13:23:48.130503-07:00 api-07 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:23:48.409604-07:00 cache-3 kernel: [74490.894821] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.146.41.14 DST=10.0.586.586 LEN=88 TOS=0x00 PREC=0x00 TTL=88 ID=74490 DF PROTO=TCP SPT=4201 DPT=4201 WINDOW=74490 RES=0x00 SYN URGP=0 2026-10-09T13:23:48.417938-07:00 web-03 app[30210]: INFO health check ok: db 826 ms, cache 826 ms, queue depth 51 2026-10-09T13:23:48.424096-07:00 worker-12 nginx[1202]: 45.150.64.212 - - "GET /static/main.css HTTP/1.1" 301 38635 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:48.510115-07:00 db-primary postgres[16098]: LOG: duration: 2182.993 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:49.018262-07:00 web-01 app[30296]: INFO request_id=68d10063672abd5c method=GET path=/api/v2/orders status=404 duration=7381ms 2026-10-09T13:23:49.037961-07:00 web-02 app[30067]: ERROR payment declined for order 41248: card_declined (code 56), customer notified 2026-10-09T13:23:49.270764-07:00 db-primary app[30804]: INFO worker 27 picked job c79bef33a3690c99 from queue webhooks 2026-10-09T13:23:49.340631-07:00 web-01 haproxy[936]: 10.125.95.12:8565 [76564] http-in app/web-01 2392/0/135/135/2392 200 32328 - - ---- 562/562/55/55/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:23:49.430062-07:00 web-03 nginx[1205]: 192.167.20.24 - - "GET /api/v2/orders HTTP/1.1" 500 13613 "-" "Go-http-client/1.1" 2026-10-09T13:23:49.460484-07:00 web-02 postgres[16854]: LOG: duration: 971.38 ms statement: SELECT * FROM orders WHERE customer_id = 59802 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:49.591910-07:00 web-03 kernel: [61534.450251] TCP: request_sock_TCP: Possible SYN flooding on port 8062. Sending cookies. Check SNMP counters. 2026-10-09T13:23:49.931541-07:00 edge-fr-1 nginx[1206]: 10.96.239.104 - - "GET /health HTTP/1.1" 302 14274 "-" "kube-probe/1.31" 2026-10-09T13:23:50.021314-07:00 worker-12 app[30386]: DEBUG cache hit ratio 23% over the last minute (56990 lookups) 2026-10-09T13:23:50.311756-07:00 web-02 app[30523]: INFO request_id=33834d8b2e42cec0 method=GET path=/api/v2/search?q=invoice status=200 duration=6632ms 2026-10-09T13:23:50.349722-07:00 db-primary sshd[42957]: Accepted publickey for françois from 172.108.182.51 port 39240 ssh2: ED25519 SHA256:4b2f15ceb9ad4387 2026-10-09T13:23:50.362645-07:00 api-08 sshd[31395]: Connection closed by 10.47.13.23 port 13616 [preauth] 2026-10-09T13:23:50.414427-07:00 web-03 app[30648]: INFO order 61357 confirmed for root in 7925 ms (region eu-west-1, queue invoices) 2026-10-09T13:23:50.488563-07:00 web-01 haproxy[941]: 203.53.229.110:60897 [11801] http-in app/db-primary 8930/0/352/352/8930 502 44263 - - ---- 136/136/82/82/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:23:50.500063-07:00 edge-fr-1 app[30644]: INFO worker 21 picked job a4001fad9530ddf9 from queue emails 2026-10-09T13:23:50.627789-07:00 worker-12 dockerd[700]: time="2026-10-09T13:23:50.627789-07:00" level=warning msg="Health check for container 20f24e349cebaf4b error: context deadline exceeded" 2026-10-09T13:23:50.728059-07:00 bastion app[30049]: INFO worker 92 picked job 9f7186fe9e13a51b from queue invoices 2026-10-09T13:23:50.775622-07:00 api-07 app[30275]: INFO worker 23 finished job 1113b26d53f33cef in 8284 ms 2026-10-09T13:23:51.063959-07:00 edge-fr-1 nginx[1202]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.114.203.136, server: app.example.com, request: "GET /.env HTTP/1.1", upstream: "http://10.0.787.787:8080/.env" 2026-10-09T13:23:51.234865-07:00 web-02 dockerd[700]: time="2026-10-09T13:23:51.234865-07:00" level=info msg="Container 66cb843afda1a193 exited with code 0" 2026-10-09T13:23:51.279198-07:00 web-03 postgres[17079]: LOG: checkpoint complete: wrote 2410 buffers (43%); 0 WAL file(s) added, 0 removed, 98 recycled; write=4972.461 s, sync=0.461 s, total=4972.461 s 2026-10-09T13:23:51.320964-07:00 worker-12 haproxy[930]: 172.237.69.120:39867 [34481] http-in app/api-08 7430/0/285/285/7430 401 57007 - - ---- 956/956/59/59/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:23:51.573285-07:00 cache-3 kernel: [87449.754945] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.242.188.25 DST=10.0.635.635 LEN=84 TOS=0x00 PREC=0x00 TTL=84 ID=87449 DF PROTO=TCP SPT=12966 DPT=12966 WINDOW=87449 RES=0x00 SYN URGP=0 2026-10-09T13:23:51.583373-07:00 web-01 nginx[1203]: 192.37.28.114 - - "GET /api/v2/orders HTTP/1.1" 404 24088 "-" "curl/8.4.0" 2026-10-09T13:23:51.721622-07:00 worker-12 sshd[62087]: pam_unix(sshd:session): session opened for user root(uid=5699) by (uid=0) 2026-10-09T13:23:51.867441-07:00 web-02 nginx[1206]: 203.103.49.165 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 68251 "-" "kube-probe/1.31" 2026-10-09T13:23:52.007048-07:00 web-02 sshd[56647]: Invalid user deploy from 45.124.247.184 port 42312 2026-10-09T13:23:52.151886-07:00 api-08 nginx[1202]: 10.60.84.168 - - "GET /login HTTP/1.1" 404 72066 "-" "Go-http-client/1.1" 2026-10-09T13:23:52.205275-07:00 api-07 app[30407]: INFO worker 58 finished job 0136664b88d0679e in 7222 ms 2026-10-09T13:23:52.230600-07:00 worker-12 postgres[3776]: LOG: duration: 2182.959 ms statement: SELECT * FROM orders WHERE customer_id = 95982 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:52.252651-07:00 cache-3 app[30182]: INFO order 41722 confirmed for françois in 7682 ms (region us-east-1, queue invoices) 2026-10-09T13:23:52.322452-07:00 web-03 kernel: [15521.248334] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.87.6.143 DST=10.0.349.349 LEN=47 TOS=0x00 PREC=0x00 TTL=47 ID=15521 DF PROTO=TCP SPT=40223 DPT=40223 WINDOW=15521 RES=0x00 SYN URGP=0 2026-10-09T13:23:52.325700-07:00 web-02 app[30006]: INFO order 16048 confirmed for akira in 3210 ms (region us-east-1, queue webhooks) 2026-10-09T13:23:52.439664-07:00 web-01 sshd[6774]: Connection closed by 10.61.92.234 port 43651 [preauth] 2026-10-09T13:23:52.465715-07:00 web-01 kubelet[800]: I1009 13:23:52.341654 8154 kubelet.go:8154] "Pod is terminating, skipping pod status update" pod="default/api-26b50b687649278b" 2026-10-09T13:23:53.080101-07:00 web-02 nginx[1205]: 45.148.18.181 - deploy "POST /static/main.css HTTP/1.1" 200 13950 "-" "kube-probe/1.31" 2026-10-09T13:23:53.359843-07:00 web-03 haproxy[936]: 45.112.10.161:43521 [55598] http-in app/web-01 8787/0/688/688/8787 200 31851 - - ---- 195/195/42/42/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:23:53.431927-07:00 web-02 postgres[20150]: LOG: duration: 4562.548 ms statement: SELECT * FROM orders WHERE customer_id = 84350 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:53.918823-07:00 web-03 app[30404]: INFO request_id=ad1ac582b71dad76 method=GET path=/api/v2/users status=204 duration=48ms 2026-10-09T13:23:54.130342-07:00 worker-12 app[30349]: INFO order 21019 confirmed for sørensen in 3419 ms (region us-east-1, queue emails) 2026-10-09T13:23:54.279624-07:00 worker-12 app[30715]: INFO request_id=8a9e0bb66dfb5fab method=GET path=/api/v2/users status=204 duration=8316ms 2026-10-09T13:23:54.448158-07:00 web-01 nginx[1204]: 45.43.71.84 - - "GET /favicon.ico HTTP/1.1" 204 64037 "-" "python-requests/2.32.3" 2026-10-09T13:23:54.449357-07:00 db-replica sshd[64693]: Accepted publickey for root from 203.116.107.83 port 25684 ssh2: ED25519 SHA256:3e97359c99360e18 2026-10-09T13:23:54.487191-07:00 web-02 app[30057]: INFO order 17413 confirmed for deploy in 1023 ms (region ap-northeast-1, queue orders) 2026-10-09T13:23:54.613151-07:00 worker-12 haproxy[931]: 203.223.103.146:30945 [73423] http-in app/web-03 7730/0/331/331/7730 200 71858 - - ---- 408/408/90/90/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:23:54.892866-07:00 cache-3 app[30241]: INFO request_id=95ada718193f5e6b method=GET path=/wp-login.php status=200 duration=8172ms 2026-10-09T13:23:54.951621-07:00 bastion systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:23:55.083059-07:00 web-01 postgres[16288]: LOG: duration: 7265.837 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:23:55.301104-07:00 web-02 nginx[1208]: 45.170.122.151 - root "POST /.env HTTP/1.1" 301 60971 "-" "curl/8.4.0" 2026-10-09T13:23:55.642624-07:00 bastion systemd[1]: session-51627.scope: Deactivated successfully. 2026-10-09T13:23:55.766055-07:00 edge-fr-1 sshd[2492]: Received disconnect from 203.170.180.106 port 42284:11: Bye Bye [preauth] 2026-10-09T13:23:55.810604-07:00 bastion kernel: [38128.397839] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.118.140.217 DST=10.0.370.370 LEN=20 TOS=0x00 PREC=0x00 TTL=20 ID=38128 DF PROTO=TCP SPT=49677 DPT=49677 WINDOW=38128 RES=0x00 SYN URGP=0 2026-10-09T13:23:55.834145-07:00 api-07 sshd[17126]: Accepted publickey for priya from 172.168.33.72 port 23259 ssh2: ED25519 SHA256:0f32bb663af1f622 2026-10-09T13:23:55.963410-07:00 cache-3 nginx[1207]: 10.225.101.139 - - "GET /.env HTTP/1.1" 404 1242 "-" "Go-http-client/1.1" 2026-10-09T13:23:55.974202-07:00 api-07 haproxy[934]: 10.59.219.21:50580 [51071] http-in app/api-08 9223/0/837/837/9223 301 67959 - - ---- 456/456/35/35/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:23:56.015109-07:00 db-primary app[30353]: DEBUG cache hit ratio 32% over the last minute (17872 lookups) 2026-10-09T13:23:56.178884-07:00 cache-3 app[30405]: WARN slow query (9567 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '46 minutes' 2026-10-09T13:23:56.391608-07:00 edge-fr-1 nginx[1202]: 192.206.153.7 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 56786 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:23:56.407620-07:00 web-02 nginx[1203]: 192.44.29.98 - - "GET /wp-login.php HTTP/1.1" 302 85666 "-" "Go-http-client/1.1" 2026-10-09T13:23:56.484821-07:00 edge-fr-1 haproxy[911]: 45.125.25.52:51937 [29313] http-in app/worker-12 3162/0/497/497/3162 301 67452 - - ---- 729/729/60/60/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:23:56.618534-07:00 worker-12 app[30843]: INFO request_id=1c87f1975782678f method=GET path=/metrics status=404 duration=2833ms 2026-10-09T13:23:56.767481-07:00 edge-fr-1 kubelet[800]: I1009 13:23:56.706386 9169 kubelet.go:9169] "Pod is terminating, skipping pod status update" pod="default/api-10d87555457a1adb" 2026-10-09T13:23:56.844142-07:00 api-08 nginx[1205]: 203.144.34.181 - - "GET /wp-login.php HTTP/1.1" 401 78913 "-" "kube-probe/1.31" 2026-10-09T13:23:56.899506-07:00 edge-fr-1 sshd[417]: Accepted publickey for priya from 45.182.47.191 port 19249 ssh2: ED25519 SHA256:69e1bee7c4d9c6cc 2026-10-09T13:23:57.003702-07:00 bastion app[30460]: DEBUG cache hit ratio 12% over the last minute (55710 lookups) 2026-10-09T13:23:57.027634-07:00 web-01 nginx[1207]: 10.138.189.77 - - "GET /health HTTP/1.1" 500 40759 "-" "python-requests/2.32.3" 2026-10-09T13:23:57.029597-07:00 worker-12 systemd[1]: Started Session 49591 of User backup. 2026-10-09T13:23:57.046637-07:00 db-primary kernel: [54903.023089] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.193.147.21 DST=10.0.772.772 LEN=26 TOS=0x00 PREC=0x00 TTL=26 ID=54903 DF PROTO=TCP SPT=38240 DPT=38240 WINDOW=54903 RES=0x00 SYN URGP=0 2026-10-09T13:23:57.158174-07:00 edge-fr-1 nginx[1205]: 91.132.238.84 - - "GET /health HTTP/1.1" 302 28065 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:23:57.313972-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577437.464:75894): pid=75894 uid=0 auid=7112 ses=872 msg='op=login id=7112 exe="/usr/sbin/sshd" hostname=? addr=203.29.0.146 terminal=/dev/pts/0 res=success' 2026-10-09T13:23:57.333274-07:00 web-03 app[30750]: INFO worker 51 finished job 8d7c18ececf4695e in 6099 ms 2026-10-09T13:23:57.633140-07:00 api-07 app[30430]: ERROR cache miss storm: 2673 misses in 8335 ms, key prefix session:root 2026-10-09T13:23:57.938484-07:00 web-03 sshd[9647]: Connection closed by 172.42.244.126 port 1277 [preauth] 2026-10-09T13:23:58.059972-07:00 edge-fr-1 haproxy[924]: 172.220.37.234:42504 [22209] http-in app/db-replica 1368/0/489/489/1368 404 77320 - - ---- 601/601/34/34/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:23:58.230578-07:00 api-08 kernel: [81633.819703] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.196.86.32 DST=10.0.299.299 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=81633 DF PROTO=TCP SPT=11055 DPT=11055 WINDOW=81633 RES=0x00 SYN URGP=0 2026-10-09T13:23:58.256546-07:00 api-08 nginx[1201]: 203.132.228.132 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 77665 "-" "Go-http-client/1.1" 2026-10-09T13:23:58.271197-07:00 cache-3 kernel: [92469.656704] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.48.33.33 DST=10.0.720.720 LEN=54 TOS=0x00 PREC=0x00 TTL=54 ID=92469 DF PROTO=TCP SPT=46377 DPT=46377 WINDOW=92469 RES=0x00 SYN URGP=0 2026-10-09T13:23:58.392612-07:00 web-01 postgres[20229]: LOG: duration: 3160.266 ms statement: SELECT * FROM orders WHERE customer_id = 16358 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:23:58.624103-07:00 edge-fr-1 cron[58869]: (ci) CMD (/usr/bin/backup --quiet --target /srv/ci) 2026-10-09T13:23:58.634368-07:00 api-07 sshd[31177]: Accepted publickey for sørensen from 10.75.91.31 port 1534 ssh2: ED25519 SHA256:b46fa2bca1b6b75a 2026-10-09T13:23:58.648013-07:00 db-replica app[30157]: WARN retrying upstream 203.118.143.60:20381 after timeout (8324 ms), attempt 3 of 3 2026-10-09T13:23:59.063688-07:00 db-primary app[30530]: INFO worker 36 picked job fc55b6aa9b89b1db from queue emails 2026-10-09T13:23:59.295576-07:00 worker-12 nginx[1207]: 172.170.82.195 - - "GET /favicon.ico HTTP/1.1" 500 2020 "-" "Go-http-client/1.1" 2026-10-09T13:23:59.327705-07:00 cache-3 haproxy[906]: 203.153.10.241:62887 [80269] http-in app/cache-3 3213/0/434/434/3213 302 79102 - - ---- 343/343/76/76/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:23:59.357968-07:00 db-primary app[30534]: INFO health check ok: db 901 ms, cache 901 ms, queue depth 76 2026-10-09T13:23:59.461279-07:00 cache-3 app[30962]: INFO order 16548 confirmed for müller in 7182 ms (region us-east-1, queue orders) 2026-10-09T13:23:59.506708-07:00 api-07 app[30517]: WARN retrying upstream 172.75.45.253:1513 after timeout (8252 ms), attempt 1 of 3 2026-10-09T13:23:59.708434-07:00 api-07 nginx[1203]: 172.155.178.96 - - "GET /login HTTP/1.1" 200 35134 "-" "Go-http-client/1.1" 2026-10-09T13:23:59.841526-07:00 db-primary nginx[1207]: 10.78.128.58 - - "GET /health HTTP/1.1" 200 13799 "-" "python-requests/2.32.3" 2026-10-09T13:23:59.888264-07:00 edge-fr-1 app[30752]: INFO request_id=723ef390791053c8 method=GET path=/admin status=302 duration=8170ms 2026-10-09T13:23:59.933940-07:00 edge-fr-1 nginx[1210]: 203.174.99.80 - - "GET /api/v2/orders HTTP/1.1" 404 55582 "-" "python-requests/2.32.3" 2026-10-09T13:24:00.216646-07:00 db-primary app[30747]: INFO request_id=25846be0b28d593b method=GET path=/login status=200 duration=2121ms 2026-10-09T13:24:00.324887-07:00 worker-12 haproxy[915]: 45.77.247.242:11215 [97154] http-in app/worker-12 8061/0/653/653/8061 200 44404 - - ---- 305/305/84/84/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:24:00.398759-07:00 edge-fr-1 nginx[1206]: 45.179.200.40 - - "GET /wp-login.php HTTP/1.1" 301 5863 "-" "python-requests/2.32.3" 2026-10-09T13:24:00.504822-07:00 db-primary systemd[1]: session-37373.scope: Deactivated successfully. 2026-10-09T13:24:00.650075-07:00 db-replica app[30525]: INFO worker 52 finished job dd722b987bc1ceb7 in 2489 ms 2026-10-09T13:24:00.651633-07:00 web-02 nginx[1204]: 192.119.11.149 - - "GET /api/v2/orders HTTP/1.1" 404 80942 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:00.676612-07:00 worker-12 nginx[1207]: 192.131.201.77 - - "GET /.env HTTP/1.1" 200 15653 "-" "python-requests/2.32.3" 2026-10-09T13:24:01.087131-07:00 web-02 kernel: [41575.769498] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.16.56.199 DST=10.0.583.583 LEN=39 TOS=0x00 PREC=0x00 TTL=39 ID=41575 DF PROTO=TCP SPT=9997 DPT=9997 WINDOW=41575 RES=0x00 SYN URGP=0 2026-10-09T13:24:01.178467-07:00 db-primary nginx[1207]: 10.85.26.167 - - "GET /login HTTP/1.1" 200 56538 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:01.316053-07:00 db-primary sshd[49056]: Connection closed by 45.163.79.209 port 15505 [preauth] 2026-10-09T13:24:01.338612-07:00 db-primary app[30824]: DEBUG cache hit ratio 46% over the last minute (57504 lookups) 2026-10-09T13:24:01.527387-07:00 db-replica app[30065]: INFO request_id=75541238d24912e1 method=GET path=/api/v2/orders status=500 duration=8364ms 2026-10-09T13:24:01.773098-07:00 api-07 app[30672]: INFO request_id=e615c352910f4bbe method=GET path=/api/v2/users status=301 duration=1106ms 2026-10-09T13:24:01.822681-07:00 db-replica haproxy[907]: 203.92.175.165:30158 [95853] http-in app/api-07 3426/0/750/750/3426 404 79249 - - ---- 885/885/43/43/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:24:02.447967-07:00 api-07 app[30989]: INFO request_id=ebf28f8b58b1d23e method=GET path=/.env status=200 duration=3953ms 2026-10-09T13:24:02.725304-07:00 api-07 haproxy[929]: 203.40.164.103:19311 [70614] http-in app/bastion 4988/0/436/436/4988 500 75799 - - ---- 972/972/27/27/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:24:02.858179-07:00 web-03 sshd[23451]: Connection closed by 192.182.216.72 port 3418 [preauth] 2026-10-09T13:24:02.867701-07:00 db-replica nginx[1200]: 172.94.233.134 - - "GET /metrics HTTP/1.1" 301 18215 "-" "kube-probe/1.31" 2026-10-09T13:24:02.977647-07:00 web-03 sshd[25360]: Failed password for invalid user françois from 10.1.94.141 port 31636 ssh2 2026-10-09T13:24:03.218629-07:00 cache-3 app[30492]: INFO request_id=7e53617e916236df method=GET path=/api/v2/search?q=invoice status=204 duration=8950ms 2026-10-09T13:24:03.300987-07:00 db-primary cron[33617]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:24:03.360280-07:00 web-01 nginx[1207]: 172.225.70.148 - - "GET /api/v2/users HTTP/1.1" 200 34912 "-" "kube-probe/1.31" 2026-10-09T13:24:03.371812-07:00 bastion cron[24605]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:03.558978-07:00 cache-3 haproxy[948]: 91.48.17.232:42730 [32628] http-in app/web-01 8882/0/881/881/8882 200 54456 - - ---- 163/163/41/41/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:24:03.606502-07:00 edge-fr-1 app[30951]: INFO worker 97 finished job d764ff01d738e29c in 5961 ms 2026-10-09T13:24:03.774927-07:00 bastion nginx[1206]: 91.83.57.186 - - "GET /.env HTTP/1.1" 301 67615 "-" "Go-http-client/1.1" 2026-10-09T13:24:03.898562-07:00 api-07 kubelet[800]: I1009 13:24:03.146317 3993 kubelet.go:3993] "Pod is terminating, skipping pod status update" pod="default/api-aa24ce6e501b014d" 2026-10-09T13:24:04.056411-07:00 db-primary sshd[39584]: Invalid user akira from 172.154.140.227 port 47036 2026-10-09T13:24:04.124110-07:00 db-primary app[30095]: INFO worker 22 finished job 6dd843c81af1b2bf in 5557 ms 2026-10-09T13:24:04.278292-07:00 edge-fr-1 app[30459]: INFO order 20755 confirmed for akira in 2799 ms (region us-east-1, queue orders) 2026-10-09T13:24:04.332907-07:00 web-01 app[30810]: WARN slow query (8035 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '95 minutes' 2026-10-09T13:24:04.392627-07:00 web-02 haproxy[908]: 45.44.219.187:8607 [15625] http-in app/db-primary 586/0/235/235/586 301 68139 - - ---- 721/721/47/47/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:24:04.553825-07:00 web-03 nginx[1202]: 10.122.9.81 - françois "POST /health HTTP/1.1" 404 61177 "-" "kube-probe/1.31" 2026-10-09T13:24:04.571523-07:00 bastion app[30470]: WARN slow query (287 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '81 minutes' 2026-10-09T13:24:04.661245-07:00 bastion nginx[1206]: 192.222.196.69 - - "GET /wp-login.php HTTP/1.1" 200 83525 "-" "python-requests/2.32.3" 2026-10-09T13:24:04.741383-07:00 web-01 sshd[32998]: Accepted publickey for priya from 172.87.223.213 port 22316 ssh2: ED25519 SHA256:1069759dac463e5b 2026-10-09T13:24:04.743824-07:00 cache-3 dockerd[700]: time="2026-10-09T13:24:04.743824-07:00" level=info msg="Container 6b8c37100616f2b6 exited with code 0" 2026-10-09T13:24:04.766427-07:00 web-01 app[30635]: WARN slow query (2482 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '81 minutes' 2026-10-09T13:24:04.880387-07:00 db-primary nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 45.194.86.42, server: app.example.com, request: "GET /.env HTTP/1.1", upstream: "http://10.0.940.940:8080/.env" 2026-10-09T13:24:04.940473-07:00 web-03 app[30076]: DEBUG cache hit ratio 53% over the last minute (46388 lookups) 2026-10-09T13:24:05.032172-07:00 edge-fr-1 nginx[1208]: 91.63.228.238 - - "GET /static/app.js HTTP/1.1" 401 68936 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:05.046671-07:00 api-07 nginx[1210]: 45.155.211.156 - zoë "POST /api/v2/users HTTP/1.1" 200 88871 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:05.113971-07:00 cache-3 postgres[28826]: LOG: duration: 4789.120 ms statement: SELECT * FROM orders WHERE customer_id = 35154 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:05.384595-07:00 cache-3 app[30919]: INFO request_id=9171f6b7bdc2da8a method=GET path=/admin status=401 duration=5840ms 2026-10-09T13:24:05.417136-07:00 db-replica sshd[46466]: Accepted publickey for müller from 203.59.45.99 port 42140 ssh2: ED25519 SHA256:be340c35902148e9 2026-10-09T13:24:05.469316-07:00 web-03 app[30911]: INFO worker 12 finished job 485cb01ba75d2f88 in 794 ms 2026-10-09T13:24:05.557325-07:00 api-07 sshd[28890]: Invalid user sørensen from 203.115.70.110 port 9719 2026-10-09T13:24:05.795653-07:00 api-08 haproxy[905]: 45.128.191.38:53940 [18471] http-in app/api-08 8059/0/58/58/8059 200 53276 - - ---- 255/255/40/40/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:24:05.804176-07:00 api-08 nginx[1210]: 45.95.149.105 - - "GET /login HTTP/1.1" 500 34247 "-" "curl/8.4.0" 2026-10-09T13:24:05.858379-07:00 db-primary systemd[1]: Started Session 16604 of User root. 2026-10-09T13:24:05.947898-07:00 cache-3 cron[7364]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:05.982114-07:00 web-03 app[30175]: DEBUG cache hit ratio 81% over the last minute (88770 lookups) 2026-10-09T13:24:06.002445-07:00 edge-fr-1 nginx[1210]: 10.252.53.37 - - "GET /health HTTP/1.1" 500 78608 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:06.222391-07:00 db-primary nginx[1208]: 192.127.232.219 - - "GET /login HTTP/1.1" 301 81619 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:06.237013-07:00 web-03 sshd[63404]: Accepted publickey for backup from 10.223.175.192 port 28805 ssh2: ED25519 SHA256:d8dc3f6ecf4f4426 2026-10-09T13:24:06.271620-07:00 bastion systemd[1]: session-13657.scope: Deactivated successfully. 2026-10-09T13:24:06.361088-07:00 bastion app[30697]: INFO order 54589 confirmed for ci in 826 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:24:06.399579-07:00 cache-3 nginx[1200]: 192.125.213.174 - - "GET /wp-login.php HTTP/1.1" 401 5285 "-" "kube-probe/1.31" 2026-10-09T13:24:06.488029-07:00 edge-fr-1 app[30616]: INFO order 43648 confirmed for sørensen in 8890 ms (region eu-west-1, queue emails) 2026-10-09T13:24:06.574585-07:00 edge-fr-1 nginx[1200]: 192.175.65.132 - - "GET /health HTTP/1.1" 302 41804 "-" "kube-probe/1.31" 2026-10-09T13:24:06.690244-07:00 worker-12 app[30399]: DEBUG cache hit ratio 79% over the last minute (17671 lookups) 2026-10-09T13:24:06.762712-07:00 edge-fr-1 haproxy[944]: 91.144.184.126:63164 [65224] http-in app/api-08 3083/0/596/596/3083 401 15637 - - ---- 633/633/69/69/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:24:07.000130-07:00 api-08 app[30297]: INFO request_id=12152e6c3afa3922 method=GET path=/metrics status=401 duration=4427ms 2026-10-09T13:24:07.121538-07:00 web-01 systemd[1]: Started Session 62517 of User zoë. 2026-10-09T13:24:07.349240-07:00 bastion nginx[1206]: 10.51.63.241 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 17762 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:07.451092-07:00 worker-12 app[30172]: INFO request_id=a4222e1166b8c325 method=GET path=/api/v2/orders/8841 status=200 duration=2717ms 2026-10-09T13:24:07.690085-07:00 db-primary app[30916]: INFO request_id=96907fe9d42d8746 method=GET path=/api/v2/orders status=200 duration=1967ms 2026-10-09T13:24:07.961019-07:00 cache-3 app[30625]: INFO request_id=da0f86fd1b423477 method=GET path=/static/app.js status=301 duration=3250ms 2026-10-09T13:24:08.157333-07:00 db-primary nginx[1200]: 192.66.122.23 - - "GET /admin HTTP/1.1" 200 27737 "-" "Go-http-client/1.1" 2026-10-09T13:24:08.272627-07:00 bastion app[30217]: INFO worker 93 finished job 5aac7721ec99b40c in 7712 ms 2026-10-09T13:24:08.544304-07:00 bastion app[30798]: DEBUG cache hit ratio 24% over the last minute (98202 lookups) 2026-10-09T13:24:08.600808-07:00 web-03 systemd[1]: session-58836.scope: Deactivated successfully. 2026-10-09T13:24:08.611644-07:00 api-08 postgres[2094]: LOG: duration: 8793.919 ms statement: SELECT * FROM orders WHERE customer_id = 61837 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:08.757410-07:00 api-08 app[30588]: WARN retrying upstream 45.16.49.16:50274 after timeout (8906 ms), attempt 3 of 3 2026-10-09T13:24:08.783398-07:00 api-07 kernel: [71061.684766] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.170.44.206 DST=10.0.681.681 LEN=19 TOS=0x00 PREC=0x00 TTL=19 ID=71061 DF PROTO=TCP SPT=36708 DPT=36708 WINDOW=71061 RES=0x00 SYN URGP=0 2026-10-09T13:24:08.887365-07:00 bastion app[30253]: INFO worker 24 finished job 93926905bad54b6a in 6098 ms 2026-10-09T13:24:09.101677-07:00 worker-12 app[30250]: INFO order 45893 confirmed for akira in 7950 ms (region eu-west-1, queue invoices) 2026-10-09T13:24:09.163186-07:00 db-primary app[30790]: INFO worker 17 finished job fc9727a2f29c5ca2 in 5672 ms 2026-10-09T13:24:09.195200-07:00 worker-12 sshd[55071]: Received disconnect from 45.32.11.254 port 39839:11: Bye Bye [preauth] 2026-10-09T13:24:09.252093-07:00 api-07 app[30754]: INFO request_id=f44d78e2fefe7489 method=GET path=/metrics status=502 duration=3524ms 2026-10-09T13:24:09.303613-07:00 bastion app[30797]: INFO order 23757 confirmed for backup in 3608 ms (region eu-west-1, queue webhooks) 2026-10-09T13:24:09.362973-07:00 api-08 haproxy[931]: 192.24.53.77:41764 [70022] http-in app/edge-fr-1 486/0/445/445/486 502 87013 - - ---- 921/921/37/37/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:09.405089-07:00 cache-3 postgres[21906]: LOG: duration: 1983.953 ms statement: SELECT * FROM orders WHERE customer_id = 56390 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:09.453478-07:00 api-08 nginx[1200]: 45.4.105.131 - - "GET /metrics HTTP/1.1" 302 51611 "-" "python-requests/2.32.3" 2026-10-09T13:24:09.523094-07:00 api-08 sshd[36556]: Failed password for invalid user priya from 172.84.92.4 port 9477 ssh2 2026-10-09T13:24:09.819047-07:00 edge-fr-1 nginx[1204]: 45.1.174.72 - - "GET /wp-login.php HTTP/1.1" 500 23001 "-" "Go-http-client/1.1" 2026-10-09T13:24:09.821061-07:00 worker-12 sshd[51630]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:24:09.924126-07:00 cache-3 app[30444]: INFO worker 55 picked job aa22e6d253243d21 from queue invoices 2026-10-09T13:24:10.096577-07:00 cache-3 haproxy[929]: 10.232.188.40:45394 [61310] http-in app/edge-fr-1 4777/0/266/266/4777 302 56428 - - ---- 784/784/36/36/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:24:10.174949-07:00 bastion app[30288]: INFO health check ok: db 491 ms, cache 491 ms, queue depth 56 2026-10-09T13:24:10.420364-07:00 web-02 haproxy[947]: 203.240.105.94:12206 [54862] http-in app/edge-fr-1 2469/0/443/443/2469 500 14618 - - ---- 479/479/93/93/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:24:10.766022-07:00 edge-fr-1 app[30397]: INFO worker 74 finished job 4cac0cc2e542b285 in 4772 ms 2026-10-09T13:24:10.780273-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577450.41:18901): pid=18901 uid=0 auid=7840 ses=438 msg='op=login id=7840 exe="/usr/sbin/sshd" hostname=? addr=203.187.52.239 terminal=/dev/pts/0 res=success' 2026-10-09T13:24:10.896044-07:00 db-primary sshd[3571]: Received disconnect from 192.78.224.21 port 52382:11: Bye Bye [preauth] 2026-10-09T13:24:11.144442-07:00 web-01 nginx[1206]: 203.233.173.243 - - "GET /login HTTP/1.1" 200 47900 "-" "curl/8.4.0" 2026-10-09T13:24:11.146599-07:00 cache-3 haproxy[925]: 10.162.182.84:2195 [20711] http-in app/edge-fr-1 3445/0/945/945/3445 401 52058 - - ---- 287/287/50/50/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:24:11.235786-07:00 web-01 app[30740]: INFO request_id=8a3455dbebc44fe0 method=GET path=/static/main.css status=200 duration=5552ms 2026-10-09T13:24:11.394653-07:00 web-01 nginx[1206]: 172.253.227.245 - françois "POST /login HTTP/1.1" 200 50731 "-" "python-requests/2.32.3" 2026-10-09T13:24:11.418753-07:00 db-replica nginx[1209]: 203.142.47.60 - priya "POST /wp-login.php HTTP/1.1" 200 74364 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:11.434677-07:00 web-01 app[30202]: INFO worker 80 finished job 4d4bebd9b90d53c2 in 7713 ms 2026-10-09T13:24:11.618317-07:00 bastion haproxy[920]: 172.248.206.45:43524 [60459] http-in app/api-08 1369/0/509/509/1369 301 67982 - - ---- 222/222/66/66/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:11.733403-07:00 web-03 app[30577]: INFO request_id=de4ff9468f958cd8 method=GET path=/.env status=404 duration=9626ms 2026-10-09T13:24:11.801883-07:00 cache-3 app[30793]: INFO order 78181 confirmed for françois in 54 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:24:11.806475-07:00 worker-12 dockerd[700]: time="2026-10-09T13:24:11.806475-07:00" level=info msg="Container 4653076155dff6f2 exited with code 0" 2026-10-09T13:24:11.823363-07:00 api-08 sshd[22507]: Connection closed by 91.232.58.80 port 43240 [preauth] 2026-10-09T13:24:11.892259-07:00 web-03 sshd[53129]: Received disconnect from 91.247.157.123 port 61334:11: Bye Bye [preauth] 2026-10-09T13:24:11.912106-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577451.154:53887): pid=53887 uid=0 auid=5580 ses=553 msg='op=login id=5580 exe="/usr/sbin/sshd" hostname=? addr=45.131.91.193 terminal=/dev/pts/0 res=success' 2026-10-09T13:24:12.013431-07:00 api-07 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:24:12.162658-07:00 api-08 nginx[1205]: 91.202.35.63 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 62083 "-" "Go-http-client/1.1" 2026-10-09T13:24:12.481025-07:00 api-08 sshd[55634]: Connection closed by 192.139.199.138 port 44587 [preauth] 2026-10-09T13:24:12.530075-07:00 edge-fr-1 app[30080]: INFO worker 65 picked job 6eebbd7d3f77cced from queue emails 2026-10-09T13:24:12.769666-07:00 web-02 cron[2452]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:13.145268-07:00 cache-3 postgres[23043]: LOG: duration: 1829.665 ms statement: SELECT * FROM orders WHERE customer_id = 46943 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:13.180610-07:00 web-02 app[30620]: INFO order 60856 confirmed for müller in 2579 ms (region eu-west-1, queue webhooks) 2026-10-09T13:24:13.273798-07:00 api-07 nginx[1201]: 91.22.8.185 - - "GET /login HTTP/1.1" 301 62138 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:13.656171-07:00 edge-fr-1 sshd[7005]: Failed password for invalid user zoë from 192.108.157.37 port 19961 ssh2 2026-10-09T13:24:13.741006-07:00 web-01 app[30000]: INFO order 51178 confirmed for root in 9444 ms (region ap-northeast-1, queue orders) 2026-10-09T13:24:13.779464-07:00 worker-12 nginx[1210]: 45.239.165.149 - - "GET /favicon.ico HTTP/1.1" 502 24139 "-" "curl/8.4.0" 2026-10-09T13:24:13.914379-07:00 web-03 app[30466]: INFO request_id=ceabfb7fd520de0a method=GET path=/favicon.ico status=404 duration=3224ms 2026-10-09T13:24:14.098683-07:00 api-08 sshd[3497]: Accepted publickey for sørensen from 10.210.25.248 port 31180 ssh2: ED25519 SHA256:cc8b2317160e95a7 2026-10-09T13:24:14.109416-07:00 web-02 app[30851]: INFO worker 90 finished job fa740265bd9ca11d in 3283 ms 2026-10-09T13:24:14.486981-07:00 web-02 nginx[1209]: 192.134.237.103 - - "GET /api/v2/users HTTP/1.1" 200 55255 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:14.503282-07:00 web-01 app[30527]: INFO worker 23 finished job e7c210a661e2fab5 in 4061 ms 2026-10-09T13:24:14.542053-07:00 edge-fr-1 app[30640]: INFO worker 32 finished job 51deda271a699829 in 5207 ms 2026-10-09T13:24:14.588188-07:00 bastion haproxy[940]: 45.195.242.10:29784 [88362] http-in app/web-01 1900/0/209/209/1900 200 17154 - - ---- 631/631/27/27/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:24:14.652902-07:00 api-08 app[30342]: INFO order 45618 confirmed for ci in 512 ms (region us-east-1, queue webhooks) 2026-10-09T13:24:14.969345-07:00 edge-fr-1 app[30565]: INFO order 24443 confirmed for priya in 9959 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:24:15.098198-07:00 web-03 kernel: [14870.972023] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.226.140.141 DST=10.0.175.175 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=14870 DF PROTO=TCP SPT=44306 DPT=44306 WINDOW=14870 RES=0x00 SYN URGP=0 2026-10-09T13:24:15.405696-07:00 web-01 nginx[1209]: 172.136.253.211 - - "GET /static/main.css HTTP/1.1" 404 63852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:15.602625-07:00 bastion app[30771]: DEBUG cache hit ratio 58% over the last minute (52735 lookups) 2026-10-09T13:24:15.945463-07:00 api-08 app[30877]: INFO worker 45 finished job 34c3b6687a063af1 in 6257 ms 2026-10-09T13:24:16.150590-07:00 web-03 sshd[18297]: Accepted publickey for backup from 10.222.164.169 port 20811 ssh2: ED25519 SHA256:d4012b9bc5070409 2026-10-09T13:24:16.309733-07:00 edge-fr-1 app[30647]: INFO worker 82 finished job 0dbe985394845ff0 in 499 ms 2026-10-09T13:24:16.527161-07:00 cache-3 app[30975]: INFO worker 37 finished job dc5999d5d193e353 in 4897 ms 2026-10-09T13:24:17.060555-07:00 db-primary kernel: [57091.032725] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.50.96.103 DST=10.0.892.892 LEN=17 TOS=0x00 PREC=0x00 TTL=17 ID=57091 DF PROTO=TCP SPT=23494 DPT=23494 WINDOW=57091 RES=0x00 SYN URGP=0 2026-10-09T13:24:17.130669-07:00 api-08 sshd[11616]: Received disconnect from 192.106.224.31 port 48598:11: Bye Bye [preauth] 2026-10-09T13:24:17.391594-07:00 bastion sshd[938]: Failed password for invalid user ci from 45.42.139.57 port 1568 ssh2 2026-10-09T13:24:17.571456-07:00 api-07 haproxy[917]: 172.21.94.139:10632 [94294] http-in app/worker-12 3864/0/968/968/3864 204 56356 - - ---- 200/200/49/49/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:24:17.590480-07:00 web-03 app[30393]: INFO worker 28 picked job 81461f7b26ffa438 from queue emails 2026-10-09T13:24:17.596606-07:00 db-primary sshd[43862]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:24:17.753664-07:00 edge-fr-1 haproxy[933]: 91.132.209.239:17194 [66498] http-in app/db-primary 2221/0/884/884/2221 401 26292 - - ---- 532/532/56/56/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:24:17.976025-07:00 api-08 sshd[52964]: Connection closed by 91.107.124.112 port 26284 [preauth] 2026-10-09T13:24:18.249827-07:00 web-02 app[30388]: INFO request_id=5f1ed3b2b0cbf73d method=GET path=/favicon.ico status=500 duration=2304ms 2026-10-09T13:24:18.794257-07:00 cache-3 sshd[62589]: Accepted publickey for müller from 10.101.55.224 port 43105 ssh2: ED25519 SHA256:d3b9bf4547c368fb 2026-10-09T13:24:18.941469-07:00 cache-3 nginx[1203]: 203.163.110.137 - backup "POST /wp-login.php HTTP/1.1" 502 52021 "-" "kube-probe/1.31" 2026-10-09T13:24:19.036096-07:00 web-01 systemd[1]: session-69113.scope: Deactivated successfully. 2026-10-09T13:24:19.105357-07:00 api-08 nginx[1203]: 203.245.173.180 - - "GET /.env HTTP/1.1" 404 84118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:19.115115-07:00 db-primary nginx[1205]: 91.186.208.83 - - "GET /favicon.ico HTTP/1.1" 200 77422 "-" "python-requests/2.32.3" 2026-10-09T13:24:19.429254-07:00 edge-fr-1 haproxy[909]: 91.116.137.52:8582 [32241] http-in app/db-replica 4198/0/357/357/4198 401 38977 - - ---- 131/131/86/86/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:19.522444-07:00 api-08 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:24:19.584353-07:00 api-07 nginx[1201]: 192.118.241.140 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 19385 "-" "Go-http-client/1.1" 2026-10-09T13:24:19.637161-07:00 web-03 haproxy[938]: 91.185.255.168:10533 [42505] http-in app/web-02 4480/0/359/359/4480 204 74519 - - ---- 326/326/99/99/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:24:19.726108-07:00 web-02 app[30792]: INFO order 53597 confirmed for akira in 9229 ms (region eu-west-1, queue invoices) 2026-10-09T13:24:19.777554-07:00 web-01 haproxy[905]: 10.201.116.157:10159 [61407] http-in app/worker-12 5343/0/912/912/5343 200 35253 - - ---- 700/700/94/94/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:19.840457-07:00 bastion kernel: [81301.123351] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.44.220.209 DST=10.0.492.492 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=81301 DF PROTO=TCP SPT=43444 DPT=43444 WINDOW=81301 RES=0x00 SYN URGP=0 2026-10-09T13:24:19.878179-07:00 web-03 app[30750]: INFO worker 75 picked job 63eb64ebb366dc35 from queue emails 2026-10-09T13:24:20.054364-07:00 api-07 app[30082]: INFO order 54220 confirmed for deploy in 169 ms (region eu-west-1, queue orders) 2026-10-09T13:24:20.160999-07:00 db-replica app[30501]: DEBUG cache hit ratio 59% over the last minute (12463 lookups) 2026-10-09T13:24:20.263438-07:00 web-01 cron[37687]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:24:20.424573-07:00 api-07 kernel: [96573.898378] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.49.51.76 DST=10.0.804.804 LEN=83 TOS=0x00 PREC=0x00 TTL=83 ID=96573 DF PROTO=TCP SPT=51971 DPT=51971 WINDOW=96573 RES=0x00 SYN URGP=0 2026-10-09T13:24:20.555965-07:00 cache-3 nginx[1203]: 10.244.136.224 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 28221 "-" "python-requests/2.32.3" 2026-10-09T13:24:20.688484-07:00 api-08 app[30114]: INFO worker 42 finished job 793d9547eb950f34 in 5062 ms 2026-10-09T13:24:21.140976-07:00 api-08 nginx[1204]: 91.61.130.113 - ci "POST /wp-login.php HTTP/1.1" 404 23616 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:21.236862-07:00 web-01 kernel: [74331.549814] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.174.24.156 DST=10.0.454.454 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=74331 DF PROTO=TCP SPT=45859 DPT=45859 WINDOW=74331 RES=0x00 SYN URGP=0 2026-10-09T13:24:21.433565-07:00 worker-12 haproxy[927]: 203.84.38.210:18964 [21342] http-in app/web-03 8663/0/817/817/8663 502 85807 - - ---- 988/988/40/40/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:21.517411-07:00 web-02 nginx[1200]: 203.245.95.183 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 66745 "-" "Go-http-client/1.1" 2026-10-09T13:24:21.609920-07:00 cache-3 app[30731]: INFO worker 82 picked job 4c20aa1fe101be05 from queue invoices 2026-10-09T13:24:21.630124-07:00 web-03 sshd[48486]: Connection closed by 45.108.202.11 port 45218 [preauth] 2026-10-09T13:24:21.743691-07:00 cache-3 nginx[1207]: 91.43.225.119 - - "GET /metrics HTTP/1.1" 200 25775 "-" "python-requests/2.32.3" 2026-10-09T13:24:21.838752-07:00 web-03 haproxy[949]: 172.147.17.112:15978 [44740] http-in app/web-02 4754/0/119/119/4754 404 69889 - - ---- 891/891/59/59/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:21.838776-07:00 api-07 sshd[5572]: Failed password for invalid user müller from 203.157.213.169 port 54791 ssh2 2026-10-09T13:24:21.870280-07:00 web-02 app[30607]: INFO request_id=01de345474a4d421 method=GET path=/favicon.ico status=404 duration=1819ms 2026-10-09T13:24:22.652481-07:00 bastion sshd[17131]: Accepted publickey for françois from 45.169.18.113 port 43517 ssh2: ED25519 SHA256:ba9ee5dbd7e3eaa3 2026-10-09T13:24:22.721448-07:00 api-08 nginx[1202]: 192.137.87.70 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 77296 "-" "python-requests/2.32.3" 2026-10-09T13:24:22.860259-07:00 worker-12 nginx[1201]: 45.185.101.89 - - "GET /metrics HTTP/1.1" 404 22691 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:22.946865-07:00 worker-12 app[30373]: INFO request_id=b68ad9c4797cd5be method=GET path=/admin status=404 duration=2529ms 2026-10-09T13:24:23.185118-07:00 web-02 app[30661]: INFO health check ok: db 436 ms, cache 436 ms, queue depth 70 2026-10-09T13:24:23.345477-07:00 web-03 app[30080]: INFO request_id=074cb0cbadf7071a method=GET path=/static/app.js status=200 duration=8228ms 2026-10-09T13:24:23.709711-07:00 cache-3 app[30498]: INFO worker 61 finished job d87ff12756c65ae6 in 4937 ms 2026-10-09T13:24:23.719873-07:00 api-08 app[30118]: INFO request_id=a20582e5b8487613 method=GET path=/api/v2/users status=404 duration=5825ms 2026-10-09T13:24:23.793602-07:00 bastion nginx[1203]: 203.53.165.116 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 75536 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:23.825021-07:00 worker-12 app[30728]: INFO health check ok: db 484 ms, cache 484 ms, queue depth 66 2026-10-09T13:24:23.940607-07:00 edge-fr-1 app[30060]: INFO request_id=993bec5832775291 method=GET path=/metrics status=502 duration=3795ms 2026-10-09T13:24:23.942360-07:00 api-08 nginx[1207]: 10.97.152.153 - - "GET /static/app.js HTTP/1.1" 502 87505 "-" "Go-http-client/1.1" 2026-10-09T13:24:24.028684-07:00 web-03 cron[13130]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:24:24.111983-07:00 bastion app[30735]: INFO request_id=4af70f33b1817d21 method=GET path=/static/main.css status=401 duration=6327ms 2026-10-09T13:24:24.156049-07:00 db-primary nginx[1200]: 172.23.153.245 - - "GET /api/v2/users HTTP/1.1" 302 24517 "-" "python-requests/2.32.3" 2026-10-09T13:24:24.246209-07:00 cache-3 nginx[1201]: 45.241.74.249 - - "GET /metrics HTTP/1.1" 301 119 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:24.273060-07:00 bastion nginx[1204]: 172.40.83.27 - müller "POST /admin HTTP/1.1" 301 82495 "-" "python-requests/2.32.3" 2026-10-09T13:24:24.350061-07:00 web-01 haproxy[913]: 91.2.221.148:9191 [93638] http-in app/db-replica 5459/0/422/422/5459 200 83550 - - ---- 703/703/36/36/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:24:24.395373-07:00 web-03 sshd[1703]: Connection closed by 192.158.196.8 port 51308 [preauth] 2026-10-09T13:24:24.445023-07:00 api-07 app[30511]: INFO request_id=864fec4c116d6ff5 method=GET path=/health status=404 duration=6601ms 2026-10-09T13:24:24.538828-07:00 cache-3 app[30448]: DEBUG cache hit ratio 92% over the last minute (98584 lookups) 2026-10-09T13:24:24.577092-07:00 web-02 sshd[58544]: pam_unix(sshd:session): session opened for user sørensen(uid=6407) by (uid=0) 2026-10-09T13:24:24.655052-07:00 edge-fr-1 app[30540]: INFO request_id=d69bc4ba47ac3848 method=GET path=/static/main.css status=404 duration=4773ms 2026-10-09T13:24:25.030625-07:00 cache-3 app[30441]: INFO order 14377 confirmed for ci in 4990 ms (region eu-west-1, queue emails) 2026-10-09T13:24:25.056667-07:00 edge-fr-1 nginx[1200]: 91.93.164.18 - - "GET /metrics HTTP/1.1" 401 21201 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:25.187780-07:00 edge-fr-1 nginx[1206]: 192.140.129.122 - - "GET /wp-login.php HTTP/1.1" 200 74968 "-" "Go-http-client/1.1" 2026-10-09T13:24:25.558326-07:00 web-01 app[30133]: INFO worker 94 finished job e037bce3b105083a in 4676 ms 2026-10-09T13:24:25.633335-07:00 api-07 app[30003]: DEBUG cache hit ratio 98% over the last minute (59050 lookups) 2026-10-09T13:24:25.650913-07:00 edge-fr-1 haproxy[935]: 192.100.97.82:30711 [20949] http-in app/web-03 6200/0/670/670/6200 200 78709 - - ---- 869/869/48/48/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:25.678418-07:00 web-02 app[30988]: INFO order 48978 confirmed for priya in 1729 ms (region eu-west-1, queue emails) 2026-10-09T13:24:26.155959-07:00 db-replica nginx[1203]: 10.146.94.74 - - "GET /api/v2/orders HTTP/1.1" 204 2017 "-" "kube-probe/1.31" 2026-10-09T13:24:26.514840-07:00 cache-3 kubelet[800]: I1009 13:24:26.784238 5729 kubelet.go:5729] "Pod is terminating, skipping pod status update" pod="default/api-5e45af64938d68eb" 2026-10-09T13:24:26.884109-07:00 worker-12 cron[58801]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:24:26.910377-07:00 cache-3 nginx[1202]: 203.72.165.248 - - "GET /login HTTP/1.1" 404 78746 "-" "curl/8.4.0" 2026-10-09T13:24:27.004401-07:00 api-08 app[30203]: WARN retrying upstream 192.150.231.24:20547 after timeout (7145 ms), attempt 2 of 3 2026-10-09T13:24:27.026914-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577467.243:99888): pid=99888 uid=0 auid=6448 ses=547 msg='op=login id=6448 exe="/usr/sbin/sshd" hostname=? addr=203.212.71.94 terminal=/dev/pts/0 res=success' 2026-10-09T13:24:27.059584-07:00 web-02 nginx[1209]: 192.45.155.251 - - "GET /api/v2/users HTTP/1.1" 200 53250 "-" "curl/8.4.0" 2026-10-09T13:24:27.299693-07:00 db-primary app[30930]: INFO order 35360 confirmed for priya in 4003 ms (region eu-west-1, queue webhooks) 2026-10-09T13:24:27.651585-07:00 bastion systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:24:27.655237-07:00 cache-3 nginx[1204]: 172.225.52.234 - akira "POST /.env HTTP/1.1" 302 56593 "-" "kube-probe/1.31" 2026-10-09T13:24:27.983250-07:00 web-02 sshd[53853]: Failed password for invalid user sørensen from 203.180.166.250 port 54245 ssh2 2026-10-09T13:24:27.993444-07:00 api-07 app[30932]: INFO order 71512 confirmed for sørensen in 4717 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:24:28.059393-07:00 bastion app[30622]: INFO worker 35 picked job 703b6b2d2e87ce7c from queue invoices 2026-10-09T13:24:28.085134-07:00 web-02 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:24:28.451553-07:00 web-01 app[30547]: INFO worker 54 picked job 26e12658b76fab09 from queue orders 2026-10-09T13:24:28.561950-07:00 bastion nginx[1204]: 203.74.182.192 - - "GET /static/main.css HTTP/1.1" 200 66968 "-" "python-requests/2.32.3" 2026-10-09T13:24:28.650668-07:00 db-replica app[30540]: INFO request_id=9cd45869afc3ee26 method=GET path=/wp-login.php status=301 duration=3249ms 2026-10-09T13:24:28.800268-07:00 cache-3 systemd[1]: Started Session 68676 of User ci. 2026-10-09T13:24:28.870256-07:00 bastion cron[10022]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:28.940279-07:00 db-replica app[30681]: INFO worker 49 finished job c4fac4c64a753a2f in 2870 ms 2026-10-09T13:24:29.085538-07:00 api-07 nginx[1201]: 45.200.30.212 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 10798 "-" "curl/8.4.0" 2026-10-09T13:24:29.175284-07:00 db-primary nginx[1200]: 192.95.206.36 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 76351 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:29.204928-07:00 worker-12 haproxy[927]: 203.17.246.12:47999 [63901] http-in app/api-07 5974/0/234/234/5974 401 3350 - - ---- 613/613/23/23/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:29.552484-07:00 cache-3 app[30768]: INFO request_id=46b125bf2e31ee78 method=GET path=/login status=401 duration=6624ms 2026-10-09T13:24:29.782697-07:00 db-primary systemd[1]: session-30119.scope: Deactivated successfully. 2026-10-09T13:24:29.805241-07:00 db-primary app[30123]: INFO request_id=3e6d7c3e58b73ec0 method=GET path=/metrics status=404 duration=4156ms 2026-10-09T13:24:29.851299-07:00 api-08 nginx[1204]: 45.171.90.63 - müller "POST /wp-login.php HTTP/1.1" 502 76394 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:30.077309-07:00 cache-3 app[30511]: WARN retrying upstream 45.38.98.43:25382 after timeout (823 ms), attempt 2 of 3 2026-10-09T13:24:30.196328-07:00 api-08 app[30805]: INFO request_id=2e9588f41a46dfcb method=GET path=/.env status=404 duration=7201ms 2026-10-09T13:24:30.347141-07:00 api-08 nginx[1202]: 192.53.130.226 - - "GET /favicon.ico HTTP/1.1" 401 29110 "-" "kube-probe/1.31" 2026-10-09T13:24:30.438820-07:00 worker-12 app[30301]: INFO health check ok: db 923 ms, cache 923 ms, queue depth 71 2026-10-09T13:24:30.490669-07:00 cache-3 kernel: [81832.403634] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.233.88.19 DST=10.0.377.377 LEN=33 TOS=0x00 PREC=0x00 TTL=33 ID=81832 DF PROTO=TCP SPT=15790 DPT=15790 WINDOW=81832 RES=0x00 SYN URGP=0 2026-10-09T13:24:30.511298-07:00 worker-12 nginx[1203]: 203.227.19.156 - - "GET /api/v2/orders HTTP/1.1" 301 37882 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:30.819041-07:00 db-primary nginx[1209]: 203.246.85.81 - - "GET /static/main.css HTTP/1.1" 404 25549 "-" "Go-http-client/1.1" 2026-10-09T13:24:30.907664-07:00 web-02 app[30710]: INFO order 87145 confirmed for sørensen in 2358 ms (region ap-northeast-1, queue emails) 2026-10-09T13:24:30.968471-07:00 web-02 systemd[1]: Started Session 40647 of User backup. 2026-10-09T13:24:31.027265-07:00 api-08 app[30722]: INFO worker 39 picked job a9b0b74c8d439305 from queue invoices 2026-10-09T13:24:31.264380-07:00 api-07 sshd[21988]: Invalid user deploy from 91.78.57.196 port 7514 2026-10-09T13:24:31.351994-07:00 bastion app[30412]: INFO request_id=e248ea8c49721e4f method=GET path=/.env status=200 duration=7827ms 2026-10-09T13:24:31.459415-07:00 api-08 postgres[27518]: LOG: duration: 2596.232 ms statement: SELECT * FROM orders WHERE customer_id = 99668 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:31.608651-07:00 bastion nginx[1204]: 192.167.36.35 - - "GET /admin HTTP/1.1" 404 5465 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:31.641973-07:00 web-01 app[30872]: INFO order 53754 confirmed for müller in 8513 ms (region us-east-1, queue emails) 2026-10-09T13:24:31.710740-07:00 web-01 nginx[1203]: 91.219.196.50 - backup "POST /api/v2/users HTTP/1.1" 200 25579 "-" "python-requests/2.32.3" 2026-10-09T13:24:31.792639-07:00 worker-12 nginx[1205]: 91.187.32.249 - - "GET /api/v2/users HTTP/1.1" 204 11477 "-" "Go-http-client/1.1" 2026-10-09T13:24:31.862274-07:00 web-01 sshd[22772]: Invalid user sørensen from 91.96.109.252 port 46635 2026-10-09T13:24:32.301963-07:00 bastion haproxy[902]: 172.254.182.237:32339 [83953] http-in app/api-07 7164/0/290/290/7164 301 33387 - - ---- 842/842/94/94/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:24:32.475174-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577472.506:82297): pid=82297 uid=0 auid=9923 ses=693 msg='op=login id=9923 exe="/usr/sbin/sshd" hostname=? addr=172.81.194.213 terminal=/dev/pts/0 res=success' 2026-10-09T13:24:32.492405-07:00 cache-3 app[30813]: INFO health check ok: db 121 ms, cache 121 ms, queue depth 39 2026-10-09T13:24:32.771883-07:00 edge-fr-1 sshd[55540]: Failed password for invalid user françois from 172.34.122.94 port 26423 ssh2 2026-10-09T13:24:32.787780-07:00 worker-12 app[30535]: WARN slow query (4483 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '55 minutes' 2026-10-09T13:24:32.871570-07:00 web-03 app[30963]: INFO health check ok: db 819 ms, cache 819 ms, queue depth 33 2026-10-09T13:24:32.934234-07:00 api-07 postgres[13169]: LOG: duration: 987.21 ms statement: SELECT * FROM orders WHERE customer_id = 47682 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:33.118754-07:00 api-07 app[30464]: INFO worker 68 picked job 795a8d2de32aa265 from queue emails 2026-10-09T13:24:33.127230-07:00 api-08 app[30263]: INFO worker 32 finished job 107372e9f234724e in 329 ms 2026-10-09T13:24:33.228950-07:00 web-01 nginx[1201]: 10.75.206.97 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 86207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:33.281495-07:00 worker-12 kernel: [70905.925900] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.6.145.188 DST=10.0.375.375 LEN=81 TOS=0x00 PREC=0x00 TTL=81 ID=70905 DF PROTO=TCP SPT=33074 DPT=33074 WINDOW=70905 RES=0x00 SYN URGP=0 2026-10-09T13:24:33.353778-07:00 edge-fr-1 sshd[46781]: pam_unix(sshd:session): session opened for user deploy(uid=9402) by (uid=0) 2026-10-09T13:24:33.523137-07:00 web-01 app[30232]: INFO request_id=bb848d5bc6372fcf method=GET path=/login status=401 duration=5392ms 2026-10-09T13:24:33.945826-07:00 api-07 app[30846]: INFO request_id=6198cc93b884634b method=GET path=/metrics status=204 duration=7037ms 2026-10-09T13:24:34.099032-07:00 bastion app[30574]: INFO request_id=bf9cb95648a3a89c method=GET path=/api/v2/search?q=invoice status=404 duration=4486ms 2026-10-09T13:24:34.298920-07:00 cache-3 kernel: [31055.308162] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.255.117.40 DST=10.0.102.102 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=31055 DF PROTO=TCP SPT=17112 DPT=17112 WINDOW=31055 RES=0x00 SYN URGP=0 2026-10-09T13:24:34.593880-07:00 db-primary sshd[9260]: Connection closed by 203.241.176.26 port 8700 [preauth] 2026-10-09T13:24:34.994200-07:00 web-01 cron[4776]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:24:35.013839-07:00 db-replica cron[44741]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:35.299758-07:00 api-07 app[30551]: INFO worker 43 finished job ccfc6e512d7dc98a in 1591 ms 2026-10-09T13:24:35.838090-07:00 db-primary app[30927]: INFO health check ok: db 147 ms, cache 147 ms, queue depth 31 2026-10-09T13:24:35.848774-07:00 bastion app[30394]: INFO health check ok: db 352 ms, cache 352 ms, queue depth 67 2026-10-09T13:24:36.024555-07:00 edge-fr-1 nginx[1201]: 192.72.120.38 - - "GET /wp-login.php HTTP/1.1" 200 10754 "-" "python-requests/2.32.3" 2026-10-09T13:24:36.092193-07:00 cache-3 sshd[35342]: Connection closed by 172.50.115.9 port 21606 [preauth] 2026-10-09T13:24:36.094438-07:00 db-primary sshd[37899]: Accepted publickey for priya from 10.149.169.199 port 43322 ssh2: ED25519 SHA256:90a7285a44bfc4c1 2026-10-09T13:24:36.132543-07:00 api-07 nginx[1200]: 91.158.82.217 - akira "POST /admin HTTP/1.1" 204 21244 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:36.231966-07:00 web-01 app[30153]: INFO order 58349 confirmed for ci in 3565 ms (region ap-northeast-1, queue orders) 2026-10-09T13:24:36.282485-07:00 worker-12 app[30332]: INFO order 52586 confirmed for deploy in 5756 ms (region us-east-1, queue invoices) 2026-10-09T13:24:36.558732-07:00 api-07 app[30814]: WARN retrying upstream 192.227.155.206:8303 after timeout (2142 ms), attempt 2 of 3 2026-10-09T13:24:36.607308-07:00 db-primary sshd[60788]: Accepted publickey for müller from 172.167.52.41 port 45138 ssh2: ED25519 SHA256:3c0aa613c1f6f287 2026-10-09T13:24:36.949934-07:00 db-replica app[30310]: INFO request_id=e7947ad3e4ff5ad8 method=GET path=/.env status=200 duration=4315ms 2026-10-09T13:24:37.378708-07:00 web-02 sshd[7085]: Failed password for invalid user akira from 91.173.68.114 port 58724 ssh2 2026-10-09T13:24:37.986492-07:00 db-replica app[30569]: INFO worker 36 picked job 5513b15d9fa79c11 from queue emails 2026-10-09T13:24:37.990313-07:00 edge-fr-1 app[30288]: INFO order 50670 confirmed for françois in 3863 ms (region eu-west-1, queue invoices) 2026-10-09T13:24:38.077647-07:00 db-primary sshd[46819]: Failed password for invalid user müller from 10.201.12.55 port 24858 ssh2 2026-10-09T13:24:38.348821-07:00 web-03 sshd[64813]: Invalid user deploy from 172.147.162.177 port 3079 2026-10-09T13:24:38.502085-07:00 web-01 nginx[1209]: 45.26.100.118 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 89497 "-" "python-requests/2.32.3" 2026-10-09T13:24:38.581095-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577478.146:26123): pid=26123 uid=0 auid=5845 ses=490 msg='op=login id=5845 exe="/usr/sbin/sshd" hostname=? addr=45.154.205.194 terminal=/dev/pts/0 res=success' 2026-10-09T13:24:38.589485-07:00 bastion sshd[57599]: Connection closed by 10.100.124.50 port 51503 [preauth] 2026-10-09T13:24:38.676829-07:00 web-02 app[30568]: INFO request_id=c55e41a7c74179ec method=GET path=/api/v2/orders status=200 duration=5888ms 2026-10-09T13:24:38.754977-07:00 web-02 nginx[1204]: 172.172.184.139 - akira "POST /api/v2/orders HTTP/1.1" 200 25785 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:38.892237-07:00 api-07 postgres[20106]: LOG: duration: 9020.903 ms statement: SELECT * FROM orders WHERE customer_id = 37291 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:39.064591-07:00 web-03 haproxy[941]: Server app/web-03 is DOWN, reason: Layer4 timeout, check duration: 4039ms. 33 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:24:39.270157-07:00 web-03 sshd[27748]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:24:39.469638-07:00 api-07 cron[58634]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:39.586106-07:00 web-03 sshd[55343]: pam_unix(sshd:session): session opened for user priya(uid=4266) by (uid=0) 2026-10-09T13:24:39.661373-07:00 db-replica postgres[16511]: LOG: duration: 1197.672 ms statement: SELECT * FROM orders WHERE customer_id = 63025 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:39.686566-07:00 web-03 app[30714]: INFO worker 12 finished job 22cd20ff99c9a45f in 1410 ms 2026-10-09T13:24:39.773270-07:00 web-02 app[30976]: INFO order 67522 confirmed for root in 7803 ms (region us-east-1, queue emails) 2026-10-09T13:24:39.907206-07:00 db-primary app[30512]: INFO request_id=ed1bdbaea2226375 method=GET path=/admin status=404 duration=1071ms 2026-10-09T13:24:40.145859-07:00 web-02 sshd[10723]: Invalid user priya from 172.255.126.14 port 21736 2026-10-09T13:24:40.156094-07:00 db-replica app[30941]: INFO worker 14 picked job 6166cb42dcb1b820 from queue orders 2026-10-09T13:24:40.192421-07:00 edge-fr-1 app[30852]: WARN slow query (8413 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '58 minutes' 2026-10-09T13:24:40.350947-07:00 web-03 kubelet[800]: I1009 13:24:40.022316 4570 kubelet.go:4570] "Pod is terminating, skipping pod status update" pod="default/api-d1ba8c3958ef1034" 2026-10-09T13:24:40.457891-07:00 web-03 nginx[1208]: 172.97.93.68 - - "GET /favicon.ico HTTP/1.1" 401 24979 "-" "Go-http-client/1.1" 2026-10-09T13:24:40.544075-07:00 web-03 app[30323]: INFO order 66430 confirmed for ci in 7681 ms (region us-east-1, queue emails) 2026-10-09T13:24:40.913586-07:00 web-02 nginx[1210]: 203.43.107.199 - - "GET /admin HTTP/1.1" 200 12278 "-" "curl/8.4.0" 2026-10-09T13:24:41.093563-07:00 cache-3 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.14.72.19, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.941.941:8080/metrics" 2026-10-09T13:24:41.320173-07:00 db-replica sshd[16833]: Invalid user françois from 91.137.46.22 port 11593 2026-10-09T13:24:41.335338-07:00 cache-3 app[30610]: INFO request_id=1d95b5b67b064a05 method=GET path=/api/v2/orders/8841 status=502 duration=2919ms 2026-10-09T13:24:41.538348-07:00 cache-3 postgres[25394]: LOG: duration: 9201.411 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:24:41.597651-07:00 db-primary sshd[50202]: Invalid user deploy from 172.179.161.2 port 43945 2026-10-09T13:24:41.610799-07:00 web-01 postgres[19820]: LOG: duration: 638.97 ms statement: SELECT * FROM orders WHERE customer_id = 70018 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:41.642453-07:00 db-primary app[30434]: INFO order 36896 confirmed for françois in 5314 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:24:41.829444-07:00 api-07 app[30361]: INFO request_id=25581351c903b0db method=GET path=/metrics status=200 duration=8361ms 2026-10-09T13:24:42.279759-07:00 api-07 nginx[1204]: 10.128.185.11 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 11178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:42.552460-07:00 db-replica systemd[1]: Started Session 23967 of User ci. 2026-10-09T13:24:42.607580-07:00 bastion kernel: [21037.664442] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.92.204.229 DST=10.0.949.949 LEN=51 TOS=0x00 PREC=0x00 TTL=51 ID=21037 DF PROTO=TCP SPT=42129 DPT=42129 WINDOW=21037 RES=0x00 SYN URGP=0 2026-10-09T13:24:42.859307-07:00 web-01 app[30814]: INFO worker 37 picked job 8f2582ef3adf3f7c from queue orders 2026-10-09T13:24:43.198926-07:00 web-03 haproxy[921]: 45.204.17.130:42366 [35694] http-in app/api-07 2518/0/161/161/2518 204 73297 - - ---- 331/331/73/73/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:24:43.279520-07:00 api-07 sshd[23297]: Invalid user müller from 172.163.219.90 port 34116 2026-10-09T13:24:43.298454-07:00 edge-fr-1 app[30976]: INFO request_id=aa9af4498f47b81b method=GET path=/api/v2/orders status=200 duration=4630ms 2026-10-09T13:24:43.501498-07:00 bastion systemd[1]: session-24855.scope: Deactivated successfully. 2026-10-09T13:24:43.619280-07:00 db-replica sudo: root : TTY=pts/0 ; PWD=/home/root ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:24:43.885885-07:00 web-01 app[30246]: INFO request_id=20f9a68ea5f13955 method=GET path=/.env status=301 duration=8024ms 2026-10-09T13:24:43.956417-07:00 edge-fr-1 haproxy[944]: 91.237.183.128:18424 [81056] http-in app/api-08 1337/0/36/36/1337 404 36991 - - ---- 490/490/68/68/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:24:44.029602-07:00 bastion app[30732]: INFO order 98573 confirmed for françois in 6981 ms (region us-east-1, queue orders) 2026-10-09T13:24:44.126676-07:00 web-03 sshd[58952]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:24:44.615540-07:00 bastion nginx[1202]: 45.123.246.196 - - "GET /static/main.css HTTP/1.1" 200 55909 "-" "curl/8.4.0" 2026-10-09T13:24:44.630471-07:00 db-replica postgres[10845]: LOG: duration: 4487.491 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:24:44.638738-07:00 api-08 sshd[63875]: Received disconnect from 203.182.194.78 port 25592:11: Bye Bye [preauth] 2026-10-09T13:24:44.689799-07:00 db-primary nginx[1209]: 192.59.186.248 - müller "POST /static/app.js HTTP/1.1" 401 894 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:45.013785-07:00 db-primary kernel: [67821.707962] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.150.214.106 DST=10.0.566.566 LEN=23 TOS=0x00 PREC=0x00 TTL=23 ID=67821 DF PROTO=TCP SPT=33404 DPT=33404 WINDOW=67821 RES=0x00 SYN URGP=0 2026-10-09T13:24:45.225827-07:00 bastion sshd[5839]: Connection closed by 10.160.7.230 port 43078 [preauth] 2026-10-09T13:24:45.410772-07:00 worker-12 app[30277]: DEBUG cache hit ratio 22% over the last minute (30702 lookups) 2026-10-09T13:24:45.414868-07:00 web-02 systemd[1]: session-84165.scope: Deactivated successfully. 2026-10-09T13:24:45.469093-07:00 db-primary app[30628]: INFO request_id=f5bdbd07ae77963a method=GET path=/static/app.js status=200 duration=562ms 2026-10-09T13:24:45.555767-07:00 worker-12 cron[11268]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:24:45.659506-07:00 web-02 postgres[4672]: LOG: duration: 6190.117 ms statement: SELECT * FROM orders WHERE customer_id = 61897 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:45.761989-07:00 web-01 app[30077]: INFO request_id=8b387e67396daf26 method=GET path=/wp-login.php status=404 duration=1386ms 2026-10-09T13:24:45.856917-07:00 web-01 app[30845]: INFO request_id=fd1358964ed2e94c method=GET path=/api/v2/orders status=404 duration=5507ms 2026-10-09T13:24:45.902230-07:00 bastion nginx[1204]: 192.108.111.81 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 20058 "-" "Go-http-client/1.1" 2026-10-09T13:24:45.937583-07:00 cache-3 nginx[1205]: 192.121.124.79 - root "POST /api/v2/orders/8841 HTTP/1.1" 200 20356 "-" "python-requests/2.32.3" 2026-10-09T13:24:45.942404-07:00 web-03 nginx[1204]: 91.62.18.242 - - "GET /login HTTP/1.1" 500 32845 "-" "kube-probe/1.31" 2026-10-09T13:24:46.137717-07:00 api-07 app[30304]: ERROR payment declined for order 85809: card_declined (code 98), customer notified 2026-10-09T13:24:46.168769-07:00 bastion haproxy[947]: 203.20.189.1:18055 [23679] http-in app/api-08 346/0/750/750/346 302 49319 - - ---- 645/645/33/33/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:24:46.239238-07:00 db-replica nginx[1204]: 172.236.250.233 - - "GET /health HTTP/1.1" 500 56047 "-" "Go-http-client/1.1" 2026-10-09T13:24:46.320450-07:00 worker-12 sshd[50977]: pam_unix(sshd:session): session opened for user deploy(uid=3448) by (uid=0) 2026-10-09T13:24:46.381949-07:00 db-primary haproxy[907]: 91.127.172.178:21707 [11747] http-in app/cache-3 4475/0/189/189/4475 301 15882 - - ---- 973/973/49/49/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:24:46.403663-07:00 web-02 cron[10168]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:46.414363-07:00 cache-3 app[30668]: INFO health check ok: db 305 ms, cache 305 ms, queue depth 32 2026-10-09T13:24:46.464261-07:00 api-08 sshd[12840]: Connection closed by 172.122.166.50 port 44762 [preauth] 2026-10-09T13:24:46.581704-07:00 edge-fr-1 nginx[1208]: 91.68.186.94 - - "GET /favicon.ico HTTP/1.1" 502 45417 "-" "Go-http-client/1.1" 2026-10-09T13:24:46.633765-07:00 db-primary app[30816]: INFO worker 56 finished job 4be417b5469b8ae5 in 3702 ms 2026-10-09T13:24:46.794508-07:00 edge-fr-1 app[30015]: INFO health check ok: db 535 ms, cache 535 ms, queue depth 24 2026-10-09T13:24:46.896885-07:00 web-01 app[30650]: INFO worker 91 picked job 932e50268c90fa46 from queue emails 2026-10-09T13:24:47.191409-07:00 bastion kernel: [31909.838650] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.68.253.238 DST=10.0.748.748 LEN=74 TOS=0x00 PREC=0x00 TTL=74 ID=31909 DF PROTO=TCP SPT=5751 DPT=5751 WINDOW=31909 RES=0x00 SYN URGP=0 2026-10-09T13:24:47.230398-07:00 worker-12 nginx[1205]: 10.62.147.164 - - "GET /admin HTTP/1.1" 302 38830 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:47.371214-07:00 api-07 systemd[1]: Started Session 94789 of User deploy. 2026-10-09T13:24:47.431107-07:00 api-07 cron[23197]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:47.604733-07:00 edge-fr-1 app[30584]: INFO worker 13 finished job d7619902dbc81975 in 6810 ms 2026-10-09T13:24:47.671805-07:00 api-08 haproxy[908]: 91.69.240.7:53586 [28745] http-in app/cache-3 9643/0/118/118/9643 200 64580 - - ---- 221/221/32/32/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:24:47.860403-07:00 api-07 systemd[1]: session-46900.scope: Deactivated successfully. 2026-10-09T13:24:47.884306-07:00 web-01 app[30385]: INFO request_id=6a9d07d4a9fb20c0 method=GET path=/wp-login.php status=302 duration=6315ms 2026-10-09T13:24:47.955487-07:00 db-primary systemd[1]: Started Session 89557 of User müller. 2026-10-09T13:24:48.212158-07:00 api-07 cron[24585]: (müller) CMD (/usr/bin/backup --quiet --target /srv/müller) 2026-10-09T13:24:48.423224-07:00 web-01 sshd[23849]: Invalid user backup from 10.51.159.216 port 7782 2026-10-09T13:24:48.521675-07:00 bastion nginx[1203]: 10.218.179.160 - - "GET /api/v2/users HTTP/1.1" 200 20601 "-" "Go-http-client/1.1" 2026-10-09T13:24:48.536547-07:00 cache-3 app[30267]: INFO request_id=004df23758d2ef8d method=GET path=/.env status=301 duration=2702ms 2026-10-09T13:24:48.542252-07:00 db-replica app[30088]: INFO order 45018 confirmed for akira in 442 ms (region eu-west-1, queue invoices) 2026-10-09T13:24:48.658027-07:00 db-replica nginx[1209]: 192.224.185.108 - - "GET /api/v2/orders HTTP/1.1" 502 88372 "-" "curl/8.4.0" 2026-10-09T13:24:48.815307-07:00 cache-3 nginx[1201]: 192.227.21.73 - - "GET /static/app.js HTTP/1.1" 200 68188 "-" "curl/8.4.0" 2026-10-09T13:24:49.063855-07:00 api-07 nginx[1202]: 91.1.182.248 - - "GET /login HTTP/1.1" 200 12825 "-" "curl/8.4.0" 2026-10-09T13:24:49.198672-07:00 web-01 app[30422]: INFO worker 19 finished job da418521fbb0f539 in 3089 ms 2026-10-09T13:24:49.203222-07:00 cache-3 app[30199]: INFO worker 14 picked job 6a6aa461016e2f0c from queue orders 2026-10-09T13:24:49.420438-07:00 web-03 app[30582]: INFO worker 77 finished job ef2d057e46a80c00 in 60 ms 2026-10-09T13:24:49.566966-07:00 worker-12 nginx[1209]: 172.80.253.52 - - "GET /login HTTP/1.1" 204 80121 "-" "kube-probe/1.31" 2026-10-09T13:24:49.741078-07:00 api-07 sshd[50114]: pam_unix(sshd:session): session opened for user deploy(uid=3561) by (uid=0) 2026-10-09T13:24:49.772982-07:00 web-03 kernel: [21349.279803] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.254.48.57 DST=10.0.484.484 LEN=77 TOS=0x00 PREC=0x00 TTL=77 ID=21349 DF PROTO=TCP SPT=30180 DPT=30180 WINDOW=21349 RES=0x00 SYN URGP=0 2026-10-09T13:24:49.828898-07:00 web-03 app[30936]: INFO request_id=5b55338281a607f1 method=GET path=/wp-login.php status=404 duration=4549ms 2026-10-09T13:24:49.897600-07:00 bastion app[30301]: WARN retrying upstream 91.73.126.240:26069 after timeout (865 ms), attempt 1 of 3 2026-10-09T13:24:50.354913-07:00 api-08 app[30430]: INFO worker 26 picked job c883851860017f15 from queue emails 2026-10-09T13:24:50.494578-07:00 edge-fr-1 nginx[1203]: 10.98.174.93 - - "GET /login HTTP/1.1" 404 15301 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:50.567956-07:00 worker-12 sshd[60368]: Failed password for invalid user priya from 192.124.72.177 port 27788 ssh2 2026-10-09T13:24:50.634608-07:00 web-01 app[30713]: INFO worker 56 finished job a773a2f1e87229fe in 7716 ms 2026-10-09T13:24:50.669907-07:00 api-08 app[30387]: INFO worker 99 finished job 2649876bc992789b in 7577 ms 2026-10-09T13:24:50.775152-07:00 cache-3 haproxy[916]: 172.18.127.50:57471 [32679] http-in app/web-01 4651/0/520/520/4651 404 11430 - - ---- 618/618/50/50/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:50.965672-07:00 web-01 nginx[1208]: 10.102.208.97 - - "GET /health HTTP/1.1" 401 27802 "-" "Go-http-client/1.1" 2026-10-09T13:24:51.001056-07:00 web-01 app[30894]: INFO worker 56 picked job a5e442005ecf8ec6 from queue invoices 2026-10-09T13:24:51.052039-07:00 api-08 cron[35379]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:51.080180-07:00 edge-fr-1 app[30994]: INFO health check ok: db 448 ms, cache 448 ms, queue depth 84 2026-10-09T13:24:51.242649-07:00 edge-fr-1 systemd[1]: session-38155.scope: Deactivated successfully. 2026-10-09T13:24:51.325139-07:00 db-replica sshd[60778]: Accepted publickey for zoë from 203.152.76.201 port 35178 ssh2: ED25519 SHA256:c729f0dbadf6a05e 2026-10-09T13:24:51.461547-07:00 bastion sshd[56540]: Accepted publickey for akira from 203.195.83.253 port 48661 ssh2: ED25519 SHA256:63579b64f4acc0a8 2026-10-09T13:24:51.517454-07:00 web-02 app[30365]: INFO request_id=5ebb87f0cbb5a3d0 method=GET path=/wp-login.php status=500 duration=961ms 2026-10-09T13:24:51.570831-07:00 web-03 app[30488]: INFO health check ok: db 987 ms, cache 987 ms, queue depth 84 2026-10-09T13:24:51.663058-07:00 worker-12 app[30760]: INFO order 70166 confirmed for priya in 1341 ms (region us-east-1, queue invoices) 2026-10-09T13:24:51.724879-07:00 db-replica app[30383]: INFO worker 61 finished job 0c0949f3270b222e in 3575 ms 2026-10-09T13:24:51.992151-07:00 edge-fr-1 sshd[40071]: Invalid user backup from 192.10.188.102 port 46365 2026-10-09T13:24:52.003358-07:00 web-02 nginx[1201]: 45.191.73.201 - - "GET /static/app.js HTTP/1.1" 200 48862 "-" "curl/8.4.0" 2026-10-09T13:24:52.339337-07:00 web-02 sshd[1321]: Invalid user root from 10.43.50.249 port 36534 2026-10-09T13:24:52.399717-07:00 web-02 sshd[27403]: Received disconnect from 172.116.79.208 port 16111:11: Bye Bye [preauth] 2026-10-09T13:24:52.405422-07:00 edge-fr-1 haproxy[901]: 203.215.107.139:12617 [20217] http-in app/db-primary 150/0/708/708/150 302 83529 - - ---- 339/339/70/70/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:24:52.740506-07:00 api-07 nginx[1204]: 192.122.239.4 - ci "POST /login HTTP/1.1" 200 19242 "-" "kube-probe/1.31" 2026-10-09T13:24:52.818116-07:00 edge-fr-1 systemd[1]: Started Session 36155 of User root. 2026-10-09T13:24:52.824227-07:00 web-01 postgres[22829]: LOG: checkpoint complete: wrote 7838 buffers (22%); 0 WAL file(s) added, 0 removed, 93 recycled; write=2827.704 s, sync=0.704 s, total=2827.704 s 2026-10-09T13:24:52.983137-07:00 edge-fr-1 app[30395]: INFO request_id=1ee45957a3407d8a method=GET path=/wp-login.php status=200 duration=7203ms 2026-10-09T13:24:53.058565-07:00 bastion sshd[18217]: Received disconnect from 10.202.162.30 port 62694:11: Bye Bye [preauth] 2026-10-09T13:24:53.325593-07:00 cache-3 app[30662]: INFO order 30431 confirmed for françois in 5229 ms (region eu-west-1, queue webhooks) 2026-10-09T13:24:53.574056-07:00 db-primary haproxy[908]: 203.0.101.125:53308 [88458] http-in app/worker-12 2407/0/914/914/2407 204 87898 - - ---- 110/110/33/33/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:24:53.574654-07:00 edge-fr-1 postgres[7788]: LOG: duration: 890.959 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:24:53.684868-07:00 edge-fr-1 haproxy[928]: 45.8.38.228:19342 [57868] http-in app/db-primary 3909/0/31/31/3909 404 67213 - - ---- 979/979/10/10/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:24:53.744931-07:00 db-primary nginx[1200]: 203.32.76.107 - - "GET /wp-login.php HTTP/1.1" 301 78219 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:24:53.858048-07:00 db-primary app[30481]: DEBUG cache hit ratio 3% over the last minute (11565 lookups) 2026-10-09T13:24:53.941885-07:00 worker-12 nginx[1200]: 91.64.231.85 - - "GET /static/app.js HTTP/1.1" 404 67914 "-" "kube-probe/1.31" 2026-10-09T13:24:54.067030-07:00 cache-3 app[30963]: INFO request_id=5029add3007533b8 method=GET path=/api/v2/orders status=302 duration=111ms 2026-10-09T13:24:54.153777-07:00 db-replica postgres[7399]: LOG: duration: 8300.737 ms statement: SELECT * FROM orders WHERE customer_id = 55088 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:54.304883-07:00 api-07 kernel: [76636.043810] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.214.216.49 DST=10.0.855.855 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=76636 DF PROTO=TCP SPT=57902 DPT=57902 WINDOW=76636 RES=0x00 SYN URGP=0 2026-10-09T13:24:54.330704-07:00 db-replica nginx[1203]: 10.5.13.227 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 18632 "-" "curl/8.4.0" 2026-10-09T13:24:54.339008-07:00 api-08 sshd[20958]: Accepted publickey for akira from 10.211.180.118 port 46598 ssh2: ED25519 SHA256:219d38025af3767e 2026-10-09T13:24:54.441276-07:00 api-07 sshd[27823]: Failed password for invalid user sørensen from 172.103.146.175 port 27063 ssh2 2026-10-09T13:24:54.584214-07:00 db-replica nginx[1203]: 91.128.78.171 - backup "POST /static/main.css HTTP/1.1" 502 28064 "-" "kube-probe/1.31" 2026-10-09T13:24:54.723659-07:00 api-08 cron[42189]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:24:54.904951-07:00 api-07 systemd[1]: session-87876.scope: Deactivated successfully. 2026-10-09T13:24:54.918727-07:00 bastion app[30937]: INFO worker 20 picked job 372d69982f908bc7 from queue emails 2026-10-09T13:24:54.925874-07:00 db-primary kernel: [93760.657602] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.193.249.243 DST=10.0.175.175 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=93760 DF PROTO=TCP SPT=63107 DPT=63107 WINDOW=93760 RES=0x00 SYN URGP=0 2026-10-09T13:24:54.956401-07:00 bastion nginx[1209]: 192.96.160.139 - - "GET /health HTTP/1.1" 502 4536 "-" "kube-probe/1.31" 2026-10-09T13:24:55.101758-07:00 edge-fr-1 app[30213]: INFO worker 63 finished job 153907dfe1789e55 in 3103 ms 2026-10-09T13:24:55.104009-07:00 db-replica sshd[44372]: Failed password for invalid user root from 192.117.207.5 port 32132 ssh2 2026-10-09T13:24:55.155509-07:00 api-08 sshd[14968]: Connection closed by 203.200.251.8 port 60756 [preauth] 2026-10-09T13:24:55.189098-07:00 web-01 sshd[37580]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:24:55.387234-07:00 web-03 sshd[59095]: Failed password for invalid user deploy from 91.249.250.9 port 21269 ssh2 2026-10-09T13:24:55.543884-07:00 web-01 app[30796]: INFO order 74604 confirmed for backup in 7990 ms (region us-east-1, queue invoices) 2026-10-09T13:24:55.649258-07:00 db-replica haproxy[947]: 45.134.191.71:34222 [14324] http-in app/edge-fr-1 4813/0/358/358/4813 200 16509 - - ---- 977/977/26/26/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:24:55.804790-07:00 api-07 sshd[24082]: pam_unix(sshd:session): session opened for user priya(uid=3043) by (uid=0) 2026-10-09T13:24:55.997727-07:00 bastion app[30045]: INFO worker 63 picked job 2a4bee119f8b097d from queue orders 2026-10-09T13:24:56.027270-07:00 db-replica app[30626]: INFO request_id=f4238e8bd70aaa51 method=GET path=/api/v2/orders status=200 duration=3160ms 2026-10-09T13:24:56.178046-07:00 api-08 app[30418]: INFO order 51352 confirmed for françois in 8791 ms (region eu-west-1, queue orders) 2026-10-09T13:24:56.253432-07:00 api-08 postgres[4267]: LOG: duration: 1604.519 ms statement: SELECT * FROM orders WHERE customer_id = 86147 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:24:56.535956-07:00 web-02 systemd[1]: session-27907.scope: Deactivated successfully. 2026-10-09T13:24:56.763015-07:00 web-03 app[30603]: INFO worker 90 finished job d9521847bd9f69a4 in 4843 ms 2026-10-09T13:24:56.842140-07:00 web-01 haproxy[919]: 203.142.107.47:22755 [37745] http-in app/db-replica 897/0/149/149/897 200 79027 - - ---- 390/390/26/26/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:24:56.998121-07:00 api-08 nginx[1208]: 192.60.55.235 - - "GET /static/main.css HTTP/1.1" 200 47331 "-" "python-requests/2.32.3" 2026-10-09T13:24:57.073835-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:24:57.073835-07:00" level=info msg="Container be09aa8094f4639f exited with code 0" 2026-10-09T13:24:57.209440-07:00 bastion systemd[1]: Started Session 64774 of User deploy. 2026-10-09T13:24:57.231540-07:00 web-03 app[30383]: INFO order 21583 confirmed for akira in 3273 ms (region eu-west-1, queue invoices) 2026-10-09T13:24:57.396051-07:00 api-08 sshd[4844]: Invalid user akira from 91.188.212.47 port 15365 2026-10-09T13:24:57.553173-07:00 edge-fr-1 app[30707]: INFO order 46201 confirmed for backup in 3114 ms (region eu-west-1, queue orders) 2026-10-09T13:24:57.553486-07:00 api-07 nginx[1203]: 45.172.73.45 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 36491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:24:57.993730-07:00 api-08 haproxy[949]: 192.197.108.253:9838 [19763] http-in app/cache-3 874/0/349/349/874 200 68182 - - ---- 818/818/72/72/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:24:58.000721-07:00 edge-fr-1 app[30741]: INFO order 98836 confirmed for root in 5796 ms (region us-east-1, queue orders) 2026-10-09T13:24:58.045582-07:00 db-primary app[30193]: INFO worker 47 finished job 0da72d52bceb0478 in 7889 ms 2026-10-09T13:24:58.103344-07:00 api-07 sshd[40400]: Received disconnect from 91.122.70.151 port 35256:11: Bye Bye [preauth] 2026-10-09T13:24:58.150903-07:00 web-03 systemd[1]: session-19945.scope: Deactivated successfully. 2026-10-09T13:24:58.168641-07:00 worker-12 haproxy[919]: 203.151.220.8:38378 [40177] http-in app/web-01 6562/0/328/328/6562 200 53980 - - ---- 712/712/70/70/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:24:58.287580-07:00 web-02 app[30191]: INFO worker 47 finished job d9affd8a832d641f in 9987 ms 2026-10-09T13:24:58.444386-07:00 cache-3 postgres[11330]: LOG: duration: 4934.758 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:24:58.616820-07:00 api-08 app[30962]: INFO request_id=65eeb1a6477293c6 method=GET path=/static/app.js status=302 duration=8687ms 2026-10-09T13:24:58.703716-07:00 web-01 sshd[42578]: Failed password for invalid user backup from 45.198.178.41 port 55698 ssh2 2026-10-09T13:24:58.802394-07:00 worker-12 app[30770]: INFO order 81237 confirmed for zoë in 4729 ms (region ap-northeast-1, queue emails) 2026-10-09T13:24:58.809778-07:00 db-replica nginx[1205]: 203.53.214.114 - - "GET /metrics HTTP/1.1" 200 45457 "-" "curl/8.4.0" 2026-10-09T13:24:59.274649-07:00 edge-fr-1 app[30041]: INFO worker 80 finished job 4c11c5d04a751386 in 1538 ms 2026-10-09T13:24:59.291805-07:00 api-08 kernel: [66400.701863] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.109.125.36 DST=10.0.117.117 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=66400 DF PROTO=TCP SPT=41347 DPT=41347 WINDOW=66400 RES=0x00 SYN URGP=0 2026-10-09T13:24:59.339747-07:00 bastion app[30809]: DEBUG cache hit ratio 34% over the last minute (10826 lookups) 2026-10-09T13:24:59.407240-07:00 bastion haproxy[916]: 10.57.109.12:43951 [65739] http-in app/api-08 2383/0/359/359/2383 200 43472 - - ---- 453/453/93/93/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:24:59.597344-07:00 bastion app[30965]: INFO health check ok: db 329 ms, cache 329 ms, queue depth 41 2026-10-09T13:24:59.639067-07:00 bastion app[30354]: INFO worker 78 finished job 46350f7257d68dc4 in 5167 ms 2026-10-09T13:24:59.783763-07:00 db-replica nginx[1201]: 10.142.174.187 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 24902 "-" "Go-http-client/1.1" 2026-10-09T13:24:59.852827-07:00 db-replica haproxy[925]: Server app/api-07 is DOWN, reason: Layer4 timeout, check duration: 6055ms. 39 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:24:59.924776-07:00 web-03 app[30848]: INFO order 52129 confirmed for akira in 4962 ms (region us-east-1, queue orders) 2026-10-09T13:24:59.973564-07:00 edge-fr-1 nginx[1204]: 192.138.195.162 - - "GET /static/main.css HTTP/1.1" 200 87574 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:00.310650-07:00 api-08 app[30932]: INFO request_id=4b11aa43c1f8f3a0 method=GET path=/api/v2/users status=200 duration=8689ms 2026-10-09T13:25:00.644203-07:00 web-01 sshd[48541]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:25:00.685400-07:00 web-01 nginx[1202]: 203.164.135.206 - - "GET /api/v2/orders HTTP/1.1" 301 35946 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:00.757517-07:00 web-03 app[30925]: INFO worker 73 picked job 9bc41f4d5b4a0624 from queue invoices 2026-10-09T13:25:00.767804-07:00 web-01 sshd[62655]: Accepted publickey for akira from 45.98.196.10 port 29878 ssh2: ED25519 SHA256:42329f85b6d669e6 2026-10-09T13:25:00.803561-07:00 api-07 app[30595]: INFO request_id=55cdee6a4e13aa23 method=GET path=/static/app.js status=500 duration=9562ms 2026-10-09T13:25:00.814370-07:00 api-07 app[30982]: INFO worker 46 picked job 8f1ff43ec1c9ffb1 from queue orders 2026-10-09T13:25:00.852481-07:00 edge-fr-1 app[30211]: INFO order 97032 confirmed for sørensen in 1015 ms (region us-east-1, queue invoices) 2026-10-09T13:25:01.153612-07:00 db-primary nginx[1201]: 192.156.105.110 - müller "POST /health HTTP/1.1" 200 22416 "-" "python-requests/2.32.3" 2026-10-09T13:25:01.286793-07:00 worker-12 sshd[1976]: Invalid user zoë from 203.227.242.31 port 58638 2026-10-09T13:25:01.307841-07:00 db-replica nginx[1203]: 45.249.40.75 - - "GET /login HTTP/1.1" 204 52804 "-" "kube-probe/1.31" 2026-10-09T13:25:01.585777-07:00 web-01 systemd[1]: Started Session 42821 of User backup. 2026-10-09T13:25:01.599868-07:00 web-03 app[30332]: INFO request_id=5de24a23dd0101f3 method=GET path=/.env status=204 duration=6659ms 2026-10-09T13:25:01.630164-07:00 web-02 sshd[5511]: Invalid user ci from 172.90.254.197 port 15665 2026-10-09T13:25:01.829601-07:00 api-08 app[30950]: ERROR cache miss storm: 5408 misses in 5297 ms, key prefix session:deploy 2026-10-09T13:25:01.847806-07:00 web-03 nginx[1204]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.151.29.33, server: app.example.com, request: "GET /static/main.css HTTP/1.1", upstream: "http://10.0.566.566:8080/static/main.css" 2026-10-09T13:25:01.856722-07:00 worker-12 sshd[55183]: Connection closed by 10.141.80.80 port 17545 [preauth] 2026-10-09T13:25:01.875291-07:00 db-primary app[30714]: INFO order 15970 confirmed for deploy in 3366 ms (region us-east-1, queue invoices) 2026-10-09T13:25:01.950033-07:00 web-01 app[30471]: INFO request_id=764dd29ba0d5673b method=GET path=/api/v2/orders/8841 status=401 duration=2502ms 2026-10-09T13:25:02.069565-07:00 worker-12 app[30961]: WARN slow query (1199 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '75 minutes' 2026-10-09T13:25:02.224825-07:00 bastion postgres[18521]: LOG: duration: 8939.49 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:02.273481-07:00 cache-3 app[30084]: INFO worker 18 picked job 97b3b20958aeb1a7 from queue webhooks 2026-10-09T13:25:02.428288-07:00 api-07 cron[9326]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:25:02.513975-07:00 cache-3 app[30342]: INFO order 94816 confirmed for akira in 5914 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:25:02.944104-07:00 web-03 nginx[1200]: 203.155.179.3 - - "GET /api/v2/users HTTP/1.1" 502 21113 "-" "Go-http-client/1.1" 2026-10-09T13:25:03.144048-07:00 db-primary dockerd[700]: time="2026-10-09T13:25:03.144048-07:00" level=info msg="Container d59ed32ae12d24b0 exited with code 0" 2026-10-09T13:25:03.270740-07:00 web-03 systemd[1]: session-20478.scope: Deactivated successfully. 2026-10-09T13:25:03.300100-07:00 api-07 nginx[1201]: 45.38.13.171 - - "GET /.env HTTP/1.1" 204 84736 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:03.516405-07:00 cache-3 app[30680]: INFO request_id=a1914876ecc49451 method=GET path=/health status=200 duration=277ms 2026-10-09T13:25:03.524627-07:00 web-01 nginx[1204]: 203.81.120.106 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 74617 "-" "Go-http-client/1.1" 2026-10-09T13:25:03.543844-07:00 cache-3 systemd[1]: session-25461.scope: Deactivated successfully. 2026-10-09T13:25:03.843177-07:00 web-02 app[30267]: INFO order 43104 confirmed for root in 9816 ms (region us-east-1, queue orders) 2026-10-09T13:25:03.922662-07:00 web-01 app[30639]: INFO request_id=8532f00a88fa9da6 method=GET path=/api/v2/search?q=invoice status=200 duration=5471ms 2026-10-09T13:25:04.159569-07:00 web-03 postgres[14750]: LOG: duration: 6729.830 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:04.173546-07:00 worker-12 nginx[1204]: 45.229.146.122 - - "GET /.env HTTP/1.1" 200 56977 "-" "kube-probe/1.31" 2026-10-09T13:25:04.328429-07:00 db-replica postgres[19228]: LOG: duration: 1676.738 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:04.480719-07:00 bastion app[30063]: INFO worker 55 finished job f32541c39ce5fa8b in 4947 ms 2026-10-09T13:25:04.567526-07:00 web-01 nginx[1205]: 172.216.19.224 - - "GET /api/v2/orders HTTP/1.1" 404 47531 "-" "python-requests/2.32.3" 2026-10-09T13:25:04.723724-07:00 web-03 haproxy[919]: 192.74.138.249:64429 [87899] http-in app/db-primary 6013/0/585/585/6013 200 13978 - - ---- 880/880/65/65/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:25:04.873419-07:00 bastion nginx[1200]: 192.226.90.124 - - "GET /.env HTTP/1.1" 302 42390 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:04.880907-07:00 api-07 app[30722]: INFO order 50479 confirmed for sørensen in 7763 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:25:04.939136-07:00 db-primary nginx[1201]: 172.99.110.166 - - "GET /favicon.ico HTTP/1.1" 301 61064 "-" "curl/8.4.0" 2026-10-09T13:25:05.033519-07:00 cache-3 sshd[10059]: Connection closed by 91.87.219.62 port 15497 [preauth] 2026-10-09T13:25:05.314412-07:00 api-07 sshd[9893]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:25:05.347537-07:00 cache-3 nginx[1203]: 91.221.77.61 - - "GET /metrics HTTP/1.1" 404 57774 "-" "Go-http-client/1.1" 2026-10-09T13:25:05.542786-07:00 web-02 app[30926]: WARN slow query (4394 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '32 minutes' 2026-10-09T13:25:05.675462-07:00 cache-3 nginx[1206]: 91.15.206.203 - - "GET /login HTTP/1.1" 200 44510 "-" "kube-probe/1.31" 2026-10-09T13:25:05.738114-07:00 web-02 nginx[1205]: 10.92.234.167 - - "GET /api/v2/orders HTTP/1.1" 302 27471 "-" "python-requests/2.32.3" 2026-10-09T13:25:05.889758-07:00 web-02 app[30764]: INFO order 24111 confirmed for priya in 828 ms (region eu-west-1, queue webhooks) 2026-10-09T13:25:05.917521-07:00 worker-12 nginx[1207]: 172.238.108.12 - - "GET /static/app.js HTTP/1.1" 404 17580 "-" "curl/8.4.0" 2026-10-09T13:25:05.942559-07:00 api-08 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.244.70.174, server: app.example.com, request: "GET /api/v2/search?q=invoice HTTP/1.1", upstream: "http://10.0.647.647:8080/api/v2/search?q=invoice" 2026-10-09T13:25:05.980129-07:00 cache-3 nginx[1200]: 172.110.224.252 - - "GET /api/v2/users HTTP/1.1" 404 81617 "-" "Go-http-client/1.1" 2026-10-09T13:25:05.985578-07:00 api-07 sshd[20357]: Invalid user zoë from 45.102.253.90 port 5769 2026-10-09T13:25:06.164123-07:00 db-replica sshd[37949]: Connection closed by 91.78.173.154 port 44178 [preauth] 2026-10-09T13:25:06.412845-07:00 web-01 nginx[1207]: 10.54.220.91 - priya "POST /login HTTP/1.1" 200 48622 "-" "curl/8.4.0" 2026-10-09T13:25:06.423161-07:00 web-02 sshd[26951]: Accepted publickey for deploy from 10.53.117.173 port 50525 ssh2: ED25519 SHA256:84436aadd87aa37a 2026-10-09T13:25:06.731851-07:00 web-02 haproxy[902]: 45.64.243.98:46869 [23952] http-in app/api-08 7173/0/605/605/7173 200 75353 - - ---- 415/415/11/11/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:25:06.785526-07:00 web-01 sshd[49376]: Invalid user priya from 10.169.116.6 port 26275 2026-10-09T13:25:06.786853-07:00 api-07 app[30086]: INFO request_id=6811541f6b0f984c method=GET path=/api/v2/orders status=200 duration=1946ms 2026-10-09T13:25:06.907596-07:00 cache-3 nginx[1203]: 203.137.50.184 - - "GET /api/v2/orders HTTP/1.1" 204 63958 "-" "curl/8.4.0" 2026-10-09T13:25:06.983492-07:00 web-01 app[30679]: INFO worker 11 picked job c517fd2c4b43361a from queue webhooks 2026-10-09T13:25:07.036425-07:00 api-08 sshd[52284]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:25:07.117938-07:00 db-replica app[30059]: INFO request_id=2c1e4a2940910484 method=GET path=/login status=200 duration=4400ms 2026-10-09T13:25:07.178313-07:00 web-02 nginx[1201]: 45.94.197.224 - - "GET /metrics HTTP/1.1" 301 17261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:07.203267-07:00 db-primary app[30475]: INFO worker 19 finished job d543f02b18d19037 in 4864 ms 2026-10-09T13:25:07.308551-07:00 edge-fr-1 cron[35881]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:25:07.336516-07:00 bastion app[30324]: INFO request_id=1a7b2bc598f8713f method=GET path=/.env status=404 duration=2892ms 2026-10-09T13:25:07.356276-07:00 db-replica haproxy[948]: 91.103.134.46:21350 [18169] http-in app/web-03 4971/0/128/128/4971 200 40560 - - ---- 631/631/48/48/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:25:07.425459-07:00 api-08 kernel: [13320.921403] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.9.42.246 DST=10.0.883.883 LEN=25 TOS=0x00 PREC=0x00 TTL=25 ID=13320 DF PROTO=TCP SPT=44579 DPT=44579 WINDOW=13320 RES=0x00 SYN URGP=0 2026-10-09T13:25:07.823986-07:00 api-08 app[30325]: INFO order 64617 confirmed for backup in 7444 ms (region eu-west-1, queue orders) 2026-10-09T13:25:08.459730-07:00 web-02 nginx[1201]: 192.121.154.104 - - "GET /static/main.css HTTP/1.1" 200 37821 "-" "python-requests/2.32.3" 2026-10-09T13:25:08.513266-07:00 cache-3 app[30284]: INFO request_id=445f6e299033d1c5 method=GET path=/api/v2/users status=302 duration=2251ms 2026-10-09T13:25:08.535636-07:00 db-replica app[30778]: INFO request_id=a730775957e82217 method=GET path=/static/app.js status=502 duration=6186ms 2026-10-09T13:25:08.649222-07:00 worker-12 nginx[1210]: 10.122.20.36 - ci "POST /static/app.js HTTP/1.1" 404 589 "-" "python-requests/2.32.3" 2026-10-09T13:25:08.747310-07:00 db-replica kernel: [25373.085150] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.145.55.127 DST=10.0.111.111 LEN=93 TOS=0x00 PREC=0x00 TTL=93 ID=25373 DF PROTO=TCP SPT=29469 DPT=29469 WINDOW=25373 RES=0x00 SYN URGP=0 2026-10-09T13:25:08.783190-07:00 db-primary app[30089]: INFO worker 31 picked job 5e0217f946c6188a from queue orders 2026-10-09T13:25:08.857838-07:00 db-primary sshd[22400]: pam_unix(sshd:session): session opened for user backup(uid=7399) by (uid=0) 2026-10-09T13:25:08.886831-07:00 bastion app[30248]: INFO order 18945 confirmed for backup in 5965 ms (region eu-west-1, queue emails) 2026-10-09T13:25:09.199553-07:00 cache-3 nginx[1206]: 192.239.50.228 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 66682 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:09.296000-07:00 edge-fr-1 nginx[1209]: 91.59.67.175 - - "GET /api/v2/orders HTTP/1.1" 200 15307 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:09.297997-07:00 web-03 nginx[1208]: 45.164.54.55 - sørensen "POST /static/app.js HTTP/1.1" 404 52436 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:09.325353-07:00 db-primary haproxy[941]: 45.169.91.161:60710 [47891] http-in app/cache-3 4346/0/557/557/4346 502 53291 - - ---- 883/883/26/26/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:09.437408-07:00 web-02 app[30379]: INFO health check ok: db 15 ms, cache 15 ms, queue depth 62 2026-10-09T13:25:09.897508-07:00 bastion haproxy[929]: 10.148.139.14:11649 [30612] http-in app/cache-3 1827/0/796/796/1827 302 69147 - - ---- 728/728/19/19/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:25:09.928462-07:00 db-primary app[30571]: INFO worker 54 picked job c7c9cab6e758f119 from queue webhooks 2026-10-09T13:25:09.933307-07:00 api-08 app[30445]: INFO request_id=c944c9c098c7a102 method=GET path=/api/v2/orders/8841 status=500 duration=5133ms 2026-10-09T13:25:09.934746-07:00 worker-12 app[30933]: INFO worker 16 finished job 14e18b7ea052b2f8 in 9486 ms 2026-10-09T13:25:09.962443-07:00 api-08 nginx[1210]: 203.50.83.214 - - "GET /favicon.ico HTTP/1.1" 502 80044 "-" "kube-probe/1.31" 2026-10-09T13:25:09.998571-07:00 edge-fr-1 haproxy[947]: 203.195.176.238:42383 [11878] http-in app/worker-12 7792/0/442/442/7792 200 3359 - - ---- 576/576/11/11/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:25:10.014785-07:00 db-replica kernel: [63949.802898] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.241.144.24 DST=10.0.640.640 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=63949 DF PROTO=TCP SPT=1079 DPT=1079 WINDOW=63949 RES=0x00 SYN URGP=0 2026-10-09T13:25:10.370553-07:00 web-02 haproxy[915]: 203.93.248.175:60983 [55511] http-in app/web-03 7737/0/428/428/7737 301 67211 - - ---- 582/582/23/23/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:10.572164-07:00 web-01 sshd[21743]: Received disconnect from 91.184.93.171 port 52734:11: Bye Bye [preauth] 2026-10-09T13:25:10.590656-07:00 db-primary app[30453]: DEBUG cache hit ratio 96% over the last minute (58705 lookups) 2026-10-09T13:25:10.634576-07:00 worker-12 nginx[1204]: 203.233.8.16 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 73810 "-" "curl/8.4.0" 2026-10-09T13:25:10.906612-07:00 bastion postgres[20058]: LOG: duration: 7848.753 ms statement: SELECT * FROM orders WHERE customer_id = 89120 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:10.961240-07:00 cache-3 app[30133]: WARN retrying upstream 10.91.207.38:54108 after timeout (1023 ms), attempt 3 of 3 2026-10-09T13:25:10.967601-07:00 api-07 postgres[12501]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 96898 remain, 2329 scanned (2% of total) 2026-10-09T13:25:11.287859-07:00 api-07 cron[28945]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:25:11.436224-07:00 edge-fr-1 haproxy[921]: 45.2.175.111:49984 [99503] http-in app/api-07 9526/0/974/974/9526 200 71933 - - ---- 171/171/61/61/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:11.491772-07:00 web-02 nginx[1210]: 10.88.133.102 - - "GET /static/main.css HTTP/1.1" 404 49036 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:11.563056-07:00 db-replica app[30633]: INFO request_id=2dfd2ccf8a0a0e92 method=GET path=/favicon.ico status=301 duration=4155ms 2026-10-09T13:25:11.565869-07:00 cache-3 app[30148]: INFO worker 72 finished job d8bde7299cff99f9 in 9206 ms 2026-10-09T13:25:11.691693-07:00 db-primary nginx[1200]: 45.166.135.144 - - "GET /api/v2/orders HTTP/1.1" 502 71417 "-" "Go-http-client/1.1" 2026-10-09T13:25:12.103207-07:00 bastion nginx[1203]: 91.141.7.99 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 13162 "-" "python-requests/2.32.3" 2026-10-09T13:25:12.151785-07:00 db-primary app[30154]: INFO health check ok: db 880 ms, cache 880 ms, queue depth 62 2026-10-09T13:25:12.178379-07:00 web-03 app[30595]: INFO request_id=b38427556454b6dd method=GET path=/api/v2/search?q=invoice status=302 duration=5176ms 2026-10-09T13:25:12.246320-07:00 api-07 haproxy[919]: 45.156.252.121:29605 [86402] http-in app/db-primary 5093/0/50/50/5093 200 44008 - - ---- 344/344/54/54/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:25:12.268119-07:00 api-07 app[30581]: INFO order 17839 confirmed for akira in 6114 ms (region us-east-1, queue emails) 2026-10-09T13:25:12.421722-07:00 web-01 nginx[1209]: 203.234.135.106 - - "GET /wp-login.php HTTP/1.1" 200 23354 "-" "Go-http-client/1.1" 2026-10-09T13:25:12.653478-07:00 db-primary sshd[6011]: pam_unix(sshd:session): session opened for user françois(uid=9065) by (uid=0) 2026-10-09T13:25:12.687895-07:00 db-primary sshd[38677]: Invalid user zoë from 172.214.111.70 port 43355 2026-10-09T13:25:12.707997-07:00 api-08 app[30912]: INFO request_id=3c3aebd6ad2f53ca method=GET path=/health status=502 duration=7509ms 2026-10-09T13:25:12.727787-07:00 api-08 app[30938]: INFO request_id=1ae121f99fbb43b9 method=GET path=/api/v2/orders/8841 status=204 duration=1311ms 2026-10-09T13:25:12.765533-07:00 cache-3 haproxy[925]: 203.107.147.123:51564 [65160] http-in app/db-primary 50/0/383/383/50 200 87196 - - ---- 305/305/25/25/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:25:12.864160-07:00 bastion nginx[1209]: 192.89.111.39 - françois "POST /api/v2/users HTTP/1.1" 204 35022 "-" "python-requests/2.32.3" 2026-10-09T13:25:12.945270-07:00 db-replica haproxy[925]: 10.227.130.51:4751 [13397] http-in app/cache-3 7143/0/533/533/7143 200 25220 - - ---- 800/800/42/42/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:13.085200-07:00 edge-fr-1 nginx[1208]: 192.176.117.150 - - "GET /api/v2/orders HTTP/1.1" 302 45668 "-" "kube-probe/1.31" 2026-10-09T13:25:13.176539-07:00 worker-12 nginx[1209]: 203.69.205.213 - - "GET /api/v2/users HTTP/1.1" 200 20873 "-" "curl/8.4.0" 2026-10-09T13:25:13.246690-07:00 db-primary nginx[1200]: 172.202.230.166 - - "GET /favicon.ico HTTP/1.1" 301 61128 "-" "Go-http-client/1.1" 2026-10-09T13:25:13.558138-07:00 api-07 sshd[27989]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:25:13.713058-07:00 bastion sshd[38824]: Invalid user françois from 192.118.39.121 port 54254 2026-10-09T13:25:13.822495-07:00 api-08 app[30356]: INFO request_id=b2fec16884284413 method=GET path=/.env status=500 duration=1044ms 2026-10-09T13:25:13.839395-07:00 db-primary app[30166]: INFO worker 15 picked job 9013abbbd0556df3 from queue emails 2026-10-09T13:25:13.876558-07:00 api-07 sshd[46998]: Failed password for invalid user zoë from 91.100.38.90 port 52640 ssh2 2026-10-09T13:25:13.946251-07:00 db-replica sshd[51747]: Invalid user akira from 203.69.229.145 port 17167 2026-10-09T13:25:14.068091-07:00 api-08 app[30300]: INFO worker 33 picked job 39248002473743be from queue webhooks 2026-10-09T13:25:14.206440-07:00 cache-3 kernel: [75884.517592] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.117.23.183 DST=10.0.601.601 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=75884 DF PROTO=TCP SPT=41407 DPT=41407 WINDOW=75884 RES=0x00 SYN URGP=0 2026-10-09T13:25:14.282400-07:00 db-primary sshd[24948]: pam_unix(sshd:session): session opened for user priya(uid=2228) by (uid=0) 2026-10-09T13:25:14.425603-07:00 edge-fr-1 sshd[19028]: Failed password for invalid user müller from 192.164.186.233 port 32959 ssh2 2026-10-09T13:25:14.697225-07:00 api-08 systemd[1]: session-40304.scope: Deactivated successfully. 2026-10-09T13:25:14.798625-07:00 db-replica app[30042]: INFO request_id=2edf5e4068882e39 method=GET path=/api/v2/orders status=401 duration=1515ms 2026-10-09T13:25:14.853367-07:00 worker-12 app[30216]: INFO worker 90 picked job 99f704e22c28c114 from queue emails 2026-10-09T13:25:14.912613-07:00 web-01 app[30502]: INFO worker 93 finished job bb298786f172a4cb in 7651 ms 2026-10-09T13:25:14.925286-07:00 web-02 app[30522]: INFO worker 58 finished job 1c17afa83bfde1b1 in 7488 ms 2026-10-09T13:25:14.944657-07:00 api-07 sshd[3587]: pam_unix(sshd:session): session opened for user akira(uid=5547) by (uid=0) 2026-10-09T13:25:14.970103-07:00 web-01 app[30095]: INFO request_id=bb80851c11588a1e method=GET path=/admin status=302 duration=9123ms 2026-10-09T13:25:15.066420-07:00 web-02 app[30706]: INFO worker 12 finished job 1a4708420d1dadf9 in 6345 ms 2026-10-09T13:25:15.133549-07:00 web-02 app[30696]: ERROR cache miss storm: 9034 misses in 9524 ms, key prefix session:backup 2026-10-09T13:25:15.407155-07:00 web-03 app[30494]: INFO request_id=94b95c03bfda2b09 method=GET path=/wp-login.php status=500 duration=4853ms 2026-10-09T13:25:15.475253-07:00 worker-12 sshd[12674]: Received disconnect from 203.226.176.43 port 36344:11: Bye Bye [preauth] 2026-10-09T13:25:15.536755-07:00 web-02 sshd[51087]: Invalid user zoë from 10.6.72.250 port 25686 2026-10-09T13:25:15.689981-07:00 web-02 haproxy[945]: 192.19.138.112:42350 [51961] http-in app/db-replica 6014/0/317/317/6014 404 83884 - - ---- 471/471/32/32/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:25:15.989063-07:00 api-07 haproxy[912]: 203.243.31.62:17074 [41648] http-in app/db-primary 3072/0/696/696/3072 204 76361 - - ---- 945/945/12/12/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:25:16.132287-07:00 api-08 app[30094]: INFO request_id=57fd183b5d94eb74 method=GET path=/api/v2/search?q=invoice status=404 duration=5560ms 2026-10-09T13:25:16.216642-07:00 edge-fr-1 app[30885]: INFO health check ok: db 833 ms, cache 833 ms, queue depth 71 2026-10-09T13:25:16.574780-07:00 edge-fr-1 cron[15266]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:25:16.582328-07:00 edge-fr-1 nginx[1210]: 203.32.2.144 - - "GET /static/app.js HTTP/1.1" 200 83639 "-" "Go-http-client/1.1" 2026-10-09T13:25:16.741736-07:00 db-replica nginx[1207]: 192.237.219.100 - françois "POST /.env HTTP/1.1" 301 6389 "-" "kube-probe/1.31" 2026-10-09T13:25:16.875479-07:00 web-02 app[30136]: INFO health check ok: db 966 ms, cache 966 ms, queue depth 53 2026-10-09T13:25:17.018246-07:00 db-primary postgres[15684]: LOG: duration: 1345.608 ms statement: SELECT * FROM orders WHERE customer_id = 50302 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:17.313907-07:00 web-03 app[30374]: INFO health check ok: db 96 ms, cache 96 ms, queue depth 65 2026-10-09T13:25:17.361645-07:00 api-08 app[30615]: INFO worker 64 picked job 67d48fefe6692c23 from queue emails 2026-10-09T13:25:17.382516-07:00 web-01 haproxy[904]: 45.45.170.163:20691 [80458] http-in app/api-07 5234/0/671/671/5234 200 63536 - - ---- 519/519/22/22/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:17.394556-07:00 cache-3 nginx[1206]: 172.1.24.70 - françois "POST /wp-login.php HTTP/1.1" 200 21274 "-" "Go-http-client/1.1" 2026-10-09T13:25:17.458014-07:00 web-03 systemd[1]: Started Session 82499 of User root. 2026-10-09T13:25:17.513286-07:00 web-01 nginx[1210]: 91.57.163.103 - françois "POST /admin HTTP/1.1" 200 76568 "-" "kube-probe/1.31" 2026-10-09T13:25:17.589746-07:00 bastion haproxy[907]: 91.57.211.91:51184 [85362] http-in app/web-01 9709/0/973/973/9709 200 3044 - - ---- 918/918/24/24/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:25:17.763800-07:00 edge-fr-1 kernel: [69254.871739] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.64.27.41 DST=10.0.863.863 LEN=49 TOS=0x00 PREC=0x00 TTL=49 ID=69254 DF PROTO=TCP SPT=30155 DPT=30155 WINDOW=69254 RES=0x00 SYN URGP=0 2026-10-09T13:25:17.774411-07:00 web-01 sshd[63902]: Connection closed by 91.146.75.38 port 14503 [preauth] 2026-10-09T13:25:17.875297-07:00 bastion postgres[19568]: LOG: duration: 5729.876 ms statement: SELECT * FROM orders WHERE customer_id = 72515 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:17.913931-07:00 web-02 cron[15891]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:25:17.931419-07:00 api-08 nginx[1201]: 10.80.119.247 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 62531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:18.005480-07:00 edge-fr-1 haproxy[920]: 45.104.32.35:59412 [20979] http-in app/api-08 4124/0/909/909/4124 401 54914 - - ---- 453/453/39/39/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:18.099338-07:00 worker-12 nginx[1209]: 192.185.159.221 - ci "POST /wp-login.php HTTP/1.1" 200 82980 "-" "Go-http-client/1.1" 2026-10-09T13:25:18.194389-07:00 edge-fr-1 sshd[36248]: Received disconnect from 192.12.221.200 port 60665:11: Bye Bye [preauth] 2026-10-09T13:25:18.240706-07:00 edge-fr-1 app[30224]: INFO order 49531 confirmed for ci in 2118 ms (region ap-northeast-1, queue emails) 2026-10-09T13:25:18.266746-07:00 api-07 sshd[24870]: Accepted publickey for françois from 91.101.149.109 port 28268 ssh2: ED25519 SHA256:8d56942214a1f16a 2026-10-09T13:25:18.293467-07:00 worker-12 app[30040]: INFO request_id=9c0856552c201b5b method=GET path=/health status=200 duration=7328ms 2026-10-09T13:25:18.311550-07:00 api-08 app[30507]: INFO worker 31 finished job 8a0a7d1bd0643303 in 6794 ms 2026-10-09T13:25:18.396823-07:00 web-03 haproxy[925]: 45.162.230.175:13169 [43407] http-in app/bastion 8094/0/917/917/8094 401 38641 - - ---- 854/854/41/41/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:25:18.475722-07:00 cache-3 haproxy[926]: 172.73.24.95:4966 [52664] http-in app/bastion 7570/0/190/190/7570 204 89862 - - ---- 198/198/36/36/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:18.641166-07:00 cache-3 app[30417]: INFO worker 29 finished job 98027644059c9bf2 in 8282 ms 2026-10-09T13:25:18.649246-07:00 web-01 app[30741]: INFO request_id=cfb459d93f1d149e method=GET path=/login status=404 duration=5026ms 2026-10-09T13:25:18.714087-07:00 bastion kernel: [88485.407287] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.232.38.222 DST=10.0.930.930 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=88485 DF PROTO=TCP SPT=28417 DPT=28417 WINDOW=88485 RES=0x00 SYN URGP=0 2026-10-09T13:25:19.462837-07:00 web-01 haproxy[915]: 10.25.141.65:55547 [59841] http-in app/web-03 7119/0/86/86/7119 200 89204 - - ---- 983/983/74/74/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:19.486614-07:00 web-01 postgres[30765]: LOG: duration: 1788.697 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:19.514884-07:00 worker-12 nginx[1205]: 45.24.195.1 - deploy "POST /favicon.ico HTTP/1.1" 502 67058 "-" "curl/8.4.0" 2026-10-09T13:25:19.524890-07:00 web-03 sshd[60697]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:25:19.533800-07:00 db-replica nginx[1208]: 192.26.69.34 - - "GET /static/main.css HTTP/1.1" 500 89629 "-" "kube-probe/1.31" 2026-10-09T13:25:19.599103-07:00 api-07 app[30474]: INFO worker 68 picked job 1218fde26a43d3bd from queue webhooks 2026-10-09T13:25:19.665656-07:00 bastion app[30898]: INFO order 61700 confirmed for root in 3607 ms (region us-east-1, queue emails) 2026-10-09T13:25:19.720905-07:00 web-03 app[30391]: INFO order 82218 confirmed for müller in 4924 ms (region ap-northeast-1, queue orders) 2026-10-09T13:25:19.829416-07:00 web-01 sshd[44727]: Connection closed by 192.121.218.192 port 31516 [preauth] 2026-10-09T13:25:20.048009-07:00 web-01 nginx[1203]: 91.254.30.91 - zoë "POST /health HTTP/1.1" 401 443 "-" "kube-probe/1.31" 2026-10-09T13:25:20.234934-07:00 web-01 app[30824]: INFO worker 34 finished job 58eb8834f7c6d0b7 in 7746 ms 2026-10-09T13:25:20.279433-07:00 web-02 nginx[1208]: 172.117.109.193 - - "GET /login HTTP/1.1" 401 81775 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:20.365762-07:00 edge-fr-1 postgres[13601]: LOG: duration: 2277.361 ms statement: SELECT * FROM orders WHERE customer_id = 63733 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:20.407810-07:00 db-primary nginx[1209]: 10.168.67.106 - françois "POST /static/main.css HTTP/1.1" 404 89917 "-" "Go-http-client/1.1" 2026-10-09T13:25:20.596401-07:00 web-03 nginx[1202]: 45.117.225.194 - - "GET /admin HTTP/1.1" 200 47203 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:20.655095-07:00 web-01 app[30336]: INFO worker 27 picked job ac3b85fddc3c74dd from queue orders 2026-10-09T13:25:20.665729-07:00 api-07 sshd[49916]: Received disconnect from 203.91.80.181 port 28529:11: Bye Bye [preauth] 2026-10-09T13:25:20.717093-07:00 edge-fr-1 nginx[1204]: 192.98.152.159 - - "GET /static/app.js HTTP/1.1" 204 62575 "-" "python-requests/2.32.3" 2026-10-09T13:25:21.270696-07:00 worker-12 app[30288]: INFO request_id=963957fb7105412a method=GET path=/login status=200 duration=6229ms 2026-10-09T13:25:21.314182-07:00 db-primary nginx[1210]: 91.137.198.116 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 47785 "-" "curl/8.4.0" 2026-10-09T13:25:21.332085-07:00 db-replica app[30689]: INFO request_id=81f637a2a49500e1 method=GET path=/api/v2/orders/8841 status=404 duration=3493ms 2026-10-09T13:25:21.347704-07:00 web-02 nginx[1208]: 91.76.236.48 - - "GET /static/main.css HTTP/1.1" 302 76059 "-" "python-requests/2.32.3" 2026-10-09T13:25:21.372614-07:00 web-02 nginx[1206]: 45.191.76.242 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 5083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:21.681598-07:00 db-primary sshd[51182]: Connection closed by 45.240.20.149 port 64644 [preauth] 2026-10-09T13:25:21.840074-07:00 cache-3 sshd[29725]: Connection closed by 10.238.36.59 port 5961 [preauth] 2026-10-09T13:25:21.940155-07:00 api-07 nginx[1201]: 192.43.143.37 - - "GET /api/v2/users HTTP/1.1" 404 69964 "-" "kube-probe/1.31" 2026-10-09T13:25:22.046817-07:00 cache-3 nginx[1204]: 91.37.42.158 - - "GET /api/v2/orders HTTP/1.1" 204 23544 "-" "curl/8.4.0" 2026-10-09T13:25:22.184541-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577522.803:88371): pid=88371 uid=0 auid=7493 ses=995 msg='op=login id=7493 exe="/usr/sbin/sshd" hostname=? addr=172.189.155.189 terminal=/dev/pts/0 res=success' 2026-10-09T13:25:22.213753-07:00 web-02 app[30095]: INFO request_id=50f7630387f648da method=GET path=/health status=200 duration=7619ms 2026-10-09T13:25:22.220276-07:00 edge-fr-1 haproxy[909]: 10.38.68.57:38348 [77263] http-in app/edge-fr-1 8506/0/292/292/8506 200 80491 - - ---- 282/282/42/42/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:25:22.592484-07:00 db-primary app[30179]: INFO worker 31 finished job 4858b727f88d510c in 5215 ms 2026-10-09T13:25:22.763334-07:00 cache-3 app[30846]: INFO order 74370 confirmed for ci in 2325 ms (region eu-west-1, queue emails) 2026-10-09T13:25:22.769370-07:00 worker-12 haproxy[941]: 91.54.93.84:25572 [69524] http-in app/api-07 4086/0/980/980/4086 301 15176 - - ---- 745/745/84/84/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:22.802086-07:00 bastion nginx[1209]: 91.23.245.212 - zoë "POST /.env HTTP/1.1" 200 40481 "-" "Go-http-client/1.1" 2026-10-09T13:25:22.913244-07:00 db-replica sshd[23621]: Failed password for invalid user priya from 172.176.8.127 port 26567 ssh2 2026-10-09T13:25:22.939107-07:00 web-02 app[30451]: DEBUG cache hit ratio 67% over the last minute (70644 lookups) 2026-10-09T13:25:23.224028-07:00 db-replica nginx[1201]: 45.235.183.62 - - "GET /api/v2/orders HTTP/1.1" 301 46591 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:23.336218-07:00 api-08 nginx[1203]: 91.78.61.69 - - "GET /static/app.js HTTP/1.1" 404 30111 "-" "python-requests/2.32.3" 2026-10-09T13:25:23.347594-07:00 web-01 nginx[1203]: 203.76.143.57 - - "GET /api/v2/users HTTP/1.1" 301 51709 "-" "Go-http-client/1.1" 2026-10-09T13:25:23.358421-07:00 db-replica haproxy[939]: 203.60.209.11:39588 [77924] http-in app/db-primary 2691/0/355/355/2691 301 18342 - - ---- 893/893/39/39/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:23.462329-07:00 api-08 app[30361]: INFO request_id=ee20998405f4ef02 method=GET path=/.env status=401 duration=1890ms 2026-10-09T13:25:23.477514-07:00 bastion kernel: [57312.383405] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.26.7.104 DST=10.0.289.289 LEN=40 TOS=0x00 PREC=0x00 TTL=40 ID=57312 DF PROTO=TCP SPT=45975 DPT=45975 WINDOW=57312 RES=0x00 SYN URGP=0 2026-10-09T13:25:23.497163-07:00 cache-3 sshd[4134]: pam_unix(sshd:session): session opened for user priya(uid=1269) by (uid=0) 2026-10-09T13:25:23.498158-07:00 api-07 sshd[52685]: Accepted publickey for priya from 91.165.167.207 port 24997 ssh2: ED25519 SHA256:781ec39cc94808da 2026-10-09T13:25:23.523996-07:00 db-primary app[30834]: INFO request_id=ea23f3041a5203ac method=GET path=/static/main.css status=200 duration=6209ms 2026-10-09T13:25:23.726462-07:00 api-08 nginx[1203]: 91.167.72.43 - backup "POST /api/v2/search?q=invoice HTTP/1.1" 401 5816 "-" "python-requests/2.32.3" 2026-10-09T13:25:23.902361-07:00 web-02 nginx[1200]: 203.111.249.15 - - "GET /wp-login.php HTTP/1.1" 401 72146 "-" "Go-http-client/1.1" 2026-10-09T13:25:24.178918-07:00 web-02 sshd[58695]: Connection closed by 10.36.96.134 port 48189 [preauth] 2026-10-09T13:25:24.345148-07:00 db-replica postgres[8666]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 21180 remain, 1970 scanned (40% of total) 2026-10-09T13:25:24.590416-07:00 web-01 app[30926]: WARN slow query (6684 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '71 minutes' 2026-10-09T13:25:24.638526-07:00 web-02 app[30513]: INFO worker 40 picked job 739b4deeeed66abb from queue webhooks 2026-10-09T13:25:24.768154-07:00 bastion app[30335]: INFO worker 88 finished job 94635ad65b132364 in 2516 ms 2026-10-09T13:25:24.906612-07:00 cache-3 app[30796]: INFO request_id=2bc731c71e85ea3b method=GET path=/api/v2/users status=302 duration=4835ms 2026-10-09T13:25:24.954379-07:00 web-03 app[30067]: INFO request_id=e2793d5e32f80d49 method=GET path=/login status=204 duration=1834ms 2026-10-09T13:25:25.034191-07:00 web-03 nginx[1210]: 45.51.199.107 - - "GET /health HTTP/1.1" 404 14584 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:25.386803-07:00 api-08 app[30473]: INFO worker 39 finished job d6657535e9fa5a7f in 3937 ms 2026-10-09T13:25:25.495375-07:00 db-primary nginx[1208]: 203.181.34.114 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 44134 "-" "curl/8.4.0" 2026-10-09T13:25:25.521257-07:00 db-replica sshd[11664]: Accepted publickey for akira from 10.166.152.251 port 20751 ssh2: ED25519 SHA256:b331570a4391a983 2026-10-09T13:25:25.630849-07:00 cache-3 sshd[31767]: Failed password for invalid user priya from 203.12.252.50 port 44614 ssh2 2026-10-09T13:25:25.751077-07:00 web-02 nginx[1205]: 172.212.67.65 - - "GET /static/main.css HTTP/1.1" 200 22705 "-" "python-requests/2.32.3" 2026-10-09T13:25:25.974373-07:00 api-07 app[30316]: INFO worker 52 picked job 7e81e9830d5b7f38 from queue invoices 2026-10-09T13:25:26.109468-07:00 cache-3 sshd[55896]: Received disconnect from 45.45.3.137 port 41091:11: Bye Bye [preauth] 2026-10-09T13:25:26.158912-07:00 edge-fr-1 nginx[1202]: 91.82.106.125 - - "GET /.env HTTP/1.1" 200 31716 "-" "curl/8.4.0" 2026-10-09T13:25:26.169773-07:00 cache-3 nginx[1202]: 10.63.83.130 - - "GET /favicon.ico HTTP/1.1" 200 27828 "-" "curl/8.4.0" 2026-10-09T13:25:26.210405-07:00 api-07 nginx[1210]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.232.64.190, server: app.example.com, request: "GET /static/app.js HTTP/1.1", upstream: "http://10.0.500.500:8080/static/app.js" 2026-10-09T13:25:26.598854-07:00 api-07 nginx[1201]: 203.69.150.131 - priya "POST /.env HTTP/1.1" 200 40294 "-" "Go-http-client/1.1" 2026-10-09T13:25:26.733263-07:00 web-01 app[30764]: INFO request_id=6c785c396f1b45a5 method=GET path=/metrics status=200 duration=9315ms 2026-10-09T13:25:26.767861-07:00 edge-fr-1 sshd[58381]: Connection closed by 45.185.96.244 port 7032 [preauth] 2026-10-09T13:25:26.825748-07:00 web-02 nginx[1205]: 203.166.65.132 - - "GET /api/v2/users HTTP/1.1" 200 49799 "-" "kube-probe/1.31" 2026-10-09T13:25:26.837951-07:00 worker-12 app[30496]: INFO worker 32 picked job 59bd7c8e51704063 from queue webhooks 2026-10-09T13:25:27.122556-07:00 edge-fr-1 nginx[1200]: 203.136.23.219 - - "GET /api/v2/orders HTTP/1.1" 302 57559 "-" "curl/8.4.0" 2026-10-09T13:25:27.137060-07:00 web-01 app[30100]: INFO worker 12 picked job b513d74b1c91bdc8 from queue orders 2026-10-09T13:25:27.200963-07:00 edge-fr-1 sshd[29568]: Failed password for invalid user akira from 45.198.140.137 port 63771 ssh2 2026-10-09T13:25:27.486807-07:00 api-07 cron[57920]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:25:27.729696-07:00 web-01 app[30398]: INFO worker 72 picked job df48b38b2af4b282 from queue webhooks 2026-10-09T13:25:27.867615-07:00 edge-fr-1 nginx[1208]: 172.10.250.184 - - "GET /.env HTTP/1.1" 302 54934 "-" "Go-http-client/1.1" 2026-10-09T13:25:27.966772-07:00 api-08 app[30749]: INFO worker 20 finished job fbd655528e026fb7 in 5513 ms 2026-10-09T13:25:28.020060-07:00 api-07 sshd[32383]: pam_unix(sshd:session): session opened for user zoë(uid=7445) by (uid=0) 2026-10-09T13:25:28.048203-07:00 api-08 app[30656]: INFO worker 50 picked job a64f24d086c5ef73 from queue orders 2026-10-09T13:25:28.085513-07:00 web-01 nginx[1202]: 192.193.138.199 - root "POST /wp-login.php HTTP/1.1" 200 70417 "-" "kube-probe/1.31" 2026-10-09T13:25:28.268185-07:00 cache-3 app[30868]: INFO worker 13 picked job 3366698f6e10dbb3 from queue orders 2026-10-09T13:25:28.331577-07:00 web-02 app[30260]: INFO request_id=008d8a74fe7c5e24 method=GET path=/.env status=500 duration=5821ms 2026-10-09T13:25:28.372599-07:00 edge-fr-1 app[30806]: INFO worker 91 finished job 66ff8bfe88287fb0 in 6257 ms 2026-10-09T13:25:28.508480-07:00 web-03 app[30855]: INFO request_id=de2bd6a9da92cd77 method=GET path=/health status=404 duration=3476ms 2026-10-09T13:25:28.525159-07:00 edge-fr-1 postgres[23405]: LOG: duration: 2979.870 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:28.632843-07:00 cache-3 sshd[24728]: Accepted publickey for müller from 192.151.70.87 port 52063 ssh2: ED25519 SHA256:920f47e8dd65f8ab 2026-10-09T13:25:28.687173-07:00 edge-fr-1 nginx[1201]: 45.124.234.242 - - "GET /health HTTP/1.1" 502 64959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:28.709731-07:00 web-01 sshd[12657]: Invalid user root from 192.25.183.101 port 14762 2026-10-09T13:25:28.977951-07:00 web-01 sshd[17669]: Invalid user müller from 192.34.120.106 port 4806 2026-10-09T13:25:28.990198-07:00 api-07 cron[22886]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:25:29.054008-07:00 db-replica app[30412]: INFO order 80254 confirmed for akira in 7705 ms (region eu-west-1, queue emails) 2026-10-09T13:25:29.057648-07:00 worker-12 sshd[12565]: Invalid user priya from 203.205.209.152 port 1372 2026-10-09T13:25:29.178274-07:00 worker-12 sshd[2683]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:25:29.242238-07:00 bastion app[30750]: INFO worker 19 finished job c60a9f9bccf94d4b in 4354 ms 2026-10-09T13:25:29.334843-07:00 db-primary haproxy[918]: 10.153.93.56:2537 [49502] http-in app/db-replica 3066/0/245/245/3066 200 20452 - - ---- 928/928/36/36/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:25:29.396858-07:00 web-03 app[30448]: ERROR payment declined for order 92180: card_declined (code 95), customer notified 2026-10-09T13:25:29.500646-07:00 bastion nginx[1208]: 91.79.16.221 - - "GET /.env HTTP/1.1" 404 53673 "-" "curl/8.4.0" 2026-10-09T13:25:29.655850-07:00 api-07 haproxy[917]: 10.27.211.167:21059 [71261] http-in app/db-primary 7002/0/535/535/7002 404 8080 - - ---- 458/458/12/12/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:25:29.844291-07:00 api-07 haproxy[907]: 91.182.235.151:6418 [59517] http-in app/worker-12 1439/0/885/885/1439 500 83642 - - ---- 414/414/41/41/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:25:30.048797-07:00 api-08 app[30975]: INFO request_id=e0a78838e7c8f94d method=GET path=/.env status=200 duration=4615ms 2026-10-09T13:25:30.134313-07:00 api-08 nginx[1201]: 45.42.185.153 - - "GET /admin HTTP/1.1" 301 13356 "-" "curl/8.4.0" 2026-10-09T13:25:30.201885-07:00 worker-12 app[30856]: WARN retrying upstream 45.212.162.19:16980 after timeout (2611 ms), attempt 3 of 3 2026-10-09T13:25:30.211193-07:00 cache-3 app[30701]: INFO health check ok: db 137 ms, cache 137 ms, queue depth 41 2026-10-09T13:25:30.582224-07:00 worker-12 nginx[1202]: 45.41.0.180 - - "GET /api/v2/users HTTP/1.1" 502 8058 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:30.623188-07:00 api-08 kernel: [89346.654014] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.238.10.205 DST=10.0.156.156 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=89346 DF PROTO=TCP SPT=7638 DPT=7638 WINDOW=89346 RES=0x00 SYN URGP=0 2026-10-09T13:25:30.760852-07:00 edge-fr-1 cron[43306]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:25:30.858972-07:00 db-primary haproxy[916]: 10.211.25.169:48870 [53447] http-in app/web-01 5142/0/378/378/5142 200 72583 - - ---- 588/588/88/88/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:25:31.062686-07:00 bastion app[30210]: INFO worker 91 picked job fc8b6fe8f692ef94 from queue invoices 2026-10-09T13:25:31.069148-07:00 bastion app[30637]: INFO order 64284 confirmed for françois in 6926 ms (region us-east-1, queue orders) 2026-10-09T13:25:31.210421-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577531.866:21807): pid=21807 uid=0 auid=2020 ses=552 msg='op=login id=2020 exe="/usr/sbin/sshd" hostname=? addr=10.250.88.133 terminal=/dev/pts/0 res=success' 2026-10-09T13:25:31.361799-07:00 web-02 kernel: [89486.795516] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.189.167.157 DST=10.0.762.762 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=89486 DF PROTO=TCP SPT=29082 DPT=29082 WINDOW=89486 RES=0x00 SYN URGP=0 2026-10-09T13:25:31.384220-07:00 edge-fr-1 haproxy[934]: 192.213.106.217:45491 [12959] http-in app/cache-3 3176/0/93/93/3176 301 36900 - - ---- 313/313/48/48/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:31.647873-07:00 web-02 dockerd[700]: time="2026-10-09T13:25:31.647873-07:00" level=info msg="Container ca671e4bc9b1ede5 exited with code 0" 2026-10-09T13:25:31.705496-07:00 web-03 app[30847]: INFO worker 28 picked job ef246f58927cb077 from queue webhooks 2026-10-09T13:25:31.812987-07:00 db-primary systemd[1]: Started Session 52166 of User zoë. 2026-10-09T13:25:31.817201-07:00 db-replica nginx[1210]: 10.175.48.189 - backup "POST /admin HTTP/1.1" 200 15665 "-" "python-requests/2.32.3" 2026-10-09T13:25:31.958208-07:00 web-02 haproxy[932]: 172.88.71.202:31660 [35584] http-in app/web-02 1089/0/40/40/1089 502 51805 - - ---- 431/431/54/54/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:25:32.035016-07:00 worker-12 nginx[1201]: 10.204.161.68 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 51082 "-" "Go-http-client/1.1" 2026-10-09T13:25:32.154516-07:00 bastion app[30463]: INFO request_id=e94592e5f797e529 method=GET path=/health status=302 duration=9204ms 2026-10-09T13:25:32.415519-07:00 db-primary app[30882]: INFO request_id=eaef9ccc3c990637 method=GET path=/static/main.css status=404 duration=776ms 2026-10-09T13:25:32.513756-07:00 api-07 nginx[1209]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.47.211.87, server: app.example.com, request: "GET /.env HTTP/1.1", upstream: "http://10.0.337.337:8080/.env" 2026-10-09T13:25:32.816511-07:00 worker-12 nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.152.106.153, server: app.example.com, request: "GET /admin HTTP/1.1", upstream: "http://10.0.778.778:8080/admin" 2026-10-09T13:25:32.825110-07:00 api-07 app[30453]: INFO request_id=95256e722b698f02 method=GET path=/health status=200 duration=9958ms 2026-10-09T13:25:32.909433-07:00 bastion app[30262]: INFO worker 88 finished job f617090c31f9336b in 9622 ms 2026-10-09T13:25:33.016656-07:00 db-primary app[30674]: INFO worker 21 picked job 0091a092c856b1c9 from queue webhooks 2026-10-09T13:25:33.073477-07:00 db-primary app[30281]: INFO worker 46 finished job cc0cf3fe79ba744f in 1325 ms 2026-10-09T13:25:33.078685-07:00 cache-3 nginx[1203]: 203.203.40.80 - ci "POST /api/v2/orders/8841 HTTP/1.1" 200 25668 "-" "curl/8.4.0" 2026-10-09T13:25:33.108698-07:00 api-08 app[30289]: DEBUG cache hit ratio 77% over the last minute (73706 lookups) 2026-10-09T13:25:33.180251-07:00 web-03 sshd[52462]: Invalid user root from 172.201.217.237 port 63150 2026-10-09T13:25:33.224194-07:00 bastion app[30685]: INFO request_id=fe5925f6f82da92f method=GET path=/wp-login.php status=401 duration=4623ms 2026-10-09T13:25:33.463922-07:00 web-02 kernel: [40954.969048] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.164.37.108 DST=10.0.102.102 LEN=54 TOS=0x00 PREC=0x00 TTL=54 ID=40954 DF PROTO=TCP SPT=15698 DPT=15698 WINDOW=40954 RES=0x00 SYN URGP=0 2026-10-09T13:25:33.840834-07:00 edge-fr-1 nginx[1207]: 203.207.60.217 - - "GET /.env HTTP/1.1" 204 65002 "-" "kube-probe/1.31" 2026-10-09T13:25:33.955398-07:00 cache-3 sshd[23540]: Connection closed by 91.30.24.240 port 4071 [preauth] 2026-10-09T13:25:34.162681-07:00 web-02 kernel: [45543.133882] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.102.21.113 DST=10.0.437.437 LEN=53 TOS=0x00 PREC=0x00 TTL=53 ID=45543 DF PROTO=TCP SPT=39947 DPT=39947 WINDOW=45543 RES=0x00 SYN URGP=0 2026-10-09T13:25:34.192660-07:00 api-07 app[30572]: INFO request_id=ce5d850a81b18d6d method=GET path=/.env status=302 duration=3675ms 2026-10-09T13:25:34.295651-07:00 web-03 nginx[1200]: 45.239.197.206 - - "GET /login HTTP/1.1" 401 27117 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:34.501492-07:00 api-07 systemd[1]: session-62777.scope: Deactivated successfully. 2026-10-09T13:25:34.577008-07:00 api-08 nginx[1206]: 203.125.114.206 - müller "POST /favicon.ico HTTP/1.1" 302 36661 "-" "curl/8.4.0" 2026-10-09T13:25:34.590162-07:00 db-replica app[30104]: INFO request_id=094f8b88be3badf5 method=GET path=/favicon.ico status=302 duration=5259ms 2026-10-09T13:25:34.641865-07:00 api-07 sshd[40676]: Invalid user sørensen from 45.211.216.97 port 24981 2026-10-09T13:25:34.702524-07:00 cache-3 nginx[1201]: 45.253.154.19 - akira "POST /api/v2/orders HTTP/1.1" 200 42176 "-" "python-requests/2.32.3" 2026-10-09T13:25:34.708143-07:00 edge-fr-1 sshd[25519]: Invalid user akira from 91.196.85.32 port 50357 2026-10-09T13:25:34.716231-07:00 web-03 sshd[47057]: Failed password for invalid user akira from 91.36.34.188 port 12003 ssh2 2026-10-09T13:25:35.098534-07:00 db-primary haproxy[905]: 45.71.189.81:6876 [57860] http-in app/web-01 887/0/397/397/887 502 11119 - - ---- 247/247/88/88/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:25:35.420166-07:00 worker-12 nginx[1201]: 192.243.0.129 - deploy "POST /api/v2/users HTTP/1.1" 404 19107 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:35.921409-07:00 api-08 app[30339]: INFO health check ok: db 766 ms, cache 766 ms, queue depth 16 2026-10-09T13:25:35.958126-07:00 worker-12 app[30992]: INFO worker 26 picked job 559ce639ee5fddb4 from queue webhooks 2026-10-09T13:25:36.323818-07:00 cache-3 app[30713]: INFO worker 37 finished job 59c2ab4f631e0b9d in 3340 ms 2026-10-09T13:25:36.349987-07:00 bastion sshd[4103]: Connection closed by 203.50.126.25 port 17602 [preauth] 2026-10-09T13:25:36.512643-07:00 web-02 app[30627]: DEBUG cache hit ratio 46% over the last minute (41952 lookups) 2026-10-09T13:25:36.927709-07:00 db-replica postgres[19658]: LOG: duration: 7918.10 ms statement: SELECT * FROM orders WHERE customer_id = 93144 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:36.933036-07:00 web-01 nginx[1206]: 172.200.171.194 - - "GET /static/app.js HTTP/1.1" 404 75904 "-" "curl/8.4.0" 2026-10-09T13:25:37.183216-07:00 bastion haproxy[917]: 45.194.247.42:28743 [76318] http-in app/api-07 6535/0/968/968/6535 301 71723 - - ---- 201/201/30/30/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:37.186818-07:00 cache-3 postgres[29884]: LOG: duration: 632.318 ms statement: SELECT * FROM orders WHERE customer_id = 32137 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:37.312825-07:00 db-replica nginx[1206]: 192.194.228.56 - - "GET /static/main.css HTTP/1.1" 500 34800 "-" "curl/8.4.0" 2026-10-09T13:25:37.337328-07:00 edge-fr-1 nginx[1209]: 45.137.153.127 - - "GET /admin HTTP/1.1" 502 61397 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:37.346341-07:00 bastion haproxy[922]: 192.181.70.238:8497 [28628] http-in app/api-08 199/0/443/443/199 302 69320 - - ---- 375/375/84/84/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:25:37.386943-07:00 web-02 nginx[1209]: 203.64.10.189 - françois "POST /health HTTP/1.1" 302 18858 "-" "curl/8.4.0" 2026-10-09T13:25:37.489811-07:00 web-01 nginx[1209]: 192.145.236.47 - - "GET /api/v2/users HTTP/1.1" 500 47533 "-" "kube-probe/1.31" 2026-10-09T13:25:37.683823-07:00 web-01 postgres[4745]: LOG: duration: 5864.414 ms statement: SELECT * FROM orders WHERE customer_id = 65891 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:37.767964-07:00 bastion systemd[1]: Started Session 37499 of User backup. 2026-10-09T13:25:38.047483-07:00 api-08 nginx[1210]: 10.148.117.89 - françois "POST /metrics HTTP/1.1" 200 79867 "-" "Go-http-client/1.1" 2026-10-09T13:25:38.285616-07:00 edge-fr-1 app[30632]: INFO request_id=68f089ef684f5241 method=GET path=/metrics status=200 duration=87ms 2026-10-09T13:25:38.285856-07:00 cache-3 app[30144]: INFO order 32089 confirmed for root in 4490 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:25:38.455390-07:00 cache-3 audit: type=USER_LOGIN msg=audit(1791577538.839:96729): pid=96729 uid=0 auid=4237 ses=493 msg='op=login id=4237 exe="/usr/sbin/sshd" hostname=? addr=172.41.174.154 terminal=/dev/pts/0 res=success' 2026-10-09T13:25:38.582552-07:00 edge-fr-1 nginx[1205]: 172.119.10.245 - - "GET /health HTTP/1.1" 200 20676 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:38.947369-07:00 web-03 nginx[1206]: 45.23.192.120 - - "GET /static/main.css HTTP/1.1" 204 40730 "-" "kube-probe/1.31" 2026-10-09T13:25:38.972641-07:00 bastion app[30768]: INFO request_id=af7fa0eb944deefd method=GET path=/health status=500 duration=3954ms 2026-10-09T13:25:39.008741-07:00 api-07 postgres[25097]: LOG: duration: 4386.962 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:39.015030-07:00 worker-12 nginx[1203]: 172.125.247.216 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 38984 "-" "python-requests/2.32.3" 2026-10-09T13:25:39.125535-07:00 web-02 nginx[1210]: 91.202.38.104 - - "GET /favicon.ico HTTP/1.1" 401 79096 "-" "Go-http-client/1.1" 2026-10-09T13:25:39.128228-07:00 web-02 nginx[1210]: 172.137.3.47 - - "GET /wp-login.php HTTP/1.1" 404 18293 "-" "python-requests/2.32.3" 2026-10-09T13:25:39.162123-07:00 cache-3 app[30965]: INFO order 27400 confirmed for root in 4752 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:25:39.217755-07:00 edge-fr-1 postgres[25985]: LOG: duration: 5493.759 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:39.254629-07:00 api-07 nginx[1200]: 203.25.20.43 - - "GET /api/v2/users HTTP/1.1" 302 24329 "-" "python-requests/2.32.3" 2026-10-09T13:25:39.402515-07:00 web-02 app[30152]: INFO request_id=6480cad57908c080 method=GET path=/favicon.ico status=200 duration=6651ms 2026-10-09T13:25:39.588392-07:00 bastion haproxy[904]: 10.245.66.25:51351 [38000] http-in app/api-08 8358/0/59/59/8358 404 40453 - - ---- 678/678/62/62/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:39.774867-07:00 api-08 app[30917]: INFO order 61430 confirmed for priya in 6466 ms (region us-east-1, queue invoices) 2026-10-09T13:25:40.110756-07:00 db-primary sshd[17140]: Accepted publickey for françois from 192.71.39.210 port 43196 ssh2: ED25519 SHA256:6f47843042070b07 2026-10-09T13:25:40.220133-07:00 web-02 app[30331]: INFO request_id=bfc889c3de7e7adc method=GET path=/api/v2/orders status=204 duration=7502ms 2026-10-09T13:25:40.375348-07:00 bastion sshd[16282]: Connection closed by 203.23.41.126 port 33776 [preauth] 2026-10-09T13:25:40.628353-07:00 cache-3 sshd[40895]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:25:40.762813-07:00 web-01 app[30623]: INFO worker 59 picked job cd6755b8394ad12b from queue invoices 2026-10-09T13:25:40.922892-07:00 edge-fr-1 nginx[1208]: 203.133.197.134 - - "GET /static/main.css HTTP/1.1" 301 14864 "-" "python-requests/2.32.3" 2026-10-09T13:25:41.009895-07:00 db-primary app[30803]: INFO worker 11 picked job 83365612c838c8da from queue emails 2026-10-09T13:25:41.151229-07:00 cache-3 haproxy[943]: 172.89.243.17:62719 [16313] http-in app/cache-3 3810/0/102/102/3810 404 4190 - - ---- 679/679/63/63/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:25:41.274530-07:00 web-02 haproxy[909]: 10.77.219.177:20370 [75158] http-in app/bastion 9984/0/608/608/9984 500 79746 - - ---- 531/531/79/79/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:25:41.367453-07:00 web-03 sshd[31821]: Received disconnect from 45.218.251.11 port 21514:11: Bye Bye [preauth] 2026-10-09T13:25:41.459682-07:00 worker-12 nginx[1203]: 172.159.4.176 - - "GET /metrics HTTP/1.1" 500 25094 "-" "Go-http-client/1.1" 2026-10-09T13:25:41.560679-07:00 bastion app[30623]: INFO worker 86 finished job eefc8e3b9275cbf2 in 8340 ms 2026-10-09T13:25:41.625958-07:00 edge-fr-1 app[30986]: INFO request_id=fbff7140a0877e55 method=GET path=/admin status=200 duration=5516ms 2026-10-09T13:25:41.648390-07:00 api-08 app[30556]: INFO order 37433 confirmed for root in 4454 ms (region eu-west-1, queue emails) 2026-10-09T13:25:41.681113-07:00 bastion systemd[1]: session-28609.scope: Deactivated successfully. 2026-10-09T13:25:41.756314-07:00 api-08 app[30194]: INFO request_id=a53d8f1aea273600 method=GET path=/api/v2/orders/8841 status=301 duration=5949ms 2026-10-09T13:25:41.938223-07:00 db-replica app[30858]: DEBUG cache hit ratio 86% over the last minute (37483 lookups) 2026-10-09T13:25:41.951132-07:00 web-01 app[30378]: INFO worker 33 picked job 69b2db9e8646a530 from queue webhooks 2026-10-09T13:25:42.040430-07:00 web-01 systemd[1]: Started Session 72914 of User backup. 2026-10-09T13:25:42.299616-07:00 edge-fr-1 sshd[51083]: Failed password for invalid user müller from 91.36.192.131 port 25445 ssh2 2026-10-09T13:25:42.444895-07:00 db-primary nginx[1205]: 192.141.239.159 - - "GET /.env HTTP/1.1" 200 66919 "-" "kube-probe/1.31" 2026-10-09T13:25:42.453065-07:00 cache-3 sshd[33258]: Accepted publickey for ci from 192.188.193.223 port 50646 ssh2: ED25519 SHA256:eea08fb41e3b0756 2026-10-09T13:25:42.459016-07:00 web-03 app[30692]: INFO request_id=f4095d87e2f64abc method=GET path=/api/v2/search?q=invoice status=301 duration=2772ms 2026-10-09T13:25:42.495105-07:00 bastion haproxy[917]: 192.4.166.201:4065 [37124] http-in app/web-01 3489/0/953/953/3489 404 56737 - - ---- 325/325/54/54/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:25:42.590779-07:00 edge-fr-1 nginx[1201]: 203.142.225.25 - - "GET /api/v2/users HTTP/1.1" 200 36753 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:42.595045-07:00 bastion nginx[1201]: 10.220.120.223 - - "GET /api/v2/users HTTP/1.1" 500 36737 "-" "kube-probe/1.31" 2026-10-09T13:25:42.608183-07:00 worker-12 postgres[29642]: LOG: duration: 8822.529 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:42.619280-07:00 web-02 sshd[16919]: Failed password for invalid user ci from 10.104.154.90 port 59591 ssh2 2026-10-09T13:25:42.729740-07:00 worker-12 sshd[12848]: Failed password for invalid user deploy from 192.52.237.129 port 56828 ssh2 2026-10-09T13:25:42.770372-07:00 api-08 sshd[37414]: Invalid user müller from 10.243.194.217 port 9116 2026-10-09T13:25:42.955751-07:00 web-03 sshd[18001]: pam_unix(sshd:session): session opened for user zoë(uid=3116) by (uid=0) 2026-10-09T13:25:43.049344-07:00 edge-fr-1 nginx[1208]: 91.158.188.140 - - "GET /api/v2/users HTTP/1.1" 200 47691 "-" "Go-http-client/1.1" 2026-10-09T13:25:43.079763-07:00 worker-12 app[30380]: INFO worker 62 finished job b75b087afeadd324 in 9265 ms 2026-10-09T13:25:43.139860-07:00 web-01 app[30352]: INFO order 72528 confirmed for müller in 6613 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:25:43.211421-07:00 db-primary kernel: [27941.913877] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.234.191.239 DST=10.0.326.326 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=27941 DF PROTO=TCP SPT=30812 DPT=30812 WINDOW=27941 RES=0x00 SYN URGP=0 2026-10-09T13:25:43.332655-07:00 db-primary app[30489]: INFO worker 88 picked job 88a8ee8cc15f839b from queue emails 2026-10-09T13:25:43.674885-07:00 web-03 app[30301]: INFO worker 59 finished job a11d4a30024c67f4 in 3728 ms 2026-10-09T13:25:43.702082-07:00 db-primary app[30805]: INFO order 62248 confirmed for root in 5422 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:25:43.933411-07:00 web-03 haproxy[942]: 203.74.127.165:55377 [26185] http-in app/api-08 2665/0/987/987/2665 200 13825 - - ---- 257/257/74/74/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:25:44.020497-07:00 worker-12 postgres[28388]: LOG: duration: 3367.206 ms statement: SELECT * FROM orders WHERE customer_id = 59796 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:44.117359-07:00 web-01 app[30003]: INFO worker 27 finished job a5c1e58b94b6fcea in 8055 ms 2026-10-09T13:25:44.274123-07:00 db-replica sshd[28614]: Failed password for invalid user root from 45.62.174.61 port 54565 ssh2 2026-10-09T13:25:44.303417-07:00 web-01 systemd[1]: Started Session 20815 of User backup. 2026-10-09T13:25:44.460518-07:00 edge-fr-1 nginx[1205]: 192.14.227.35 - - "GET /api/v2/orders HTTP/1.1" 200 29899 "-" "kube-probe/1.31" 2026-10-09T13:25:44.542121-07:00 api-07 postgres[2383]: LOG: duration: 1538.779 ms statement: SELECT * FROM orders WHERE customer_id = 57324 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:44.889757-07:00 web-01 app[30778]: INFO worker 79 picked job aebc869f7f20bc8a from queue invoices 2026-10-09T13:25:44.994177-07:00 db-primary sshd[58427]: Accepted publickey for deploy from 45.102.237.172 port 56434 ssh2: ED25519 SHA256:5cd4ec631d60d407 2026-10-09T13:25:45.171834-07:00 db-replica haproxy[903]: 172.76.214.145:14376 [10805] http-in app/api-07 6237/0/399/399/6237 500 47124 - - ---- 470/470/14/14/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:45.596691-07:00 web-03 app[30940]: INFO worker 12 picked job 62b81fa410578b80 from queue orders 2026-10-09T13:25:45.713976-07:00 api-08 kubelet[800]: I1009 13:25:45.825247 2853 kubelet.go:2853] "Pod is terminating, skipping pod status update" pod="default/api-3c72d5455d9225cb" 2026-10-09T13:25:45.739160-07:00 api-07 nginx[1200]: 172.7.228.114 - - "GET /api/v2/users HTTP/1.1" 200 58786 "-" "kube-probe/1.31" 2026-10-09T13:25:45.819724-07:00 bastion sshd[30636]: Failed password for invalid user müller from 10.188.219.106 port 36015 ssh2 2026-10-09T13:25:45.837897-07:00 db-primary sshd[56159]: Connection closed by 203.150.83.166 port 62019 [preauth] 2026-10-09T13:25:45.856003-07:00 web-03 app[30879]: INFO request_id=089ee9839c5dae3a method=GET path=/metrics status=200 duration=2926ms 2026-10-09T13:25:45.958008-07:00 web-03 app[30189]: DEBUG cache hit ratio 24% over the last minute (85290 lookups) 2026-10-09T13:25:45.977243-07:00 cache-3 cron[45548]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:25:46.170577-07:00 api-08 sshd[38715]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:25:46.253186-07:00 api-07 app[30527]: INFO health check ok: db 171 ms, cache 171 ms, queue depth 30 2026-10-09T13:25:46.572710-07:00 web-03 app[30334]: INFO worker 14 finished job 8fabc1252acc71d8 in 9244 ms 2026-10-09T13:25:46.636247-07:00 web-01 nginx[1209]: 91.44.72.152 - - "GET /health HTTP/1.1" 401 87086 "-" "python-requests/2.32.3" 2026-10-09T13:25:46.750610-07:00 cache-3 postgres[7393]: LOG: duration: 6180.64 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:46.766989-07:00 api-07 kernel: [69205.258165] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.49.252.198 DST=10.0.784.784 LEN=82 TOS=0x00 PREC=0x00 TTL=82 ID=69205 DF PROTO=TCP SPT=16023 DPT=16023 WINDOW=69205 RES=0x00 SYN URGP=0 2026-10-09T13:25:46.810719-07:00 web-03 haproxy[908]: 91.41.74.186:49907 [90621] http-in app/db-primary 4226/0/176/176/4226 500 87520 - - ---- 647/647/52/52/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:25:47.067272-07:00 worker-12 app[30144]: INFO order 37998 confirmed for ci in 6986 ms (region eu-west-1, queue invoices) 2026-10-09T13:25:47.068654-07:00 web-01 app[30794]: INFO worker 88 picked job 87e03bccc9c1426c from queue webhooks 2026-10-09T13:25:47.229565-07:00 bastion kernel: [30729.726143] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.152.202.85 DST=10.0.857.857 LEN=34 TOS=0x00 PREC=0x00 TTL=34 ID=30729 DF PROTO=TCP SPT=26347 DPT=26347 WINDOW=30729 RES=0x00 SYN URGP=0 2026-10-09T13:25:47.247823-07:00 web-01 nginx[1206]: 91.120.109.38 - - "GET /health HTTP/1.1" 302 70316 "-" "Go-http-client/1.1" 2026-10-09T13:25:47.254180-07:00 worker-12 app[30030]: INFO worker 59 picked job 1ba5ff229b178046 from queue invoices 2026-10-09T13:25:47.425865-07:00 db-primary nginx[1205]: 91.37.112.59 - - "GET /favicon.ico HTTP/1.1" 200 69197 "-" "python-requests/2.32.3" 2026-10-09T13:25:47.603861-07:00 bastion app[30816]: INFO health check ok: db 707 ms, cache 707 ms, queue depth 55 2026-10-09T13:25:47.667155-07:00 web-03 sshd[35325]: pam_unix(sshd:session): session opened for user françois(uid=9406) by (uid=0) 2026-10-09T13:25:47.681208-07:00 db-replica app[30821]: INFO worker 58 finished job 7430c8d5b9533901 in 3950 ms 2026-10-09T13:25:47.733564-07:00 api-08 app[30602]: DEBUG cache hit ratio 1% over the last minute (29941 lookups) 2026-10-09T13:25:47.765894-07:00 api-08 kernel: [81911.906520] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.7.220.215 DST=10.0.330.330 LEN=19 TOS=0x00 PREC=0x00 TTL=19 ID=81911 DF PROTO=TCP SPT=64922 DPT=64922 WINDOW=81911 RES=0x00 SYN URGP=0 2026-10-09T13:25:47.805470-07:00 worker-12 nginx[1208]: 203.196.101.170 - - "GET /api/v2/orders HTTP/1.1" 200 72695 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:48.353448-07:00 db-primary sshd[27340]: Connection closed by 192.203.112.35 port 28640 [preauth] 2026-10-09T13:25:48.371818-07:00 web-03 sshd[54697]: Invalid user backup from 10.34.211.232 port 58678 2026-10-09T13:25:48.509095-07:00 bastion app[30193]: INFO request_id=4051d21b0f2559c9 method=GET path=/metrics status=200 duration=6762ms 2026-10-09T13:25:49.024652-07:00 cache-3 nginx[1201]: 192.161.12.220 - sørensen "POST /admin HTTP/1.1" 401 49828 "-" "kube-probe/1.31" 2026-10-09T13:25:49.065219-07:00 api-07 nginx[1201]: 203.237.25.184 - - "GET /admin HTTP/1.1" 200 88401 "-" "curl/8.4.0" 2026-10-09T13:25:49.203747-07:00 db-primary nginx[1202]: 10.241.227.117 - - "GET /.env HTTP/1.1" 200 52089 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:49.657101-07:00 web-01 app[30982]: INFO request_id=f595a61ed0f888fb method=GET path=/api/v2/orders/8841 status=200 duration=7012ms 2026-10-09T13:25:49.668532-07:00 db-primary app[30335]: WARN retrying upstream 203.243.119.108:3080 after timeout (5936 ms), attempt 1 of 3 2026-10-09T13:25:50.132005-07:00 web-03 nginx[1210]: 10.133.252.177 - - "GET /api/v2/users HTTP/1.1" 500 38134 "-" "Go-http-client/1.1" 2026-10-09T13:25:50.221262-07:00 cache-3 nginx[1204]: 91.243.58.194 - - "GET /wp-login.php HTTP/1.1" 301 84786 "-" "python-requests/2.32.3" 2026-10-09T13:25:50.326513-07:00 edge-fr-1 sshd[37965]: Received disconnect from 91.189.82.68 port 9126:11: Bye Bye [preauth] 2026-10-09T13:25:50.438427-07:00 api-07 app[30654]: INFO health check ok: db 879 ms, cache 879 ms, queue depth 70 2026-10-09T13:25:50.512543-07:00 edge-fr-1 sshd[6672]: Failed password for invalid user priya from 91.180.152.16 port 25768 ssh2 2026-10-09T13:25:50.641292-07:00 api-07 nginx[1209]: 172.39.250.207 - - "GET /metrics HTTP/1.1" 200 47866 "-" "kube-probe/1.31" 2026-10-09T13:25:50.770068-07:00 api-08 nginx[1204]: 45.106.173.180 - priya "POST /.env HTTP/1.1" 404 12626 "-" "python-requests/2.32.3" 2026-10-09T13:25:51.206668-07:00 web-03 app[30328]: INFO request_id=1966539471734ff7 method=GET path=/api/v2/search?q=invoice status=404 duration=7188ms 2026-10-09T13:25:51.328525-07:00 cache-3 app[30844]: INFO request_id=6c7464b435476610 method=GET path=/api/v2/orders/8841 status=200 duration=3167ms 2026-10-09T13:25:51.574454-07:00 api-08 app[30874]: INFO order 85193 confirmed for backup in 5387 ms (region eu-west-1, queue orders) 2026-10-09T13:25:51.647670-07:00 api-07 sshd[20045]: Invalid user müller from 192.153.92.27 port 27096 2026-10-09T13:25:51.664873-07:00 web-02 app[30310]: INFO request_id=abc65d9ebd53eab5 method=GET path=/favicon.ico status=404 duration=6908ms 2026-10-09T13:25:51.742360-07:00 cache-3 app[30461]: INFO worker 87 finished job 761d4cf01bbfa8a0 in 4390 ms 2026-10-09T13:25:51.772659-07:00 web-01 nginx[1201]: 45.9.196.104 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 58227 "-" "python-requests/2.32.3" 2026-10-09T13:25:51.784133-07:00 worker-12 app[30383]: INFO order 38685 confirmed for ci in 7341 ms (region us-east-1, queue emails) 2026-10-09T13:25:51.921449-07:00 web-03 sshd[34734]: Failed password for invalid user françois from 45.247.199.22 port 57266 ssh2 2026-10-09T13:25:52.075828-07:00 api-07 app[30775]: INFO request_id=531793df39a02d12 method=GET path=/api/v2/users status=200 duration=1634ms 2026-10-09T13:25:52.087440-07:00 web-03 nginx[1205]: 192.27.2.9 - - "GET /login HTTP/1.1" 404 75653 "-" "Go-http-client/1.1" 2026-10-09T13:25:52.174870-07:00 worker-12 nginx[1210]: 172.39.251.4 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 7532 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:52.397907-07:00 bastion app[30198]: INFO request_id=9978d764e3de9c26 method=GET path=/metrics status=404 duration=4461ms 2026-10-09T13:25:52.629723-07:00 cache-3 nginx[1210]: 192.191.214.146 - müller "POST /login HTTP/1.1" 500 70975 "-" "python-requests/2.32.3" 2026-10-09T13:25:52.777978-07:00 api-07 app[30289]: INFO request_id=a06d34be9997f080 method=GET path=/favicon.ico status=200 duration=3885ms 2026-10-09T13:25:53.077132-07:00 web-01 app[30276]: INFO request_id=74ccfaf79ffa426a method=GET path=/api/v2/users status=200 duration=4174ms 2026-10-09T13:25:53.183156-07:00 api-08 nginx[1207]: 192.137.26.149 - müller "POST /.env HTTP/1.1" 200 67983 "-" "Go-http-client/1.1" 2026-10-09T13:25:53.188593-07:00 web-02 nginx[1209]: 91.234.102.177 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 47377 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:53.380342-07:00 web-03 kernel: [15793.269566] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.151.10.51 DST=10.0.561.561 LEN=35 TOS=0x00 PREC=0x00 TTL=35 ID=15793 DF PROTO=TCP SPT=19211 DPT=19211 WINDOW=15793 RES=0x00 SYN URGP=0 2026-10-09T13:25:53.510849-07:00 edge-fr-1 app[30774]: INFO worker 46 finished job 3fabd50b947fe6db in 8227 ms 2026-10-09T13:25:53.552187-07:00 cache-3 app[30820]: INFO request_id=15cc246bfc24a8ad method=GET path=/admin status=301 duration=2871ms 2026-10-09T13:25:53.594393-07:00 api-08 nginx[1206]: 203.150.118.82 - root "POST /admin HTTP/1.1" 401 278 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:53.999597-07:00 web-02 nginx[1200]: 172.179.18.117 - akira "POST /api/v2/orders/8841 HTTP/1.1" 200 24803 "-" "Go-http-client/1.1" 2026-10-09T13:25:54.020092-07:00 web-03 nginx[1203]: 203.230.63.35 - - "GET /static/app.js HTTP/1.1" 404 4861 "-" "python-requests/2.32.3" 2026-10-09T13:25:54.088443-07:00 worker-12 app[30537]: INFO worker 59 finished job 27d8344d81a16534 in 8840 ms 2026-10-09T13:25:54.189283-07:00 db-primary sshd[43241]: Connection closed by 91.253.70.20 port 27778 [preauth] 2026-10-09T13:25:54.239534-07:00 worker-12 nginx[1200]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.162.95.36, server: app.example.com, request: "GET /health HTTP/1.1", upstream: "http://10.0.732.732:8080/health" 2026-10-09T13:25:54.313870-07:00 db-replica sshd[26551]: Accepted publickey for zoë from 192.132.237.207 port 21295 ssh2: ED25519 SHA256:1a6f76c66cbafb60 2026-10-09T13:25:54.525759-07:00 api-08 haproxy[928]: 45.224.11.231:53993 [55478] http-in app/api-08 4379/0/689/689/4379 200 81744 - - ---- 248/248/48/48/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:54.569709-07:00 worker-12 app[30912]: INFO health check ok: db 119 ms, cache 119 ms, queue depth 28 2026-10-09T13:25:54.663691-07:00 bastion app[30105]: INFO worker 40 picked job 9788d9f0e543616a from queue orders 2026-10-09T13:25:54.717789-07:00 bastion app[30820]: INFO request_id=a4c8934bcb2fc17a method=GET path=/.env status=500 duration=2195ms 2026-10-09T13:25:54.722715-07:00 api-08 haproxy[941]: 91.228.96.248:22825 [22403] http-in app/web-03 7388/0/401/401/7388 200 20481 - - ---- 953/953/46/46/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:25:54.747957-07:00 web-01 app[30840]: INFO worker 56 picked job b9b7226acf05f00e from queue invoices 2026-10-09T13:25:54.756077-07:00 db-replica haproxy[950]: 10.140.64.156:61104 [12012] http-in app/edge-fr-1 4788/0/192/192/4788 204 65650 - - ---- 657/657/80/80/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:25:54.795665-07:00 web-01 sshd[5666]: Failed password for invalid user root from 203.60.96.144 port 18817 ssh2 2026-10-09T13:25:54.851227-07:00 cache-3 postgres[8098]: LOG: checkpoint complete: wrote 6122 buffers (62%); 0 WAL file(s) added, 0 removed, 24 recycled; write=3507.456 s, sync=0.456 s, total=3507.456 s 2026-10-09T13:25:55.088466-07:00 cache-3 app[30064]: WARN slow query (4315 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '95 minutes' 2026-10-09T13:25:55.111059-07:00 web-03 sshd[11299]: Failed password for invalid user deploy from 172.5.153.196 port 2372 ssh2 2026-10-09T13:25:55.191887-07:00 web-02 postgres[19061]: LOG: duration: 7204.938 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:55.200231-07:00 cache-3 app[30762]: INFO worker 40 finished job 8192b4798fd1dfbc in 6683 ms 2026-10-09T13:25:55.273258-07:00 bastion app[30075]: INFO request_id=3cb08df52f9486ed method=GET path=/metrics status=200 duration=7838ms 2026-10-09T13:25:55.360781-07:00 api-07 sshd[28823]: Received disconnect from 45.204.80.76 port 18371:11: Bye Bye [preauth] 2026-10-09T13:25:55.398896-07:00 web-03 nginx[1203]: 192.109.85.236 - - "GET /wp-login.php HTTP/1.1" 200 12601 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:25:55.477542-07:00 api-08 app[30335]: INFO request_id=684d950b451c6a07 method=GET path=/favicon.ico status=500 duration=938ms 2026-10-09T13:25:55.490985-07:00 web-02 postgres[10387]: LOG: duration: 4021.253 ms statement: SELECT * FROM orders WHERE customer_id = 11863 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:25:55.510133-07:00 web-01 app[30767]: INFO worker 62 finished job 6df537089e386c74 in 5943 ms 2026-10-09T13:25:55.554841-07:00 web-01 app[30524]: DEBUG cache hit ratio 51% over the last minute (34250 lookups) 2026-10-09T13:25:55.600348-07:00 web-03 nginx[1205]: 45.178.149.254 - - "GET /admin HTTP/1.1" 200 66878 "-" "Go-http-client/1.1" 2026-10-09T13:25:55.773693-07:00 bastion haproxy[936]: 172.176.175.218:40337 [58839] http-in app/db-replica 3677/0/477/477/3677 401 88050 - - ---- 220/220/40/40/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:25:55.787662-07:00 worker-12 haproxy[912]: 172.185.241.11:18782 [54634] http-in app/bastion 7243/0/287/287/7243 404 20857 - - ---- 191/191/32/32/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:25:55.870144-07:00 edge-fr-1 app[30840]: INFO request_id=7e43760c12ab1668 method=GET path=/static/app.js status=200 duration=4868ms 2026-10-09T13:25:55.921544-07:00 web-02 app[30030]: INFO request_id=0e75aa282983dc01 method=GET path=/health status=404 duration=8266ms 2026-10-09T13:25:56.015092-07:00 cache-3 app[30715]: INFO worker 54 finished job 0748e405b84012da in 1338 ms 2026-10-09T13:25:56.135042-07:00 edge-fr-1 app[30810]: INFO order 84218 confirmed for müller in 5780 ms (region eu-west-1, queue invoices) 2026-10-09T13:25:56.140845-07:00 worker-12 sshd[60701]: Connection closed by 10.234.147.11 port 55038 [preauth] 2026-10-09T13:25:56.349887-07:00 bastion systemd[1]: Started Session 94211 of User ci. 2026-10-09T13:25:56.411728-07:00 cache-3 sshd[23284]: Failed password for invalid user backup from 45.26.15.149 port 2205 ssh2 2026-10-09T13:25:56.461389-07:00 api-08 nginx[1206]: 203.32.183.193 - - "GET /metrics HTTP/1.1" 301 25587 "-" "Go-http-client/1.1" 2026-10-09T13:25:56.545704-07:00 web-03 app[30105]: INFO worker 44 picked job 59b4f56598bef0a7 from queue orders 2026-10-09T13:25:56.564551-07:00 db-primary app[30614]: INFO health check ok: db 761 ms, cache 761 ms, queue depth 57 2026-10-09T13:25:56.698468-07:00 web-03 nginx[1206]: 91.82.232.73 - priya "POST /api/v2/users HTTP/1.1" 401 64186 "-" "Go-http-client/1.1" 2026-10-09T13:25:56.755335-07:00 web-03 nginx[1202]: 45.194.197.66 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 41952 "-" "python-requests/2.32.3" 2026-10-09T13:25:56.775490-07:00 web-02 app[30645]: INFO order 65245 confirmed for müller in 9671 ms (region eu-west-1, queue orders) 2026-10-09T13:25:56.997378-07:00 worker-12 systemd[1]: session-96110.scope: Deactivated successfully. 2026-10-09T13:25:57.034159-07:00 web-03 postgres[22463]: LOG: duration: 3523.946 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:25:57.299817-07:00 api-07 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.182.209.207, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.134.134:8080/metrics" 2026-10-09T13:25:57.317578-07:00 worker-12 app[30260]: INFO worker 52 picked job 1790e9068d135f93 from queue orders 2026-10-09T13:25:57.435992-07:00 bastion app[30431]: INFO health check ok: db 972 ms, cache 972 ms, queue depth 77 2026-10-09T13:25:57.624077-07:00 web-01 sshd[37342]: Accepted publickey for zoë from 192.175.92.182 port 34182 ssh2: ED25519 SHA256:b6d97830084d52a3 2026-10-09T13:25:57.981607-07:00 api-07 cron[18867]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:25:58.115712-07:00 db-primary nginx[1206]: 172.187.133.134 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 47916 "-" "python-requests/2.32.3" 2026-10-09T13:25:58.329267-07:00 db-replica haproxy[944]: 172.94.139.103:55603 [95487] http-in app/db-replica 4557/0/774/774/4557 204 86285 - - ---- 603/603/32/32/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:25:58.488474-07:00 web-03 app[30443]: INFO request_id=3eb87cc08289fdc7 method=GET path=/static/app.js status=302 duration=379ms 2026-10-09T13:25:58.506432-07:00 web-02 app[30010]: INFO request_id=253c27679615076b method=GET path=/login status=500 duration=4011ms 2026-10-09T13:25:58.589185-07:00 web-02 app[30910]: INFO request_id=02f29964c7c27d7e method=GET path=/api/v2/orders/8841 status=200 duration=8280ms 2026-10-09T13:25:58.671080-07:00 cache-3 sshd[3823]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:25:58.709797-07:00 api-07 nginx[1203]: 10.248.189.8 - - "GET /metrics HTTP/1.1" 200 59003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:25:58.764079-07:00 api-07 app[30101]: INFO worker 53 finished job 3f2763d2906fa99c in 9761 ms 2026-10-09T13:25:58.768240-07:00 db-replica nginx[1201]: 10.224.248.207 - - "GET /login HTTP/1.1" 401 78801 "-" "curl/8.4.0" 2026-10-09T13:25:58.873612-07:00 db-replica sshd[19424]: Received disconnect from 192.123.238.56 port 30615:11: Bye Bye [preauth] 2026-10-09T13:25:59.089298-07:00 cache-3 app[30116]: INFO worker 52 picked job 9109ca249846f280 from queue invoices 2026-10-09T13:25:59.115659-07:00 db-primary sshd[50379]: Invalid user sørensen from 192.198.112.207 port 4332 2026-10-09T13:25:59.226570-07:00 db-primary sshd[44497]: Invalid user françois from 45.82.75.79 port 38047 2026-10-09T13:25:59.286099-07:00 worker-12 app[30343]: INFO worker 24 picked job 9ee3a92f4fc70647 from queue invoices 2026-10-09T13:25:59.506633-07:00 web-01 sshd[44014]: Invalid user akira from 45.90.222.29 port 32241 2026-10-09T13:25:59.639472-07:00 db-replica haproxy[921]: 172.75.242.156:35190 [24946] http-in app/worker-12 568/0/241/241/568 200 74292 - - ---- 241/241/41/41/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:25:59.846095-07:00 api-07 app[30155]: INFO request_id=4e3125f1f452668e method=GET path=/health status=404 duration=4594ms 2026-10-09T13:25:59.907937-07:00 api-08 sshd[14710]: Accepted publickey for zoë from 91.135.80.194 port 41926 ssh2: ED25519 SHA256:41b699f868ccc818 2026-10-09T13:26:00.357900-07:00 web-01 app[30748]: INFO request_id=f01ec39fb8dbed95 method=GET path=/metrics status=404 duration=5146ms 2026-10-09T13:26:00.403616-07:00 web-02 nginx[1208]: 192.38.12.110 - - "GET /admin HTTP/1.1" 200 43056 "-" "kube-probe/1.31" 2026-10-09T13:26:00.583755-07:00 api-08 sshd[6769]: Accepted publickey for root from 172.16.6.232 port 41092 ssh2: ED25519 SHA256:2c860c35d3e21ee1 2026-10-09T13:26:00.584740-07:00 web-03 nginx[1201]: 203.115.175.4 - - "GET /metrics HTTP/1.1" 301 73873 "-" "Go-http-client/1.1" 2026-10-09T13:26:00.838893-07:00 api-08 sshd[18660]: Connection closed by 172.62.35.49 port 16777 [preauth] 2026-10-09T13:26:00.863115-07:00 db-primary haproxy[915]: 192.139.84.51:53811 [34431] http-in app/cache-3 7141/0/406/406/7141 204 36521 - - ---- 871/871/77/77/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:26:00.868815-07:00 bastion app[30708]: INFO worker 54 finished job c8389984943acbf0 in 2777 ms 2026-10-09T13:26:00.935236-07:00 edge-fr-1 app[30624]: INFO request_id=e1eaf57968d7fcfe method=GET path=/favicon.ico status=200 duration=617ms 2026-10-09T13:26:01.372237-07:00 worker-12 app[30508]: INFO worker 20 finished job 07b70a45df85ab92 in 4422 ms 2026-10-09T13:26:01.380115-07:00 cache-3 haproxy[912]: 10.210.203.115:20126 [70051] http-in app/cache-3 9736/0/653/653/9736 200 38103 - - ---- 378/378/38/38/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:26:01.800419-07:00 worker-12 haproxy[917]: 172.139.213.24:28224 [20505] http-in app/bastion 3257/0/23/23/3257 302 9824 - - ---- 801/801/36/36/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:26:01.813291-07:00 cache-3 app[30117]: INFO request_id=d682be6af1690a48 method=GET path=/wp-login.php status=404 duration=7835ms 2026-10-09T13:26:01.839961-07:00 db-replica app[30491]: INFO request_id=9380e839aadd0418 method=GET path=/api/v2/orders/8841 status=401 duration=8195ms 2026-10-09T13:26:01.863552-07:00 bastion kernel: [50225.768871] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.223.230.196 DST=10.0.601.601 LEN=44 TOS=0x00 PREC=0x00 TTL=44 ID=50225 DF PROTO=TCP SPT=14199 DPT=14199 WINDOW=50225 RES=0x00 SYN URGP=0 2026-10-09T13:26:01.907798-07:00 bastion app[30297]: INFO health check ok: db 106 ms, cache 106 ms, queue depth 12 2026-10-09T13:26:02.306250-07:00 api-07 app[30704]: INFO request_id=8b400798188f9fed method=GET path=/health status=401 duration=1232ms 2026-10-09T13:26:02.340164-07:00 db-replica nginx[1204]: 172.238.122.161 - - "GET /wp-login.php HTTP/1.1" 404 75414 "-" "kube-probe/1.31" 2026-10-09T13:26:02.504710-07:00 web-01 nginx[1210]: 203.2.225.6 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 36325 "-" "kube-probe/1.31" 2026-10-09T13:26:02.845643-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791577562.566:28026): pid=28026 uid=0 auid=2691 ses=459 msg='op=login id=2691 exe="/usr/sbin/sshd" hostname=? addr=45.195.34.248 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:02.957270-07:00 web-02 sshd[2863]: pam_unix(sshd:session): session opened for user ci(uid=9025) by (uid=0) 2026-10-09T13:26:03.077548-07:00 web-03 postgres[25241]: LOG: duration: 1318.584 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:03.606719-07:00 edge-fr-1 app[30927]: INFO request_id=2ff82cfc08cf4d2a method=GET path=/api/v2/orders status=404 duration=9357ms 2026-10-09T13:26:03.626112-07:00 api-08 haproxy[925]: 91.147.37.18:41848 [32511] http-in app/api-08 3105/0/837/837/3105 200 74102 - - ---- 447/447/34/34/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:26:03.632553-07:00 web-01 app[30575]: INFO request_id=1c307ec91819ee86 method=GET path=/api/v2/orders status=302 duration=6604ms 2026-10-09T13:26:03.638424-07:00 edge-fr-1 app[30524]: INFO request_id=f873bc0396eea0ca method=GET path=/api/v2/search?q=invoice status=404 duration=2051ms 2026-10-09T13:26:03.824720-07:00 db-primary app[30787]: INFO worker 52 picked job 871add88737f99d1 from queue webhooks 2026-10-09T13:26:03.872357-07:00 cache-3 nginx[1205]: 192.238.60.186 - - "GET /login HTTP/1.1" 200 24526 "-" "Go-http-client/1.1" 2026-10-09T13:26:03.889296-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577563.410:70441): pid=70441 uid=0 auid=4034 ses=365 msg='op=login id=4034 exe="/usr/sbin/sshd" hostname=? addr=203.121.42.193 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:03.957529-07:00 worker-12 app[30931]: INFO request_id=c3c4db7586f6be94 method=GET path=/static/app.js status=401 duration=3261ms 2026-10-09T13:26:04.033896-07:00 web-01 haproxy[910]: 172.236.77.43:43710 [87477] http-in app/bastion 3372/0/843/843/3372 200 79395 - - ---- 787/787/80/80/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:26:04.100445-07:00 web-01 sshd[19354]: Connection closed by 192.140.226.238 port 12347 [preauth] 2026-10-09T13:26:04.214910-07:00 db-replica app[30266]: INFO order 72827 confirmed for sørensen in 774 ms (region eu-west-1, queue orders) 2026-10-09T13:26:04.358122-07:00 api-07 haproxy[902]: 45.61.251.133:55323 [69804] http-in app/api-07 9930/0/668/668/9930 200 5129 - - ---- 247/247/27/27/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:26:04.428723-07:00 db-primary cron[50498]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:26:04.729681-07:00 api-08 postgres[14291]: LOG: duration: 6893.251 ms statement: SELECT * FROM orders WHERE customer_id = 12566 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:04.798537-07:00 cache-3 nginx[1202]: 203.166.196.70 - ci "POST /static/main.css HTTP/1.1" 200 36336 "-" "Go-http-client/1.1" 2026-10-09T13:26:04.848237-07:00 api-08 kernel: [86546.858469] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.130.6.60 DST=10.0.412.412 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=86546 DF PROTO=TCP SPT=54220 DPT=54220 WINDOW=86546 RES=0x00 SYN URGP=0 2026-10-09T13:26:04.975126-07:00 web-03 nginx[1206]: 45.108.230.168 - - "GET /favicon.ico HTTP/1.1" 200 1023 "-" "Go-http-client/1.1" 2026-10-09T13:26:05.237061-07:00 web-02 systemd[1]: Started Session 55762 of User sørensen. 2026-10-09T13:26:05.467166-07:00 api-08 app[30812]: INFO order 92322 confirmed for müller in 6967 ms (region eu-west-1, queue invoices) 2026-10-09T13:26:05.474524-07:00 cache-3 sshd[47285]: Accepted publickey for sørensen from 203.234.248.41 port 38567 ssh2: ED25519 SHA256:9c886dc8b3796c56 2026-10-09T13:26:05.510896-07:00 web-03 app[30203]: INFO worker 29 picked job 1af95282220b308c from queue webhooks 2026-10-09T13:26:05.542620-07:00 edge-fr-1 app[30762]: INFO order 62535 confirmed for müller in 7425 ms (region eu-west-1, queue webhooks) 2026-10-09T13:26:05.669889-07:00 api-08 haproxy[940]: 10.128.59.29:27047 [53766] http-in app/web-01 8932/0/610/610/8932 200 9373 - - ---- 332/332/90/90/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:26:05.692606-07:00 api-08 app[30387]: WARN retrying upstream 10.236.46.234:15032 after timeout (2683 ms), attempt 2 of 3 2026-10-09T13:26:05.744225-07:00 db-primary sshd[9690]: Received disconnect from 45.69.183.247 port 60698:11: Bye Bye [preauth] 2026-10-09T13:26:05.829078-07:00 web-01 app[30116]: INFO worker 93 finished job 605f96aae8bd398a in 226 ms 2026-10-09T13:26:06.233886-07:00 db-replica nginx[1202]: 172.197.199.35 - - "GET /static/main.css HTTP/1.1" 204 76086 "-" "Go-http-client/1.1" 2026-10-09T13:26:06.515591-07:00 worker-12 sshd[2193]: Received disconnect from 91.229.85.68 port 24429:11: Bye Bye [preauth] 2026-10-09T13:26:06.537275-07:00 api-08 nginx[1207]: 45.196.41.174 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 6454 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:06.566683-07:00 api-07 app[30745]: INFO request_id=37edd7132a149e8f method=GET path=/health status=404 duration=6712ms 2026-10-09T13:26:06.802851-07:00 db-primary app[30691]: INFO worker 77 picked job 5f5dd079c57af1fd from queue invoices 2026-10-09T13:26:06.878657-07:00 bastion nginx[1200]: 10.158.133.193 - - "GET /health HTTP/1.1" 404 80541 "-" "kube-probe/1.31" 2026-10-09T13:26:06.880282-07:00 api-07 haproxy[902]: 203.170.44.182:23032 [18091] http-in app/web-02 4759/0/588/588/4759 200 46643 - - ---- 293/293/94/94/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:26:06.951015-07:00 bastion haproxy[947]: 192.180.21.41:7604 [47122] http-in app/db-primary 3202/0/38/38/3202 200 61901 - - ---- 862/862/58/58/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:26:07.023422-07:00 web-01 sshd[36929]: pam_unix(sshd:session): session opened for user deploy(uid=4131) by (uid=0) 2026-10-09T13:26:07.094917-07:00 cache-3 app[30988]: INFO request_id=8cfa59d6b5e0c8a2 method=GET path=/.env status=200 duration=3032ms 2026-10-09T13:26:07.210018-07:00 web-02 app[30858]: INFO request_id=a1c5593f4451a908 method=GET path=/static/main.css status=401 duration=8875ms 2026-10-09T13:26:07.646852-07:00 web-01 systemd[1]: Started Session 87356 of User root. 2026-10-09T13:26:07.675261-07:00 api-08 app[30638]: INFO request_id=85b08311c434ba9a method=GET path=/wp-login.php status=204 duration=8288ms 2026-10-09T13:26:07.746255-07:00 web-03 kernel: [99427.785151] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.211.255.25 DST=10.0.440.440 LEN=65 TOS=0x00 PREC=0x00 TTL=65 ID=99427 DF PROTO=TCP SPT=31848 DPT=31848 WINDOW=99427 RES=0x00 SYN URGP=0 2026-10-09T13:26:07.802242-07:00 web-01 haproxy[933]: 45.33.213.137:45231 [80985] http-in app/web-03 3522/0/25/25/3522 502 71444 - - ---- 948/948/44/44/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:26:08.067594-07:00 api-07 sshd[54327]: Failed password for invalid user root from 45.37.254.116 port 62433 ssh2 2026-10-09T13:26:08.444775-07:00 db-primary app[30674]: INFO order 93512 confirmed for backup in 3543 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:08.509917-07:00 web-03 app[30976]: INFO request_id=61123f0a0ff51d43 method=GET path=/admin status=200 duration=6156ms 2026-10-09T13:26:08.543421-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791577568.195:50464): pid=50464 uid=0 auid=3487 ses=110 msg='op=login id=3487 exe="/usr/sbin/sshd" hostname=? addr=203.212.210.137 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:08.596318-07:00 worker-12 haproxy[901]: 203.84.7.226:3733 [57353] http-in app/web-02 1454/0/124/124/1454 502 49231 - - ---- 540/540/61/61/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:26:08.710158-07:00 api-08 kernel: [16485.938418] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.193.151.143 DST=10.0.506.506 LEN=74 TOS=0x00 PREC=0x00 TTL=74 ID=16485 DF PROTO=TCP SPT=42025 DPT=42025 WINDOW=16485 RES=0x00 SYN URGP=0 2026-10-09T13:26:09.200491-07:00 web-02 app[30172]: INFO request_id=c9e69637257778f7 method=GET path=/api/v2/users status=301 duration=1411ms 2026-10-09T13:26:09.372181-07:00 api-07 postgres[9315]: LOG: duration: 7596.237 ms statement: SELECT * FROM orders WHERE customer_id = 30651 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:09.621840-07:00 bastion systemd[1]: session-74066.scope: Deactivated successfully. 2026-10-09T13:26:09.625706-07:00 worker-12 nginx[1202]: 203.151.124.118 - françois "POST /.env HTTP/1.1" 502 9057 "-" "python-requests/2.32.3" 2026-10-09T13:26:09.669647-07:00 db-primary postgres[11316]: LOG: duration: 1544.302 ms statement: SELECT * FROM orders WHERE customer_id = 91328 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:09.737560-07:00 web-01 cron[37414]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:26:09.800176-07:00 api-08 sshd[31912]: Invalid user ci from 91.220.117.46 port 62970 2026-10-09T13:26:09.969371-07:00 web-01 app[30069]: DEBUG cache hit ratio 0% over the last minute (34510 lookups) 2026-10-09T13:26:10.191021-07:00 edge-fr-1 nginx[1200]: 91.229.166.20 - sørensen "POST /health HTTP/1.1" 200 84112 "-" "Go-http-client/1.1" 2026-10-09T13:26:10.235139-07:00 db-primary app[30522]: INFO health check ok: db 331 ms, cache 331 ms, queue depth 88 2026-10-09T13:26:10.323051-07:00 api-08 app[30386]: INFO request_id=1b6ef57765dda9f0 method=GET path=/login status=302 duration=3084ms 2026-10-09T13:26:10.415472-07:00 web-02 sshd[9268]: Accepted publickey for ci from 203.64.193.148 port 34645 ssh2: ED25519 SHA256:64718408ad3eed4c 2026-10-09T13:26:10.744927-07:00 cache-3 app[30660]: INFO worker 97 finished job 5071c7f55b73e86b in 9183 ms 2026-10-09T13:26:10.952370-07:00 worker-12 sshd[5369]: Failed password for invalid user backup from 10.252.142.183 port 49593 ssh2 2026-10-09T13:26:10.961085-07:00 web-01 app[30985]: INFO worker 54 finished job 08d476035ef136fb in 7404 ms 2026-10-09T13:26:11.043846-07:00 cache-3 nginx[1206]: 91.107.248.12 - zoë "POST /admin HTTP/1.1" 200 41500 "-" "curl/8.4.0" 2026-10-09T13:26:11.062387-07:00 web-01 app[30468]: INFO worker 34 picked job da0c22b9b8869691 from queue invoices 2026-10-09T13:26:11.430521-07:00 db-primary app[30112]: INFO health check ok: db 622 ms, cache 622 ms, queue depth 19 2026-10-09T13:26:11.468370-07:00 web-03 sshd[5934]: Failed password for invalid user sørensen from 203.167.192.77 port 55801 ssh2 2026-10-09T13:26:11.644202-07:00 web-02 nginx[1200]: 10.237.211.36 - - "GET /static/app.js HTTP/1.1" 200 89416 "-" "Go-http-client/1.1" 2026-10-09T13:26:11.844916-07:00 db-primary sshd[56131]: Failed password for invalid user priya from 91.78.207.140 port 20523 ssh2 2026-10-09T13:26:12.044169-07:00 bastion systemd[1]: session-44340.scope: Deactivated successfully. 2026-10-09T13:26:12.205020-07:00 api-07 app[30371]: INFO request_id=7671ef1fa33bee6b method=GET path=/admin status=204 duration=4368ms 2026-10-09T13:26:12.238420-07:00 api-08 nginx[1207]: 203.201.191.2 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 79276 "-" "python-requests/2.32.3" 2026-10-09T13:26:12.348999-07:00 bastion postgres[7804]: LOG: duration: 4711.226 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:12.506397-07:00 bastion nginx[1206]: 203.200.163.8 - priya "POST /api/v2/users HTTP/1.1" 500 66951 "-" "kube-probe/1.31" 2026-10-09T13:26:12.669964-07:00 edge-fr-1 sshd[16673]: Failed password for invalid user müller from 10.129.28.86 port 3501 ssh2 2026-10-09T13:26:12.778947-07:00 web-01 nginx[1208]: 91.84.9.14 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 39146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:12.822027-07:00 api-07 app[30569]: INFO request_id=b78edcf94b83a986 method=GET path=/api/v2/orders status=301 duration=2468ms 2026-10-09T13:26:12.839996-07:00 api-08 sshd[60576]: pam_unix(sshd:session): session opened for user sørensen(uid=6130) by (uid=0) 2026-10-09T13:26:12.967503-07:00 web-01 app[30447]: INFO request_id=ee195b6cbe4566da method=GET path=/admin status=200 duration=4825ms 2026-10-09T13:26:13.061393-07:00 cache-3 cron[32300]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:26:13.204944-07:00 edge-fr-1 app[30804]: INFO order 22099 confirmed for ci in 3910 ms (region ap-northeast-1, queue orders) 2026-10-09T13:26:13.221059-07:00 api-07 app[30605]: INFO request_id=5e8b4461082d822e method=GET path=/.env status=500 duration=9848ms 2026-10-09T13:26:13.231686-07:00 worker-12 app[30762]: INFO order 32774 confirmed for zoë in 797 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:26:13.235699-07:00 cache-3 app[30052]: INFO request_id=cc75817ecf6cbf15 method=GET path=/wp-login.php status=200 duration=4377ms 2026-10-09T13:26:13.247642-07:00 db-replica nginx[1204]: 203.58.7.42 - - "GET /api/v2/users HTTP/1.1" 502 59230 "-" "Go-http-client/1.1" 2026-10-09T13:26:13.368932-07:00 web-02 kernel: [60975.867412] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.153.172.105 DST=10.0.126.126 LEN=42 TOS=0x00 PREC=0x00 TTL=42 ID=60975 DF PROTO=TCP SPT=23899 DPT=23899 WINDOW=60975 RES=0x00 SYN URGP=0 2026-10-09T13:26:13.387818-07:00 cache-3 nginx[1201]: 192.243.94.198 - - "GET /health HTTP/1.1" 200 57314 "-" "kube-probe/1.31" 2026-10-09T13:26:13.475140-07:00 edge-fr-1 haproxy[933]: 203.165.214.76:41119 [82946] http-in app/edge-fr-1 6765/0/935/935/6765 401 19928 - - ---- 941/941/92/92/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:26:13.559930-07:00 web-03 app[30684]: ERROR payment declined for order 11117: card_declined (code 97), customer notified 2026-10-09T13:26:13.586278-07:00 db-primary app[30546]: INFO request_id=626bd144627e4a32 method=GET path=/favicon.ico status=204 duration=1505ms 2026-10-09T13:26:13.717276-07:00 web-02 postgres[23246]: LOG: duration: 532.536 ms statement: SELECT * FROM orders WHERE customer_id = 98628 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:13.765141-07:00 bastion nginx[1201]: 91.39.238.202 - - "GET /health HTTP/1.1" 302 79780 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:13.826807-07:00 cache-3 nginx[1208]: 203.121.195.52 - - "GET /login HTTP/1.1" 404 54935 "-" "python-requests/2.32.3" 2026-10-09T13:26:13.840460-07:00 worker-12 app[30932]: INFO health check ok: db 243 ms, cache 243 ms, queue depth 98 2026-10-09T13:26:13.872338-07:00 api-07 cron[34430]: (ci) CMD (/usr/bin/backup --quiet --target /srv/ci) 2026-10-09T13:26:13.973902-07:00 edge-fr-1 sshd[33179]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:26:14.136996-07:00 cache-3 nginx[1208]: 10.2.225.19 - ci "POST /api/v2/orders/8841 HTTP/1.1" 404 77784 "-" "Go-http-client/1.1" 2026-10-09T13:26:14.434664-07:00 web-01 sshd[6065]: Failed password for invalid user zoë from 91.123.63.23 port 23787 ssh2 2026-10-09T13:26:14.472636-07:00 db-replica nginx[1203]: 192.236.102.178 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 77005 "-" "Go-http-client/1.1" 2026-10-09T13:26:14.611407-07:00 web-01 postgres[7903]: LOG: duration: 1259.565 ms statement: SELECT * FROM orders WHERE customer_id = 35722 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:14.729215-07:00 api-07 kubelet[800]: I1009 13:26:14.772500 8499 kubelet.go:8499] "Pod is terminating, skipping pod status update" pod="default/api-bcc489e0817bca63" 2026-10-09T13:26:14.943375-07:00 bastion postgres[11981]: LOG: duration: 22.279 ms statement: SELECT * FROM orders WHERE customer_id = 99163 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:14.947605-07:00 web-02 app[30172]: INFO worker 75 finished job 1dad2646a7469e25 in 6886 ms 2026-10-09T13:26:14.984935-07:00 web-03 app[30841]: INFO health check ok: db 808 ms, cache 808 ms, queue depth 67 2026-10-09T13:26:15.084754-07:00 web-02 app[30454]: INFO request_id=f64d755caeec5c59 method=GET path=/wp-login.php status=404 duration=8801ms 2026-10-09T13:26:15.237674-07:00 web-01 sshd[3265]: Failed password for invalid user müller from 192.149.33.61 port 13258 ssh2 2026-10-09T13:26:15.291007-07:00 api-08 kernel: [94057.937871] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.187.247.193 DST=10.0.848.848 LEN=57 TOS=0x00 PREC=0x00 TTL=57 ID=94057 DF PROTO=TCP SPT=19670 DPT=19670 WINDOW=94057 RES=0x00 SYN URGP=0 2026-10-09T13:26:15.313754-07:00 web-02 app[30872]: INFO request_id=ac414ae81c0e5cbe method=GET path=/api/v2/search?q=invoice status=302 duration=9303ms 2026-10-09T13:26:15.607737-07:00 api-08 nginx[1201]: 192.180.197.225 - - "GET /metrics HTTP/1.1" 500 6786 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:15.612331-07:00 db-replica postgres[7307]: LOG: duration: 4707.110 ms statement: SELECT * FROM orders WHERE customer_id = 53340 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:15.638080-07:00 web-03 nginx[1210]: 172.64.148.34 - ci "POST /.env HTTP/1.1" 200 77994 "-" "curl/8.4.0" 2026-10-09T13:26:15.682857-07:00 web-02 nginx[1203]: 91.202.40.3 - müller "POST /wp-login.php HTTP/1.1" 204 73631 "-" "kube-probe/1.31" 2026-10-09T13:26:15.729658-07:00 api-08 app[30460]: WARN retrying upstream 10.115.216.181:19525 after timeout (3973 ms), attempt 3 of 3 2026-10-09T13:26:15.736532-07:00 edge-fr-1 app[30587]: INFO request_id=4adf826a5ee9159b method=GET path=/wp-login.php status=302 duration=8580ms 2026-10-09T13:26:15.871875-07:00 web-02 nginx[1210]: 45.28.110.13 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 25566 "-" "kube-probe/1.31" 2026-10-09T13:26:15.897471-07:00 web-01 systemd[1]: session-15920.scope: Deactivated successfully. 2026-10-09T13:26:15.965817-07:00 edge-fr-1 app[30057]: INFO request_id=caae2f0cd56e744b method=GET path=/static/main.css status=200 duration=8963ms 2026-10-09T13:26:16.384660-07:00 api-08 app[30120]: INFO request_id=9f8f67d73ffc2012 method=GET path=/api/v2/orders status=200 duration=9532ms 2026-10-09T13:26:16.578700-07:00 web-01 sshd[29426]: Invalid user backup from 192.104.9.166 port 53359 2026-10-09T13:26:16.928818-07:00 bastion sshd[46553]: Received disconnect from 172.248.156.209 port 30515:11: Bye Bye [preauth] 2026-10-09T13:26:16.931484-07:00 web-01 cron[17935]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:26:17.315650-07:00 web-03 nginx[1202]: 10.52.22.64 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 50715 "-" "python-requests/2.32.3" 2026-10-09T13:26:17.473070-07:00 edge-fr-1 app[30145]: INFO request_id=eefe7cc831301b72 method=GET path=/api/v2/users status=401 duration=3592ms 2026-10-09T13:26:17.490318-07:00 cache-3 nginx[1201]: 10.78.10.62 - - "GET /metrics HTTP/1.1" 502 22016 "-" "curl/8.4.0" 2026-10-09T13:26:17.926030-07:00 db-replica kernel: [97747.168854] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.125.246.206 DST=10.0.875.875 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=97747 DF PROTO=TCP SPT=15350 DPT=15350 WINDOW=97747 RES=0x00 SYN URGP=0 2026-10-09T13:26:18.035603-07:00 cache-3 app[30082]: INFO order 12258 confirmed for ci in 8123 ms (region us-east-1, queue emails) 2026-10-09T13:26:18.340809-07:00 cache-3 nginx[1207]: 91.40.104.91 - - "GET /login HTTP/1.1" 200 46571 "-" "curl/8.4.0" 2026-10-09T13:26:18.354248-07:00 cache-3 sshd[29685]: Accepted publickey for priya from 192.20.15.217 port 17853 ssh2: ED25519 SHA256:0dd4f0b2569b699d 2026-10-09T13:26:18.519815-07:00 web-02 app[30073]: INFO worker 37 finished job 38952bdc17fa15ce in 7618 ms 2026-10-09T13:26:18.566554-07:00 bastion nginx[1209]: 203.224.124.239 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 87710 "-" "Go-http-client/1.1" 2026-10-09T13:26:18.672148-07:00 db-primary nginx[1200]: 203.165.187.148 - - "GET /login HTTP/1.1" 404 42583 "-" "python-requests/2.32.3" 2026-10-09T13:26:18.703256-07:00 api-07 app[30471]: INFO order 54791 confirmed for priya in 4696 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:18.749516-07:00 cache-3 postgres[27804]: LOG: duration: 4354.494 ms statement: SELECT * FROM orders WHERE customer_id = 24505 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:18.826330-07:00 web-02 sshd[56527]: Invalid user deploy from 91.66.159.246 port 37032 2026-10-09T13:26:18.901031-07:00 db-replica app[30352]: INFO request_id=8a2a94fe83f78912 method=GET path=/admin status=200 duration=1232ms 2026-10-09T13:26:18.937550-07:00 db-replica sshd[41330]: Connection closed by 203.249.235.25 port 11002 [preauth] 2026-10-09T13:26:19.184087-07:00 api-08 sshd[26094]: Failed password for invalid user françois from 172.99.226.208 port 15368 ssh2 2026-10-09T13:26:19.219967-07:00 api-08 sshd[2110]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:26:19.428174-07:00 api-07 haproxy[906]: 192.181.84.75:49379 [56319] http-in app/db-primary 3882/0/919/919/3882 200 75221 - - ---- 884/884/45/45/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:26:19.501612-07:00 web-01 app[30712]: INFO worker 61 picked job 6aa20102788fe315 from queue invoices 2026-10-09T13:26:19.578054-07:00 web-03 app[30105]: INFO order 54162 confirmed for priya in 2596 ms (region eu-west-1, queue emails) 2026-10-09T13:26:19.971201-07:00 bastion sshd[18033]: Received disconnect from 203.53.119.158 port 61614:11: Bye Bye [preauth] 2026-10-09T13:26:20.023112-07:00 web-03 app[30108]: INFO worker 54 finished job 88dc07b122a80059 in 2600 ms 2026-10-09T13:26:20.154091-07:00 api-08 haproxy[905]: 172.104.84.151:3921 [66179] http-in app/bastion 3361/0/620/620/3361 200 87011 - - ---- 535/535/10/10/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:26:20.174678-07:00 web-03 postgres[9805]: LOG: duration: 538.89 ms statement: SELECT * FROM orders WHERE customer_id = 18729 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:20.459849-07:00 db-replica app[30852]: INFO order 76981 confirmed for backup in 3574 ms (region eu-west-1, queue orders) 2026-10-09T13:26:20.860149-07:00 worker-12 kernel: [47394.992548] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.223.223.37 DST=10.0.155.155 LEN=82 TOS=0x00 PREC=0x00 TTL=82 ID=47394 DF PROTO=TCP SPT=38954 DPT=38954 WINDOW=47394 RES=0x00 SYN URGP=0 2026-10-09T13:26:21.078747-07:00 api-07 app[30876]: INFO request_id=3bb6503356b1beba method=GET path=/login status=204 duration=7212ms 2026-10-09T13:26:21.142088-07:00 web-03 sshd[41647]: Invalid user akira from 91.244.207.204 port 20312 2026-10-09T13:26:21.250172-07:00 web-01 app[30150]: INFO worker 37 picked job d79ed352b71ef32a from queue orders 2026-10-09T13:26:21.367442-07:00 web-01 app[30317]: INFO order 90911 confirmed for zoë in 3855 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:26:21.850868-07:00 edge-fr-1 sshd[36550]: Failed password for invalid user müller from 192.127.48.121 port 35624 ssh2 2026-10-09T13:26:21.860907-07:00 web-01 systemd[1]: session-15690.scope: Deactivated successfully. 2026-10-09T13:26:21.953064-07:00 edge-fr-1 nginx[1205]: 10.167.47.27 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 75956 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:22.103222-07:00 web-02 nginx[1206]: 203.216.27.11 - - "GET /health HTTP/1.1" 401 15172 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:22.158515-07:00 web-01 sshd[12943]: Connection closed by 192.146.65.150 port 42723 [preauth] 2026-10-09T13:26:22.416081-07:00 web-01 app[30020]: WARN retrying upstream 45.52.233.254:42463 after timeout (5297 ms), attempt 3 of 3 2026-10-09T13:26:22.417961-07:00 db-replica app[30253]: INFO worker 56 picked job 3d96751b49a5fee5 from queue orders 2026-10-09T13:26:22.496861-07:00 web-02 app[30038]: INFO request_id=cb6ce6768fe58bb6 method=GET path=/login status=200 duration=1144ms 2026-10-09T13:26:23.150092-07:00 web-01 app[30411]: INFO request_id=ea1756ba56faa8e0 method=GET path=/api/v2/users status=200 duration=4744ms 2026-10-09T13:26:23.315889-07:00 web-01 sshd[36586]: Accepted publickey for deploy from 45.127.29.241 port 62880 ssh2: ED25519 SHA256:1493d181334c7eea 2026-10-09T13:26:23.561401-07:00 cache-3 app[30391]: INFO request_id=dedc7900b44e117d method=GET path=/favicon.ico status=301 duration=1809ms 2026-10-09T13:26:23.592765-07:00 edge-fr-1 nginx[1207]: 172.206.186.128 - akira "POST /static/app.js HTTP/1.1" 404 77995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:23.623427-07:00 web-03 app[30182]: INFO request_id=c0d56f4301b727e7 method=GET path=/metrics status=200 duration=8335ms 2026-10-09T13:26:23.664339-07:00 worker-12 app[30388]: INFO request_id=a1ff2a9848f96709 method=GET path=/wp-login.php status=502 duration=5167ms 2026-10-09T13:26:23.717888-07:00 db-primary sshd[16909]: Received disconnect from 172.173.79.24 port 21119:11: Bye Bye [preauth] 2026-10-09T13:26:23.731580-07:00 edge-fr-1 nginx[1208]: 10.89.247.2 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 5006 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:23.787519-07:00 cache-3 nginx[1203]: 45.12.47.141 - deploy "POST /api/v2/users HTTP/1.1" 200 69152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:23.822655-07:00 edge-fr-1 sshd[53149]: Accepted publickey for zoë from 203.63.232.216 port 17779 ssh2: ED25519 SHA256:3aa924b9536e74f1 2026-10-09T13:26:23.994006-07:00 cache-3 app[30082]: INFO order 32508 confirmed for françois in 7663 ms (region eu-west-1, queue webhooks) 2026-10-09T13:26:24.218419-07:00 web-02 app[30352]: INFO order 90281 confirmed for françois in 5839 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:24.245943-07:00 web-02 haproxy[927]: Server app/cache-3 is DOWN, reason: Layer4 timeout, check duration: 1559ms. 91 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:26:24.623501-07:00 bastion kernel: [58230.273696] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.255.170.238 DST=10.0.780.780 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=58230 DF PROTO=TCP SPT=16179 DPT=16179 WINDOW=58230 RES=0x00 SYN URGP=0 2026-10-09T13:26:24.629046-07:00 bastion postgres[30026]: LOG: duration: 6736.27 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:24.765277-07:00 api-08 nginx[1200]: 192.22.134.71 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 6123 "-" "curl/8.4.0" 2026-10-09T13:26:24.858113-07:00 bastion systemd[1]: Started Session 32032 of User root. 2026-10-09T13:26:24.912352-07:00 worker-12 nginx[1203]: 45.248.55.211 - - "GET /.env HTTP/1.1" 200 12168 "-" "kube-probe/1.31" 2026-10-09T13:26:24.920640-07:00 db-replica app[30978]: INFO order 22856 confirmed for sørensen in 4400 ms (region us-east-1, queue emails) 2026-10-09T13:26:25.009050-07:00 db-primary app[30034]: INFO request_id=257d10221790fdaf method=GET path=/health status=200 duration=8858ms 2026-10-09T13:26:25.199148-07:00 worker-12 app[30166]: INFO worker 42 picked job 9fe89411770e4c8b from queue orders 2026-10-09T13:26:25.280186-07:00 bastion app[30772]: INFO order 32087 confirmed for müller in 9257 ms (region us-east-1, queue emails) 2026-10-09T13:26:25.302152-07:00 api-07 app[30909]: INFO request_id=1ba42d38e1f58e70 method=GET path=/admin status=401 duration=4342ms 2026-10-09T13:26:25.446880-07:00 db-primary sshd[59051]: Failed password for invalid user deploy from 91.239.235.157 port 36561 ssh2 2026-10-09T13:26:25.448688-07:00 web-01 haproxy[928]: 91.37.81.230:26462 [85986] http-in app/db-replica 2132/0/413/413/2132 200 61739 - - ---- 893/893/14/14/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:26:25.495914-07:00 api-08 haproxy[917]: 10.193.81.201:35231 [18533] http-in app/worker-12 3747/0/473/473/3747 200 27107 - - ---- 769/769/84/84/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:26:25.688444-07:00 worker-12 postgres[23295]: LOG: duration: 4103.196 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:25.797911-07:00 edge-fr-1 nginx[1210]: 10.151.76.2 - - "GET /metrics HTTP/1.1" 200 62800 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:25.936887-07:00 edge-fr-1 postgres[22117]: LOG: duration: 4156.698 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:26.366880-07:00 db-replica nginx[1210]: 192.51.230.145 - - "GET /wp-login.php HTTP/1.1" 301 24755 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:26.468656-07:00 db-primary haproxy[927]: 203.94.21.193:18252 [66955] http-in app/api-07 1572/0/290/290/1572 404 66726 - - ---- 151/151/29/29/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:26:26.654434-07:00 edge-fr-1 app[30714]: INFO request_id=50fdb43e77f5caad method=GET path=/.env status=200 duration=5898ms 2026-10-09T13:26:26.941447-07:00 web-02 app[30685]: INFO worker 11 finished job 5d913f1acfab98e2 in 4058 ms 2026-10-09T13:26:27.193058-07:00 worker-12 app[30914]: INFO worker 82 finished job b66d9b4fef68a533 in 5299 ms 2026-10-09T13:26:27.266135-07:00 bastion nginx[1200]: 45.173.95.23 - - "GET /static/main.css HTTP/1.1" 302 6721 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:27.280640-07:00 web-01 haproxy[900]: 203.113.110.161:32254 [56527] http-in app/api-07 6357/0/375/375/6357 404 14125 - - ---- 146/146/94/94/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:26:27.371512-07:00 db-primary app[30033]: INFO worker 75 picked job 992a5e233daf4479 from queue emails 2026-10-09T13:26:27.391394-07:00 db-replica haproxy[932]: 172.55.173.139:49598 [83107] http-in app/api-08 6396/0/624/624/6396 502 65633 - - ---- 145/145/71/71/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:26:27.473271-07:00 worker-12 app[30607]: INFO order 40840 confirmed for backup in 3102 ms (region eu-west-1, queue webhooks) 2026-10-09T13:26:27.940710-07:00 bastion nginx[1200]: 203.52.228.212 - françois "POST /login HTTP/1.1" 301 78802 "-" "kube-probe/1.31" 2026-10-09T13:26:28.064250-07:00 web-02 app[30425]: INFO health check ok: db 701 ms, cache 701 ms, queue depth 42 2026-10-09T13:26:28.074701-07:00 db-replica app[30615]: WARN retrying upstream 45.33.53.165:41193 after timeout (2574 ms), attempt 2 of 3 2026-10-09T13:26:28.131673-07:00 db-primary app[30329]: INFO worker 79 picked job 07d4b35814cd6b9f from queue invoices 2026-10-09T13:26:28.693803-07:00 web-03 app[30795]: INFO worker 52 finished job 34e6f35f742e56ef in 8662 ms 2026-10-09T13:26:28.934033-07:00 edge-fr-1 sshd[35864]: Connection closed by 10.75.211.43 port 35889 [preauth] 2026-10-09T13:26:28.944384-07:00 worker-12 systemd[1]: Started Session 60310 of User deploy. 2026-10-09T13:26:29.119396-07:00 worker-12 sshd[40003]: Invalid user akira from 192.110.37.111 port 40695 2026-10-09T13:26:29.152598-07:00 cache-3 sshd[48122]: Accepted publickey for sørensen from 203.92.18.194 port 12627 ssh2: ED25519 SHA256:88d9042faaea11e5 2026-10-09T13:26:29.427553-07:00 web-02 app[30184]: INFO request_id=d20a4432f5cc209f method=GET path=/api/v2/search?q=invoice status=502 duration=2389ms 2026-10-09T13:26:29.449131-07:00 web-03 sshd[26110]: Failed password for invalid user priya from 192.91.97.32 port 14165 ssh2 2026-10-09T13:26:29.541846-07:00 api-08 sshd[1505]: Accepted publickey for sørensen from 45.237.63.164 port 32434 ssh2: ED25519 SHA256:2571765cc76fd30c 2026-10-09T13:26:29.889975-07:00 api-07 sshd[54042]: pam_unix(sshd:session): session opened for user root(uid=1549) by (uid=0) 2026-10-09T13:26:29.923223-07:00 edge-fr-1 app[30533]: INFO order 82444 confirmed for sørensen in 1173 ms (region us-east-1, queue invoices) 2026-10-09T13:26:29.924114-07:00 bastion app[30692]: DEBUG cache hit ratio 79% over the last minute (47317 lookups) 2026-10-09T13:26:30.089013-07:00 api-08 nginx[1202]: 192.225.159.109 - - "GET /metrics HTTP/1.1" 401 26516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:30.246678-07:00 db-replica app[30412]: INFO worker 20 picked job 4e40f483369ca21d from queue webhooks 2026-10-09T13:26:30.254315-07:00 bastion app[30811]: INFO request_id=a2a4c71c6f33ab1b method=GET path=/static/app.js status=200 duration=8079ms 2026-10-09T13:26:30.265344-07:00 api-07 haproxy[949]: 45.6.143.141:12342 [61176] http-in app/cache-3 3498/0/871/871/3498 302 35215 - - ---- 112/112/20/20/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:26:30.352010-07:00 edge-fr-1 nginx[1200]: 10.48.158.23 - - "GET /static/main.css HTTP/1.1" 502 15078 "-" "python-requests/2.32.3" 2026-10-09T13:26:30.476464-07:00 db-replica app[30645]: INFO worker 54 finished job 46ec1de26291e237 in 5031 ms 2026-10-09T13:26:30.515474-07:00 web-01 nginx[1203]: 91.226.73.33 - - "GET /static/app.js HTTP/1.1" 502 34541 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:30.572296-07:00 web-01 nginx[1204]: 45.183.66.15 - - "GET /login HTTP/1.1" 302 23805 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:30.701166-07:00 web-01 app[30219]: INFO order 45074 confirmed for priya in 2512 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:26:30.783973-07:00 db-primary nginx[1210]: 10.167.109.229 - - "GET /wp-login.php HTTP/1.1" 502 65732 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:30.901771-07:00 bastion nginx[1210]: 45.55.74.43 - müller "POST /.env HTTP/1.1" 200 66254 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:30.930276-07:00 db-primary systemd[1]: session-34606.scope: Deactivated successfully. 2026-10-09T13:26:30.992051-07:00 api-07 sshd[13039]: Failed password for invalid user deploy from 203.86.132.77 port 38158 ssh2 2026-10-09T13:26:31.113555-07:00 web-01 postgres[23600]: LOG: duration: 8003.21 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:31.192126-07:00 web-03 nginx[1203]: 10.174.19.42 - - "GET /static/app.js HTTP/1.1" 204 80529 "-" "curl/8.4.0" 2026-10-09T13:26:31.257918-07:00 api-08 app[30836]: INFO worker 90 finished job f93f902c914ac562 in 7274 ms 2026-10-09T13:26:31.354417-07:00 api-07 cron[34346]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:26:31.441835-07:00 edge-fr-1 nginx[1210]: 192.121.134.53 - - "GET /health HTTP/1.1" 200 76808 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:31.557983-07:00 api-07 app[30758]: ERROR payment declined for order 26844: card_declined (code 33), customer notified 2026-10-09T13:26:31.615694-07:00 api-07 sshd[41463]: Failed password for invalid user priya from 203.15.239.127 port 28050 ssh2 2026-10-09T13:26:31.785367-07:00 cache-3 app[30216]: INFO request_id=02a28a4433f265e9 method=GET path=/metrics status=401 duration=1032ms 2026-10-09T13:26:31.844876-07:00 worker-12 nginx[1201]: 10.67.200.220 - backup "POST /wp-login.php HTTP/1.1" 302 51040 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:31.900129-07:00 cache-3 kubelet[800]: I1009 13:26:31.894166 4895 kubelet.go:4895] "Pod is terminating, skipping pod status update" pod="default/api-a8324a714371144f" 2026-10-09T13:26:31.931309-07:00 web-02 sshd[64403]: Accepted publickey for backup from 192.27.216.117 port 35571 ssh2: ED25519 SHA256:f038a78dc7030629 2026-10-09T13:26:31.955472-07:00 web-02 nginx[1207]: 45.194.171.138 - - "GET /login HTTP/1.1" 200 47877 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:32.070981-07:00 db-primary app[30804]: INFO order 99841 confirmed for akira in 2768 ms (region eu-west-1, queue invoices) 2026-10-09T13:26:32.256241-07:00 api-08 nginx[1202]: 91.25.193.26 - françois "POST /api/v2/search?q=invoice HTTP/1.1" 500 41764 "-" "Go-http-client/1.1" 2026-10-09T13:26:32.287062-07:00 db-replica app[30200]: INFO worker 35 finished job a6a9893ef369ce38 in 3026 ms 2026-10-09T13:26:32.364595-07:00 web-01 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:26:32.495935-07:00 worker-12 app[30621]: INFO health check ok: db 193 ms, cache 193 ms, queue depth 68 2026-10-09T13:26:32.571712-07:00 api-07 sshd[5459]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:26:32.747574-07:00 bastion haproxy[919]: 203.201.74.92:39620 [71474] http-in app/db-primary 9979/0/934/934/9979 302 8615 - - ---- 930/930/50/50/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:26:32.982377-07:00 api-07 app[30918]: INFO order 44228 confirmed for backup in 14 ms (region eu-west-1, queue invoices) 2026-10-09T13:26:33.223419-07:00 web-02 sshd[37394]: Connection closed by 91.26.219.171 port 27879 [preauth] 2026-10-09T13:26:33.241832-07:00 db-primary app[30666]: INFO request_id=0bdb4fd0941fb393 method=GET path=/api/v2/orders status=200 duration=985ms 2026-10-09T13:26:33.550916-07:00 web-01 app[30719]: INFO request_id=10043195fbf44c9b method=GET path=/static/main.css status=404 duration=7843ms 2026-10-09T13:26:33.912773-07:00 web-02 nginx[1204]: 172.157.255.219 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 52649 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:33.997159-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577593.691:21067): pid=21067 uid=0 auid=4475 ses=450 msg='op=login id=4475 exe="/usr/sbin/sshd" hostname=? addr=45.210.25.133 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:34.119790-07:00 bastion app[30185]: WARN retrying upstream 192.231.241.95:28555 after timeout (7624 ms), attempt 2 of 3 2026-10-09T13:26:34.312064-07:00 bastion app[30603]: INFO order 44850 confirmed for priya in 4577 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:34.403317-07:00 web-01 nginx[1208]: 192.51.36.139 - - "GET /metrics HTTP/1.1" 401 66537 "-" "kube-probe/1.31" 2026-10-09T13:26:34.405653-07:00 web-03 sshd[45088]: Invalid user ci from 45.224.84.239 port 30952 2026-10-09T13:26:34.475429-07:00 api-07 nginx[1210]: 192.126.187.110 - - "GET /api/v2/orders HTTP/1.1" 200 5669 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:34.486664-07:00 api-08 app[30567]: INFO order 28662 confirmed for deploy in 4136 ms (region us-east-1, queue webhooks) 2026-10-09T13:26:34.530766-07:00 web-02 app[30821]: INFO worker 73 finished job e458c7716ed200fc in 3878 ms 2026-10-09T13:26:34.702116-07:00 web-01 haproxy[948]: 172.196.102.136:4593 [82401] http-in app/web-01 3511/0/863/863/3511 200 43345 - - ---- 448/448/68/68/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:26:34.851819-07:00 web-02 kernel: [30690.086318] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.106.80.15 DST=10.0.600.600 LEN=85 TOS=0x00 PREC=0x00 TTL=85 ID=30690 DF PROTO=TCP SPT=18521 DPT=18521 WINDOW=30690 RES=0x00 SYN URGP=0 2026-10-09T13:26:35.138839-07:00 cache-3 app[30411]: INFO request_id=73f1b8c6779d151b method=GET path=/.env status=502 duration=9601ms 2026-10-09T13:26:35.196221-07:00 web-02 postgres[12952]: LOG: duration: 3858.916 ms statement: SELECT * FROM orders WHERE customer_id = 25868 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:35.452248-07:00 web-01 app[30776]: INFO worker 11 finished job 69d7f7f73393830d in 5309 ms 2026-10-09T13:26:35.515810-07:00 api-07 sshd[3563]: pam_unix(sshd:session): session opened for user deploy(uid=6650) by (uid=0) 2026-10-09T13:26:35.695170-07:00 db-primary nginx[1200]: 10.210.76.13 - - "GET /.env HTTP/1.1" 200 15561 "-" "Go-http-client/1.1" 2026-10-09T13:26:35.899118-07:00 edge-fr-1 app[30802]: INFO order 13099 confirmed for müller in 7521 ms (region eu-west-1, queue emails) 2026-10-09T13:26:36.017031-07:00 edge-fr-1 haproxy[942]: 172.41.116.103:60835 [55790] http-in app/cache-3 6019/0/126/126/6019 200 14700 - - ---- 685/685/92/92/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:26:36.035739-07:00 web-03 nginx[1205]: 203.15.84.235 - - "GET /static/app.js HTTP/1.1" 500 85366 "-" "python-requests/2.32.3" 2026-10-09T13:26:36.188258-07:00 api-07 sshd[41318]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:26:36.417370-07:00 web-02 app[30607]: INFO request_id=52f8aea85b7e3c5e method=GET path=/.env status=302 duration=728ms 2026-10-09T13:26:36.523169-07:00 web-03 sshd[59318]: Accepted publickey for deploy from 10.253.76.253 port 10891 ssh2: ED25519 SHA256:04158f5277807760 2026-10-09T13:26:36.579267-07:00 api-07 postgres[4970]: LOG: duration: 7828.949 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:36.605539-07:00 cache-3 sshd[42313]: Received disconnect from 203.34.71.191 port 65422:11: Bye Bye [preauth] 2026-10-09T13:26:36.734315-07:00 db-replica app[30218]: INFO order 40243 confirmed for akira in 1273 ms (region us-east-1, queue invoices) 2026-10-09T13:26:37.015590-07:00 api-07 sshd[8806]: Accepted publickey for deploy from 192.90.173.193 port 15789 ssh2: ED25519 SHA256:8e537088a390f19d 2026-10-09T13:26:37.161752-07:00 db-replica app[30943]: INFO worker 44 picked job 4867234416fbf3ba from queue orders 2026-10-09T13:26:37.201267-07:00 web-03 app[30393]: INFO request_id=a6f699abd4c20305 method=GET path=/.env status=200 duration=7055ms 2026-10-09T13:26:37.234665-07:00 cache-3 kernel: [59002.190818] TCP: request_sock_TCP: Possible SYN flooding on port 8067. Sending cookies. Check SNMP counters. 2026-10-09T13:26:37.319965-07:00 cache-3 haproxy[943]: 10.83.114.102:33440 [29944] http-in app/web-02 8534/0/408/408/8534 404 5190 - - ---- 826/826/98/98/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:26:37.396209-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577597.911:24413): pid=24413 uid=0 auid=7627 ses=913 msg='op=login id=7627 exe="/usr/sbin/sshd" hostname=? addr=10.160.245.25 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:37.882305-07:00 cache-3 cron[52310]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:26:38.065545-07:00 edge-fr-1 nginx[1205]: 91.189.163.79 - root "POST /login HTTP/1.1" 200 72291 "-" "kube-probe/1.31" 2026-10-09T13:26:38.113870-07:00 web-01 nginx[1210]: 203.105.172.73 - - "GET /api/v2/users HTTP/1.1" 200 62463 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:38.235779-07:00 web-01 sshd[20389]: Failed password for invalid user akira from 91.26.213.39 port 44627 ssh2 2026-10-09T13:26:38.457419-07:00 db-replica haproxy[923]: 203.139.201.91:19198 [97282] http-in app/worker-12 1853/0/797/797/1853 500 57104 - - ---- 734/734/44/44/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:26:38.672469-07:00 api-08 nginx[1201]: 203.39.35.187 - - "GET /.env HTTP/1.1" 502 18356 "-" "kube-probe/1.31" 2026-10-09T13:26:38.787982-07:00 api-08 nginx[1200]: 203.220.125.105 - - "GET /metrics HTTP/1.1" 404 83774 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:38.907925-07:00 worker-12 cron[13145]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:26:39.009389-07:00 cache-3 nginx[1208]: 203.6.31.233 - - "GET /admin HTTP/1.1" 302 22455 "-" "curl/8.4.0" 2026-10-09T13:26:39.106833-07:00 api-07 app[30481]: INFO worker 31 picked job 8c2da79a5155e17d from queue orders 2026-10-09T13:26:39.218860-07:00 cache-3 sshd[8329]: Accepted publickey for deploy from 10.24.71.72 port 53476 ssh2: ED25519 SHA256:cde3b542d19987e6 2026-10-09T13:26:39.315025-07:00 web-01 systemd[1]: Started Session 47608 of User root. 2026-10-09T13:26:39.528998-07:00 cache-3 haproxy[900]: 10.230.178.26:36558 [59268] http-in app/db-replica 802/0/44/44/802 200 11068 - - ---- 729/729/52/52/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:26:39.538009-07:00 bastion app[30814]: INFO health check ok: db 458 ms, cache 458 ms, queue depth 75 2026-10-09T13:26:39.644852-07:00 web-03 nginx[1206]: 203.107.155.3 - - "GET /wp-login.php HTTP/1.1" 200 73619 "-" "curl/8.4.0" 2026-10-09T13:26:39.695962-07:00 edge-fr-1 app[30189]: INFO worker 39 finished job 812c39da2b36c38f in 9863 ms 2026-10-09T13:26:39.716315-07:00 web-01 dockerd[700]: time="2026-10-09T13:26:39.716315-07:00" level=info msg="Container 41a8777709997627 exited with code 0" 2026-10-09T13:26:39.754454-07:00 web-01 sshd[18168]: pam_unix(sshd:session): session opened for user deploy(uid=5413) by (uid=0) 2026-10-09T13:26:39.926421-07:00 web-03 app[30502]: INFO worker 38 finished job f53db4ef7fac3989 in 9950 ms 2026-10-09T13:26:40.253783-07:00 db-replica nginx[1210]: 45.16.26.96 - - "GET /favicon.ico HTTP/1.1" 500 421 "-" "python-requests/2.32.3" 2026-10-09T13:26:40.426124-07:00 web-03 nginx[1201]: 45.216.214.175 - - "GET /metrics HTTP/1.1" 401 74319 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:40.502586-07:00 web-01 app[30221]: INFO order 83165 confirmed for müller in 1142 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:40.705660-07:00 worker-12 app[30273]: INFO request_id=bb63f140ce03e4e2 method=GET path=/login status=404 duration=3246ms 2026-10-09T13:26:41.011620-07:00 web-03 sshd[50799]: Connection closed by 45.64.132.210 port 18192 [preauth] 2026-10-09T13:26:41.240175-07:00 web-01 app[30668]: INFO worker 96 picked job ff507fead6f51579 from queue orders 2026-10-09T13:26:41.248479-07:00 api-08 nginx[1208]: 10.245.101.160 - priya "POST /api/v2/users HTTP/1.1" 302 26705 "-" "kube-probe/1.31" 2026-10-09T13:26:41.428892-07:00 bastion sshd[7811]: Connection closed by 10.140.138.159 port 62453 [preauth] 2026-10-09T13:26:41.438069-07:00 api-08 dockerd[700]: time="2026-10-09T13:26:41.438069-07:00" level=info msg="Container d5b4b5b6fe8a835d exited with code 0" 2026-10-09T13:26:42.063193-07:00 web-03 app[30484]: INFO order 95829 confirmed for sørensen in 2067 ms (region eu-west-1, queue invoices) 2026-10-09T13:26:42.537705-07:00 cache-3 nginx[1208]: 10.25.29.196 - - "GET /.env HTTP/1.1" 204 50994 "-" "curl/8.4.0" 2026-10-09T13:26:42.540666-07:00 api-08 app[30716]: INFO order 71238 confirmed for ci in 4182 ms (region ap-northeast-1, queue orders) 2026-10-09T13:26:42.714097-07:00 edge-fr-1 app[30072]: INFO order 62391 confirmed for ci in 6543 ms (region ap-northeast-1, queue emails) 2026-10-09T13:26:42.721599-07:00 web-03 nginx[1203]: 192.193.115.215 - - "GET /static/main.css HTTP/1.1" 200 66769 "-" "curl/8.4.0" 2026-10-09T13:26:42.722896-07:00 api-08 app[30173]: INFO worker 57 picked job 5ae94c2a03e80251 from queue emails 2026-10-09T13:26:42.730147-07:00 web-03 nginx[1207]: 10.213.147.17 - - "GET /wp-login.php HTTP/1.1" 301 29379 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:42.791818-07:00 cache-3 haproxy[915]: 10.119.106.138:10863 [38956] http-in app/bastion 3018/0/419/419/3018 502 47591 - - ---- 692/692/68/68/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:26:43.090650-07:00 edge-fr-1 app[30501]: INFO request_id=3df158c65bb7a68a method=GET path=/api/v2/search?q=invoice status=502 duration=5901ms 2026-10-09T13:26:43.172295-07:00 db-primary app[30891]: INFO worker 41 picked job dbad56e5cbf92c7f from queue invoices 2026-10-09T13:26:43.175999-07:00 api-07 haproxy[905]: 91.43.24.102:47946 [93298] http-in app/web-01 7675/0/77/77/7675 502 77490 - - ---- 178/178/81/81/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:26:43.274005-07:00 worker-12 sshd[28748]: Invalid user françois from 10.203.242.82 port 62030 2026-10-09T13:26:43.339562-07:00 worker-12 haproxy[950]: 10.184.177.151:17580 [78709] http-in app/api-08 8102/0/960/960/8102 200 29502 - - ---- 879/879/34/34/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:26:43.369295-07:00 web-02 nginx[1204]: 203.41.202.47 - - "GET /api/v2/users HTTP/1.1" 500 10565 "-" "python-requests/2.32.3" 2026-10-09T13:26:43.776306-07:00 web-01 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:26:43.798526-07:00 web-03 cron[19759]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:26:43.970773-07:00 web-01 app[30349]: INFO worker 90 finished job eaed8739d9d8f1b0 in 2391 ms 2026-10-09T13:26:43.987920-07:00 worker-12 sshd[23511]: Received disconnect from 192.151.103.22 port 9619:11: Bye Bye [preauth] 2026-10-09T13:26:44.018740-07:00 web-03 nginx[1204]: 203.120.136.204 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 39082 "-" "Go-http-client/1.1" 2026-10-09T13:26:44.041051-07:00 db-primary app[30118]: INFO request_id=dc96649f17372d68 method=GET path=/api/v2/search?q=invoice status=200 duration=865ms 2026-10-09T13:26:44.062319-07:00 web-03 sshd[59543]: Invalid user sørensen from 45.136.185.89 port 32844 2026-10-09T13:26:44.069637-07:00 cache-3 app[30208]: INFO health check ok: db 211 ms, cache 211 ms, queue depth 68 2026-10-09T13:26:44.108450-07:00 api-08 sshd[64563]: pam_unix(sshd:session): session opened for user müller(uid=2703) by (uid=0) 2026-10-09T13:26:44.122283-07:00 web-01 app[30051]: INFO request_id=8a8ae567c2c1967d method=GET path=/static/app.js status=502 duration=9595ms 2026-10-09T13:26:44.186475-07:00 cache-3 haproxy[920]: 203.84.105.225:22208 [44485] http-in app/db-replica 8513/0/758/758/8513 500 32625 - - ---- 305/305/71/71/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:26:44.294894-07:00 edge-fr-1 nginx[1202]: 45.118.114.208 - - "GET /metrics HTTP/1.1" 204 6929 "-" "Go-http-client/1.1" 2026-10-09T13:26:44.333777-07:00 db-primary app[30660]: INFO health check ok: db 379 ms, cache 379 ms, queue depth 37 2026-10-09T13:26:44.349438-07:00 cache-3 systemd[1]: session-75120.scope: Deactivated successfully. 2026-10-09T13:26:44.538544-07:00 web-02 nginx[1201]: 45.218.253.238 - - "GET /metrics HTTP/1.1" 200 28266 "-" "Go-http-client/1.1" 2026-10-09T13:26:45.020835-07:00 db-replica systemd[1]: Started Session 66060 of User deploy. 2026-10-09T13:26:45.077825-07:00 api-08 app[30032]: INFO worker 14 picked job 4605a445919ac64e from queue orders 2026-10-09T13:26:45.120788-07:00 web-01 app[30089]: INFO request_id=f89a76f4fb1012c0 method=GET path=/static/main.css status=200 duration=4186ms 2026-10-09T13:26:45.210745-07:00 worker-12 kernel: [85388.394356] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.121.178.138 DST=10.0.482.482 LEN=94 TOS=0x00 PREC=0x00 TTL=94 ID=85388 DF PROTO=TCP SPT=43375 DPT=43375 WINDOW=85388 RES=0x00 SYN URGP=0 2026-10-09T13:26:45.308045-07:00 bastion systemd[1]: session-95877.scope: Deactivated successfully. 2026-10-09T13:26:45.416181-07:00 bastion nginx[1204]: 203.12.29.93 - - "GET /favicon.ico HTTP/1.1" 502 62648 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:45.489435-07:00 api-07 nginx[1206]: 10.187.117.143 - - "GET /api/v2/orders HTTP/1.1" 302 83984 "-" "kube-probe/1.31" 2026-10-09T13:26:45.511360-07:00 cache-3 sshd[860]: Accepted publickey for backup from 91.10.207.109 port 34967 ssh2: ED25519 SHA256:eb7b40da143b13da 2026-10-09T13:26:45.881752-07:00 bastion app[30183]: INFO order 47614 confirmed for akira in 1285 ms (region eu-west-1, queue orders) 2026-10-09T13:26:46.138712-07:00 db-primary sshd[44995]: Failed password for invalid user zoë from 45.226.126.200 port 29100 ssh2 2026-10-09T13:26:46.319599-07:00 web-01 nginx[1208]: 203.163.186.62 - akira "POST /api/v2/orders/8841 HTTP/1.1" 200 37679 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:46.430251-07:00 api-07 nginx[1201]: 10.113.108.238 - - "GET /wp-login.php HTTP/1.1" 404 4450 "-" "python-requests/2.32.3" 2026-10-09T13:26:46.485370-07:00 edge-fr-1 app[30831]: INFO worker 96 finished job b43e17907157284e in 758 ms 2026-10-09T13:26:46.589054-07:00 db-replica systemd[1]: session-82692.scope: Deactivated successfully. 2026-10-09T13:26:46.629698-07:00 db-primary nginx[1209]: 172.239.236.83 - - "GET /.env HTTP/1.1" 204 67686 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:46.822415-07:00 db-primary sshd[43792]: Invalid user ci from 203.51.130.111 port 59046 2026-10-09T13:26:47.040098-07:00 web-03 app[30313]: DEBUG cache hit ratio 2% over the last minute (38890 lookups) 2026-10-09T13:26:47.176605-07:00 edge-fr-1 app[30338]: INFO request_id=12e6bf4eb7ff7c58 method=GET path=/api/v2/search?q=invoice status=301 duration=9680ms 2026-10-09T13:26:47.338625-07:00 api-07 app[30444]: INFO health check ok: db 409 ms, cache 409 ms, queue depth 85 2026-10-09T13:26:47.571977-07:00 db-primary nginx[1203]: 45.69.160.64 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 37489 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:47.690890-07:00 worker-12 postgres[16203]: LOG: duration: 8794.626 ms statement: SELECT * FROM orders WHERE customer_id = 68785 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:26:47.731113-07:00 db-replica nginx[1201]: 192.163.181.224 - müller "POST /admin HTTP/1.1" 401 20120 "-" "curl/8.4.0" 2026-10-09T13:26:47.761161-07:00 web-03 kernel: [63910.798154] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.104.238.244 DST=10.0.973.973 LEN=35 TOS=0x00 PREC=0x00 TTL=35 ID=63910 DF PROTO=TCP SPT=40592 DPT=40592 WINDOW=63910 RES=0x00 SYN URGP=0 2026-10-09T13:26:47.770314-07:00 edge-fr-1 postgres[27130]: LOG: duration: 3817.810 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:47.810885-07:00 worker-12 sshd[19349]: pam_unix(sshd:session): session opened for user ci(uid=8548) by (uid=0) 2026-10-09T13:26:47.868798-07:00 web-02 postgres[17436]: LOG: duration: 2487.825 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:47.918962-07:00 db-primary app[30615]: INFO request_id=5d44b96ee52bb5df method=GET path=/api/v2/orders/8841 status=200 duration=560ms 2026-10-09T13:26:48.030592-07:00 web-02 nginx[1208]: 45.75.236.88 - françois "POST /health HTTP/1.1" 302 77895 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:48.114568-07:00 db-replica sshd[55090]: Accepted publickey for akira from 192.100.169.225 port 18008 ssh2: ED25519 SHA256:d824b00293e4545b 2026-10-09T13:26:48.169315-07:00 cache-3 nginx[1208]: 45.248.184.155 - müller "POST /api/v2/search?q=invoice HTTP/1.1" 200 78677 "-" "curl/8.4.0" 2026-10-09T13:26:48.429556-07:00 web-01 app[30654]: INFO request_id=b6c84da78b42e2f1 method=GET path=/api/v2/users status=200 duration=1916ms 2026-10-09T13:26:48.529379-07:00 api-07 haproxy[935]: 192.5.2.178:16097 [46922] http-in app/edge-fr-1 5632/0/299/299/5632 301 32601 - - ---- 729/729/31/31/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:26:48.620424-07:00 web-01 nginx[1204]: 192.17.70.17 - - "GET /static/main.css HTTP/1.1" 401 48543 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:48.784616-07:00 web-03 nginx[1205]: 10.246.111.123 - - "GET /api/v2/orders HTTP/1.1" 200 59579 "-" "python-requests/2.32.3" 2026-10-09T13:26:48.859884-07:00 api-08 app[30092]: INFO request_id=14beb283d34f4267 method=GET path=/health status=200 duration=6247ms 2026-10-09T13:26:49.032147-07:00 web-02 sshd[52347]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:26:49.041461-07:00 bastion nginx[1203]: 192.92.35.242 - - "GET /static/main.css HTTP/1.1" 500 33404 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:49.179987-07:00 db-primary app[30663]: INFO request_id=e19224c72eb08bb2 method=GET path=/health status=200 duration=2053ms 2026-10-09T13:26:49.197871-07:00 api-08 haproxy[949]: 10.211.35.134:37407 [73725] http-in app/api-07 8359/0/594/594/8359 200 59183 - - ---- 401/401/65/65/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:26:49.232794-07:00 cache-3 app[30141]: INFO worker 89 picked job e605c0107d606a79 from queue invoices 2026-10-09T13:26:49.469985-07:00 api-08 nginx[1200]: 10.106.18.38 - - "GET /wp-login.php HTTP/1.1" 401 41615 "-" "Go-http-client/1.1" 2026-10-09T13:26:49.485374-07:00 cache-3 app[30473]: INFO request_id=e460ed37e9b373ef method=GET path=/static/app.js status=404 duration=2513ms 2026-10-09T13:26:49.568226-07:00 bastion app[30219]: INFO worker 13 picked job 8311b6d8f4cf0092 from queue invoices 2026-10-09T13:26:49.799148-07:00 worker-12 app[30993]: INFO worker 78 picked job 21edf1edb9904772 from queue orders 2026-10-09T13:26:49.819807-07:00 db-primary sshd[54533]: Connection closed by 203.67.110.140 port 56793 [preauth] 2026-10-09T13:26:49.853921-07:00 edge-fr-1 app[30427]: INFO request_id=e3d292fba6493322 method=GET path=/favicon.ico status=404 duration=3140ms 2026-10-09T13:26:50.034334-07:00 api-07 nginx[1201]: 172.219.74.93 - - "GET /login HTTP/1.1" 204 41934 "-" "curl/8.4.0" 2026-10-09T13:26:50.054448-07:00 worker-12 sshd[42005]: Invalid user zoë from 192.136.120.66 port 7409 2026-10-09T13:26:50.132304-07:00 api-08 sshd[3827]: Accepted publickey for sørensen from 192.106.137.175 port 36230 ssh2: ED25519 SHA256:af1b120d86daaea5 2026-10-09T13:26:50.183291-07:00 web-03 nginx[1206]: 45.73.146.47 - müller "POST /metrics HTTP/1.1" 200 62477 "-" "kube-probe/1.31" 2026-10-09T13:26:50.242372-07:00 web-01 app[30081]: INFO order 99016 confirmed for deploy in 8061 ms (region eu-west-1, queue emails) 2026-10-09T13:26:50.255797-07:00 bastion app[30378]: INFO worker 35 picked job c97f970d00198240 from queue webhooks 2026-10-09T13:26:50.291366-07:00 api-07 nginx[1205]: 192.27.214.99 - - "GET /health HTTP/1.1" 404 21061 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:50.374852-07:00 api-08 app[30343]: INFO worker 47 finished job d3055acd0bc40b85 in 2514 ms 2026-10-09T13:26:50.419468-07:00 web-02 app[30486]: INFO worker 28 picked job dff3afe28ad2d9b5 from queue orders 2026-10-09T13:26:50.591447-07:00 web-03 app[30420]: INFO health check ok: db 723 ms, cache 723 ms, queue depth 57 2026-10-09T13:26:50.883991-07:00 db-replica sshd[31655]: Connection closed by 203.44.122.59 port 21246 [preauth] 2026-10-09T13:26:50.913581-07:00 web-02 postgres[25159]: LOG: duration: 8102.216 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:51.082875-07:00 db-primary sshd[17227]: Received disconnect from 91.91.238.132 port 29577:11: Bye Bye [preauth] 2026-10-09T13:26:51.097632-07:00 bastion nginx[1201]: 192.102.175.210 - - "GET /favicon.ico HTTP/1.1" 200 11592 "-" "Go-http-client/1.1" 2026-10-09T13:26:51.302176-07:00 bastion app[30242]: INFO order 44878 confirmed for zoë in 4150 ms (region us-east-1, queue invoices) 2026-10-09T13:26:51.376123-07:00 db-replica app[30405]: INFO request_id=2a7f44ccd0e65f05 method=GET path=/wp-login.php status=502 duration=1541ms 2026-10-09T13:26:51.480489-07:00 web-01 systemd[1]: Started Session 79086 of User priya. 2026-10-09T13:26:51.562873-07:00 worker-12 nginx[1202]: 10.178.119.57 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 30465 "-" "kube-probe/1.31" 2026-10-09T13:26:51.682676-07:00 web-02 cron[1009]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:26:51.827658-07:00 worker-12 postgres[19036]: LOG: checkpoint complete: wrote 9846 buffers (13%); 0 WAL file(s) added, 0 removed, 31 recycled; write=5815.446 s, sync=0.446 s, total=5815.446 s 2026-10-09T13:26:51.923879-07:00 db-replica haproxy[924]: 203.32.102.73:2829 [62958] http-in app/worker-12 2054/0/557/557/2054 401 37898 - - ---- 324/324/11/11/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:26:52.042583-07:00 edge-fr-1 nginx[1203]: 192.234.109.141 - - "GET /wp-login.php HTTP/1.1" 301 42545 "-" "Go-http-client/1.1" 2026-10-09T13:26:52.119248-07:00 bastion haproxy[937]: 192.220.5.245:13259 [22205] http-in app/db-replica 2524/0/793/793/2524 401 22218 - - ---- 314/314/58/58/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:26:52.165316-07:00 db-primary nginx[1208]: 172.178.67.180 - - "GET /static/main.css HTTP/1.1" 404 64259 "-" "python-requests/2.32.3" 2026-10-09T13:26:52.461376-07:00 web-01 nginx[1204]: 192.145.122.112 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 67080 "-" "curl/8.4.0" 2026-10-09T13:26:52.550068-07:00 web-01 systemd[1]: session-92217.scope: Deactivated successfully. 2026-10-09T13:26:52.584156-07:00 web-02 sshd[44929]: Connection closed by 10.12.83.27 port 61905 [preauth] 2026-10-09T13:26:52.708126-07:00 cache-3 app[30711]: INFO worker 85 finished job 3b91a676acecfe86 in 3412 ms 2026-10-09T13:26:52.720745-07:00 web-02 app[30853]: INFO order 32635 confirmed for backup in 3154 ms (region eu-west-1, queue orders) 2026-10-09T13:26:52.951569-07:00 worker-12 systemd[1]: session-11428.scope: Deactivated successfully. 2026-10-09T13:26:53.064520-07:00 api-08 app[30164]: INFO request_id=d970c2e9ac546432 method=GET path=/.env status=302 duration=7680ms 2026-10-09T13:26:53.127184-07:00 web-01 app[30454]: DEBUG cache hit ratio 88% over the last minute (14227 lookups) 2026-10-09T13:26:53.177698-07:00 cache-3 app[30470]: INFO request_id=4fcf3c45c82b90a7 method=GET path=/api/v2/users status=200 duration=6870ms 2026-10-09T13:26:53.454569-07:00 web-03 nginx[1210]: 91.164.124.1 - - "GET /.env HTTP/1.1" 200 59782 "-" "python-requests/2.32.3" 2026-10-09T13:26:53.518397-07:00 web-01 haproxy[911]: 203.203.78.75:22639 [33872] http-in app/web-03 5154/0/803/803/5154 302 47238 - - ---- 633/633/48/48/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:26:53.665783-07:00 worker-12 sshd[5464]: Accepted publickey for françois from 45.25.22.128 port 47779 ssh2: ED25519 SHA256:2acbcb44ee42ecd1 2026-10-09T13:26:53.919194-07:00 db-primary nginx[1202]: 192.197.43.157 - - "GET /static/app.js HTTP/1.1" 200 62360 "-" "curl/8.4.0" 2026-10-09T13:26:54.191676-07:00 api-07 sshd[46781]: Invalid user root from 172.102.150.182 port 8390 2026-10-09T13:26:54.200467-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577614.455:88251): pid=88251 uid=0 auid=6097 ses=278 msg='op=login id=6097 exe="/usr/sbin/sshd" hostname=? addr=45.200.50.39 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:54.219448-07:00 api-07 nginx[1202]: 172.56.192.66 - - "GET /static/app.js HTTP/1.1" 200 20174 "-" "curl/8.4.0" 2026-10-09T13:26:54.437157-07:00 web-02 nginx[1206]: 203.96.172.151 - - "GET /favicon.ico HTTP/1.1" 500 34893 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:54.471059-07:00 web-02 nginx[1207]: 172.152.151.239 - - "GET /wp-login.php HTTP/1.1" 200 21810 "-" "Go-http-client/1.1" 2026-10-09T13:26:54.485008-07:00 worker-12 nginx[1210]: 203.105.206.127 - - "GET /.env HTTP/1.1" 200 39539 "-" "Go-http-client/1.1" 2026-10-09T13:26:54.629439-07:00 worker-12 sshd[14673]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:26:54.683259-07:00 edge-fr-1 app[30426]: DEBUG cache hit ratio 38% over the last minute (86900 lookups) 2026-10-09T13:26:54.706988-07:00 worker-12 nginx[1208]: 192.255.6.106 - - "GET /admin HTTP/1.1" 204 77066 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:26:54.796239-07:00 db-primary app[30809]: INFO order 45992 confirmed for priya in 6854 ms (region us-east-1, queue emails) 2026-10-09T13:26:54.842216-07:00 db-primary nginx[1203]: 10.179.219.172 - - "GET /login HTTP/1.1" 301 25210 "-" "python-requests/2.32.3" 2026-10-09T13:26:54.912864-07:00 web-02 postgres[6950]: LOG: duration: 5715.685 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:55.002967-07:00 db-primary nginx[1207]: 10.218.126.182 - - "GET /static/app.js HTTP/1.1" 404 23541 "-" "curl/8.4.0" 2026-10-09T13:26:55.135363-07:00 worker-12 app[30488]: INFO request_id=4253e4e184cde7a9 method=GET path=/api/v2/users status=500 duration=3394ms 2026-10-09T13:26:55.191461-07:00 cache-3 postgres[4675]: LOG: checkpoint complete: wrote 5090 buffers (22%); 0 WAL file(s) added, 0 removed, 36 recycled; write=7922.578 s, sync=0.578 s, total=7922.578 s 2026-10-09T13:26:55.258642-07:00 api-07 haproxy[930]: 203.214.123.214:43174 [20253] http-in app/api-07 8402/0/915/915/8402 200 71830 - - ---- 679/679/13/13/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:26:55.281178-07:00 api-08 app[30923]: INFO order 47034 confirmed for deploy in 9019 ms (region us-east-1, queue invoices) 2026-10-09T13:26:55.423311-07:00 db-primary postgres[26365]: LOG: duration: 5803.433 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:26:55.458244-07:00 worker-12 systemd[1]: Started Session 23046 of User priya. 2026-10-09T13:26:55.478831-07:00 edge-fr-1 haproxy[902]: 45.105.185.114:47007 [65915] http-in app/api-08 7016/0/704/704/7016 204 32087 - - ---- 988/988/98/98/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:26:55.605719-07:00 db-replica haproxy[927]: 45.198.153.111:52213 [75236] http-in app/bastion 9458/0/69/69/9458 200 65964 - - ---- 527/527/41/41/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:26:55.663845-07:00 db-primary app[30667]: INFO order 89864 confirmed for backup in 5521 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:26:55.796966-07:00 web-03 app[30564]: INFO request_id=cdcfeb9b11a48800 method=GET path=/api/v2/search?q=invoice status=500 duration=9335ms 2026-10-09T13:26:55.836885-07:00 bastion sshd[49749]: Connection closed by 172.238.48.65 port 25280 [preauth] 2026-10-09T13:26:55.949845-07:00 worker-12 nginx[1209]: 10.138.36.88 - - "GET /api/v2/users HTTP/1.1" 401 28339 "-" "kube-probe/1.31" 2026-10-09T13:26:56.061898-07:00 db-primary nginx[1208]: 203.33.52.204 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 502 5199 "-" "curl/8.4.0" 2026-10-09T13:26:56.132173-07:00 worker-12 nginx[1207]: 91.109.218.44 - sørensen "POST /admin HTTP/1.1" 200 64179 "-" "python-requests/2.32.3" 2026-10-09T13:26:56.135721-07:00 bastion kubelet[800]: I1009 13:26:56.303791 4690 kubelet.go:4690] "Pod is terminating, skipping pod status update" pod="default/api-cb3da64617345643" 2026-10-09T13:26:56.299711-07:00 bastion app[30692]: INFO worker 71 finished job c99796fbf8670473 in 9895 ms 2026-10-09T13:26:56.349433-07:00 edge-fr-1 nginx[1202]: 45.127.194.129 - - "GET /admin HTTP/1.1" 200 44974 "-" "python-requests/2.32.3" 2026-10-09T13:26:56.484408-07:00 web-01 nginx[1210]: 172.138.161.37 - - "GET /api/v2/users HTTP/1.1" 200 8430 "-" "curl/8.4.0" 2026-10-09T13:26:56.583035-07:00 edge-fr-1 nginx[1205]: 10.101.234.87 - ci "POST /api/v2/orders/8841 HTTP/1.1" 500 60991 "-" "python-requests/2.32.3" 2026-10-09T13:26:56.678280-07:00 web-02 nginx[1207]: 203.83.184.181 - zoë "POST /api/v2/search?q=invoice HTTP/1.1" 302 74723 "-" "curl/8.4.0" 2026-10-09T13:26:56.814146-07:00 api-07 systemd[1]: Started Session 60570 of User priya. 2026-10-09T13:26:57.094953-07:00 db-replica sshd[64999]: Received disconnect from 10.203.25.247 port 38373:11: Bye Bye [preauth] 2026-10-09T13:26:57.188719-07:00 db-replica sshd[21716]: Connection closed by 45.184.39.182 port 24494 [preauth] 2026-10-09T13:26:57.229888-07:00 worker-12 sshd[29476]: Connection closed by 192.7.174.105 port 56279 [preauth] 2026-10-09T13:26:57.548560-07:00 bastion nginx[1209]: 45.137.167.66 - ci "POST /static/app.js HTTP/1.1" 200 60314 "-" "curl/8.4.0" 2026-10-09T13:26:57.699015-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577617.675:19886): pid=19886 uid=0 auid=6947 ses=417 msg='op=login id=6947 exe="/usr/sbin/sshd" hostname=? addr=91.205.110.91 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:57.820975-07:00 web-01 nginx[1200]: 203.205.23.35 - - "GET /static/main.css HTTP/1.1" 200 60939 "-" "python-requests/2.32.3" 2026-10-09T13:26:57.847288-07:00 db-primary app[30756]: INFO order 73995 confirmed for root in 6876 ms (region eu-west-1, queue webhooks) 2026-10-09T13:26:58.045086-07:00 db-primary sshd[25026]: Accepted publickey for zoë from 192.96.179.131 port 7403 ssh2: ED25519 SHA256:9ca85f1f0292f88e 2026-10-09T13:26:58.115776-07:00 worker-12 app[30844]: INFO request_id=7e12455b9112335c method=GET path=/static/main.css status=502 duration=1101ms 2026-10-09T13:26:58.158855-07:00 api-07 haproxy[929]: 203.194.200.103:13633 [93540] http-in app/web-03 1359/0/99/99/1359 500 67131 - - ---- 722/722/30/30/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:26:58.382238-07:00 worker-12 nginx[1209]: 91.66.229.128 - root "POST /admin HTTP/1.1" 200 75116 "-" "python-requests/2.32.3" 2026-10-09T13:26:58.412016-07:00 api-08 app[30740]: INFO worker 23 finished job 0d8b8bf12b85b317 in 7785 ms 2026-10-09T13:26:58.438463-07:00 db-primary nginx[1205]: 91.235.196.120 - - "GET /wp-login.php HTTP/1.1" 502 4843 "-" "Go-http-client/1.1" 2026-10-09T13:26:58.612022-07:00 db-primary systemd[1]: Started Session 20099 of User sørensen. 2026-10-09T13:26:58.693029-07:00 api-07 systemd[1]: session-76039.scope: Deactivated successfully. 2026-10-09T13:26:58.799341-07:00 db-primary nginx[1206]: 10.237.62.197 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 25009 "-" "kube-probe/1.31" 2026-10-09T13:26:58.802495-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577618.513:74301): pid=74301 uid=0 auid=4189 ses=138 msg='op=login id=4189 exe="/usr/sbin/sshd" hostname=? addr=91.39.58.126 terminal=/dev/pts/0 res=success' 2026-10-09T13:26:58.993139-07:00 db-replica app[30900]: INFO health check ok: db 200 ms, cache 200 ms, queue depth 46 2026-10-09T13:26:59.084213-07:00 edge-fr-1 app[30946]: INFO request_id=bdf420e994a12f75 method=GET path=/api/v2/search?q=invoice status=200 duration=6219ms 2026-10-09T13:26:59.195654-07:00 web-03 systemd[1]: session-98673.scope: Deactivated successfully. 2026-10-09T13:26:59.226010-07:00 worker-12 app[30712]: INFO order 56227 confirmed for backup in 2930 ms (region eu-west-1, queue invoices) 2026-10-09T13:26:59.269296-07:00 web-01 app[30479]: INFO order 68757 confirmed for müller in 8008 ms (region us-east-1, queue emails) 2026-10-09T13:26:59.291282-07:00 db-primary app[30175]: DEBUG cache hit ratio 20% over the last minute (48403 lookups) 2026-10-09T13:26:59.393348-07:00 cache-3 sshd[6914]: pam_unix(sshd:session): session opened for user ci(uid=3545) by (uid=0) 2026-10-09T13:26:59.428829-07:00 bastion postgres[25847]: LOG: checkpoint complete: wrote 2067 buffers (84%); 0 WAL file(s) added, 0 removed, 38 recycled; write=6812.270 s, sync=0.270 s, total=6812.270 s 2026-10-09T13:26:59.752339-07:00 db-replica sshd[52584]: Invalid user deploy from 203.251.26.133 port 24162 2026-10-09T13:26:59.874335-07:00 bastion nginx[1207]: 45.87.130.143 - backup "POST /static/app.js HTTP/1.1" 301 86947 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:26:59.928912-07:00 api-08 app[30676]: INFO order 84072 confirmed for zoë in 2817 ms (region us-east-1, queue orders) 2026-10-09T13:27:00.208929-07:00 web-02 sshd[30725]: Accepted publickey for akira from 172.182.137.61 port 11539 ssh2: ED25519 SHA256:9ae9305aa6c56fd7 2026-10-09T13:27:00.360390-07:00 worker-12 nginx[1206]: 172.41.47.130 - - "GET /favicon.ico HTTP/1.1" 200 30070 "-" "curl/8.4.0" 2026-10-09T13:27:00.374375-07:00 cache-3 nginx[1205]: 45.220.147.193 - - "GET /static/app.js HTTP/1.1" 502 4184 "-" "Go-http-client/1.1" 2026-10-09T13:27:00.393088-07:00 db-replica postgres[16729]: LOG: duration: 49.247 ms statement: SELECT * FROM orders WHERE customer_id = 68348 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:00.501123-07:00 worker-12 sshd[21378]: Accepted publickey for ci from 192.251.178.13 port 41352 ssh2: ED25519 SHA256:8d151af4abf4d418 2026-10-09T13:27:00.552968-07:00 db-primary nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.32.122.111, server: app.example.com, request: "GET /api/v2/search?q=invoice HTTP/1.1", upstream: "http://10.0.307.307:8080/api/v2/search?q=invoice" 2026-10-09T13:27:00.581301-07:00 web-03 systemd[1]: Started Session 56977 of User ci. 2026-10-09T13:27:00.620386-07:00 cache-3 sshd[41971]: Invalid user backup from 45.86.0.191 port 51369 2026-10-09T13:27:00.649735-07:00 api-08 systemd[1]: Started Session 53656 of User zoë. 2026-10-09T13:27:00.701461-07:00 db-replica nginx[1204]: 10.185.255.163 - ci "POST /api/v2/orders/8841 HTTP/1.1" 200 25798 "-" "python-requests/2.32.3" 2026-10-09T13:27:01.115657-07:00 web-03 haproxy[900]: 45.89.83.104:44350 [47749] http-in app/db-primary 2622/0/125/125/2622 404 46925 - - ---- 171/171/56/56/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:27:01.166714-07:00 db-replica nginx[1210]: 203.215.112.136 - - "GET /health HTTP/1.1" 302 14576 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:01.216923-07:00 cache-3 nginx[1201]: 91.49.44.250 - ci "POST /.env HTTP/1.1" 502 24082 "-" "kube-probe/1.31" 2026-10-09T13:27:01.490756-07:00 cache-3 app[30787]: INFO request_id=31e3307df71237ef method=GET path=/api/v2/orders/8841 status=500 duration=8334ms 2026-10-09T13:27:01.784042-07:00 bastion systemd[1]: Started Session 24171 of User root. 2026-10-09T13:27:01.911308-07:00 worker-12 nginx[1206]: 203.220.122.21 - - "GET /wp-login.php HTTP/1.1" 200 88295 "-" "curl/8.4.0" 2026-10-09T13:27:01.976385-07:00 worker-12 sshd[44922]: Connection closed by 203.52.170.38 port 5492 [preauth] 2026-10-09T13:27:02.017861-07:00 db-primary app[30798]: INFO worker 18 finished job 4990220cbedde14e in 5815 ms 2026-10-09T13:27:02.036261-07:00 cache-3 nginx[1206]: 192.88.131.102 - root "POST /login HTTP/1.1" 404 4856 "-" "python-requests/2.32.3" 2026-10-09T13:27:02.044541-07:00 db-primary postgres[17727]: LOG: duration: 2723.916 ms statement: SELECT * FROM orders WHERE customer_id = 87905 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:02.366144-07:00 api-07 nginx[1202]: 192.177.151.91 - - "GET /admin HTTP/1.1" 200 54855 "-" "curl/8.4.0" 2026-10-09T13:27:02.504974-07:00 web-01 haproxy[946]: 10.227.33.181:39325 [20998] http-in app/bastion 8919/0/471/471/8919 200 85055 - - ---- 427/427/90/90/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:27:02.581065-07:00 edge-fr-1 nginx[1209]: 203.14.130.130 - zoë "POST /api/v2/orders/8841 HTTP/1.1" 301 13082 "-" "kube-probe/1.31" 2026-10-09T13:27:02.833428-07:00 web-03 app[30129]: INFO worker 84 picked job 39b8470da7f59b8d from queue emails 2026-10-09T13:27:03.243077-07:00 edge-fr-1 postgres[31764]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 13461 remain, 6994 scanned (10% of total) 2026-10-09T13:27:03.282830-07:00 edge-fr-1 app[30204]: INFO order 81893 confirmed for sørensen in 4856 ms (region eu-west-1, queue orders) 2026-10-09T13:27:03.393325-07:00 db-replica nginx[1201]: 172.218.245.47 - - "GET /admin HTTP/1.1" 200 71406 "-" "curl/8.4.0" 2026-10-09T13:27:03.672623-07:00 cache-3 postgres[28256]: LOG: duration: 9377.423 ms statement: SELECT * FROM orders WHERE customer_id = 41373 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:03.757586-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577623.915:11477): pid=11477 uid=0 auid=7613 ses=806 msg='op=login id=7613 exe="/usr/sbin/sshd" hostname=? addr=172.156.129.10 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:03.789083-07:00 api-07 haproxy[908]: 172.151.131.65:37501 [33968] http-in app/db-replica 5329/0/444/444/5329 204 72878 - - ---- 917/917/39/39/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:27:03.866667-07:00 cache-3 nginx[1201]: 10.53.74.120 - - "GET /health HTTP/1.1" 200 85513 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:03.905956-07:00 web-02 sshd[64135]: Received disconnect from 10.242.44.95 port 9058:11: Bye Bye [preauth] 2026-10-09T13:27:04.157829-07:00 web-02 sshd[17056]: Connection closed by 172.20.86.234 port 57766 [preauth] 2026-10-09T13:27:04.194106-07:00 api-08 app[30067]: INFO worker 63 picked job 99c61938b625321c from queue orders 2026-10-09T13:27:04.577120-07:00 web-02 nginx[1209]: 45.75.174.36 - - "GET /static/main.css HTTP/1.1" 200 56597 "-" "curl/8.4.0" 2026-10-09T13:27:04.601266-07:00 web-02 haproxy[936]: 172.63.110.100:4094 [60417] http-in app/db-primary 5308/0/288/288/5308 200 46420 - - ---- 154/154/13/13/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:27:04.776739-07:00 cache-3 postgres[19466]: LOG: duration: 8152.114 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:04.859643-07:00 web-03 app[30809]: INFO request_id=e14a170b7797dc0e method=GET path=/metrics status=404 duration=6137ms 2026-10-09T13:27:04.890619-07:00 cache-3 sshd[47430]: Accepted publickey for françois from 192.45.142.243 port 9456 ssh2: ED25519 SHA256:ef9d5376152ef3db 2026-10-09T13:27:04.940814-07:00 edge-fr-1 app[30568]: INFO request_id=041d101a0e5ae1bb method=GET path=/api/v2/orders status=200 duration=7559ms 2026-10-09T13:27:05.043268-07:00 web-03 haproxy[918]: 45.132.57.89:10809 [18279] http-in app/web-01 6564/0/103/103/6564 200 43485 - - ---- 553/553/92/92/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:05.284976-07:00 web-01 sshd[21665]: Failed password for invalid user backup from 203.239.144.176 port 38740 ssh2 2026-10-09T13:27:05.404255-07:00 api-08 nginx[1205]: 203.163.245.234 - - "GET /api/v2/users HTTP/1.1" 404 36516 "-" "curl/8.4.0" 2026-10-09T13:27:05.811086-07:00 cache-3 nginx[1208]: 192.199.48.5 - - "GET /static/main.css HTTP/1.1" 502 46225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:05.855700-07:00 web-02 nginx[1203]: 203.197.205.173 - - "GET /login HTTP/1.1" 204 20432 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:06.088523-07:00 worker-12 sshd[55862]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:27:06.115563-07:00 cache-3 kernel: [44085.024575] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.77.79.216 DST=10.0.381.381 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=44085 DF PROTO=TCP SPT=38671 DPT=38671 WINDOW=44085 RES=0x00 SYN URGP=0 2026-10-09T13:27:06.199553-07:00 web-01 app[30078]: INFO request_id=0ccc2e833264ac9f method=GET path=/api/v2/search?q=invoice status=200 duration=1599ms 2026-10-09T13:27:06.272768-07:00 worker-12 app[30680]: INFO order 50338 confirmed for françois in 2725 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:06.569321-07:00 edge-fr-1 app[30013]: INFO request_id=fba33d0d5209d618 method=GET path=/static/app.js status=404 duration=5066ms 2026-10-09T13:27:06.774216-07:00 cache-3 app[30281]: INFO request_id=9eee3fc284fffecd method=GET path=/favicon.ico status=200 duration=7247ms 2026-10-09T13:27:06.795364-07:00 bastion nginx[1205]: 192.144.116.143 - - "GET /.env HTTP/1.1" 404 29509 "-" "kube-probe/1.31" 2026-10-09T13:27:06.922023-07:00 db-replica haproxy[905]: 203.129.196.214:36448 [88048] http-in app/api-07 5612/0/9/9/5612 301 5773 - - ---- 883/883/38/38/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:06.968006-07:00 db-replica systemd[1]: session-92057.scope: Deactivated successfully. 2026-10-09T13:27:07.137815-07:00 cache-3 sshd[55102]: Connection closed by 91.157.183.57 port 2493 [preauth] 2026-10-09T13:27:07.225784-07:00 web-01 systemd[1]: session-44506.scope: Deactivated successfully. 2026-10-09T13:27:07.248774-07:00 web-02 systemd[1]: Started Session 65511 of User zoë. 2026-10-09T13:27:07.321304-07:00 edge-fr-1 postgres[27600]: LOG: duration: 8665.326 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:07.357675-07:00 worker-12 sshd[39897]: Failed password for invalid user françois from 203.248.92.18 port 24988 ssh2 2026-10-09T13:27:07.361215-07:00 api-07 app[30138]: INFO request_id=98fa3b01b70696ea method=GET path=/static/main.css status=502 duration=6735ms 2026-10-09T13:27:07.380069-07:00 web-01 sshd[28532]: pam_unix(sshd:session): session opened for user françois(uid=8576) by (uid=0) 2026-10-09T13:27:07.446375-07:00 db-replica haproxy[917]: 172.204.27.85:31351 [98357] http-in app/api-08 6143/0/358/358/6143 200 17166 - - ---- 935/935/90/90/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:27:07.687031-07:00 db-replica sshd[52853]: Accepted publickey for sørensen from 172.190.249.191 port 3685 ssh2: ED25519 SHA256:525125489c12289f 2026-10-09T13:27:07.846562-07:00 api-07 postgres[26963]: LOG: duration: 107.274 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:07.909529-07:00 web-02 sshd[40620]: Connection closed by 45.93.67.251 port 25237 [preauth] 2026-10-09T13:27:07.939675-07:00 api-08 haproxy[914]: 91.216.222.173:24930 [59948] http-in app/web-01 6931/0/468/468/6931 200 56786 - - ---- 435/435/62/62/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:27:07.944159-07:00 api-07 sshd[408]: Failed password for invalid user backup from 172.63.51.136 port 32405 ssh2 2026-10-09T13:27:07.995218-07:00 cache-3 sshd[4141]: Invalid user backup from 203.136.160.217 port 10628 2026-10-09T13:27:08.022693-07:00 api-08 sshd[10604]: Accepted publickey for backup from 91.134.204.45 port 33069 ssh2: ED25519 SHA256:b07ca00391afaf82 2026-10-09T13:27:08.138391-07:00 web-01 app[30162]: INFO order 36332 confirmed for sørensen in 576 ms (region ap-northeast-1, queue emails) 2026-10-09T13:27:08.209852-07:00 bastion systemd[1]: session-61275.scope: Deactivated successfully. 2026-10-09T13:27:08.238508-07:00 cache-3 app[31000]: INFO worker 71 picked job 02159171b4479d51 from queue invoices 2026-10-09T13:27:08.407143-07:00 db-replica systemd[1]: Started Session 92535 of User zoë. 2026-10-09T13:27:08.634495-07:00 bastion app[30140]: INFO request_id=2fb3d859181c08a5 method=GET path=/metrics status=401 duration=2916ms 2026-10-09T13:27:08.688620-07:00 db-primary nginx[1208]: 172.12.140.180 - - "GET /api/v2/orders HTTP/1.1" 404 77788 "-" "curl/8.4.0" 2026-10-09T13:27:08.773022-07:00 db-replica app[30218]: INFO order 21953 confirmed for priya in 2674 ms (region eu-west-1, queue webhooks) 2026-10-09T13:27:08.881012-07:00 web-01 kernel: [13303.790501] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.104.93.205 DST=10.0.889.889 LEN=91 TOS=0x00 PREC=0x00 TTL=91 ID=13303 DF PROTO=TCP SPT=7394 DPT=7394 WINDOW=13303 RES=0x00 SYN URGP=0 2026-10-09T13:27:08.889911-07:00 web-02 app[30422]: INFO request_id=be0ccf5dc4d288ae method=GET path=/api/v2/orders/8841 status=302 duration=1916ms 2026-10-09T13:27:09.037673-07:00 web-02 sshd[17135]: Invalid user deploy from 192.199.180.175 port 46786 2026-10-09T13:27:09.376855-07:00 api-07 sshd[25259]: Connection closed by 192.98.224.155 port 23039 [preauth] 2026-10-09T13:27:09.396900-07:00 cache-3 nginx[1201]: 45.50.116.169 - - "GET /metrics HTTP/1.1" 500 71617 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:09.455237-07:00 web-03 app[30285]: INFO request_id=9aa26989e78bace6 method=GET path=/login status=200 duration=7929ms 2026-10-09T13:27:09.670489-07:00 worker-12 systemd[1]: session-51380.scope: Deactivated successfully. 2026-10-09T13:27:09.747224-07:00 web-01 app[30606]: INFO worker 88 picked job 2fd218f9d6c167b4 from queue webhooks 2026-10-09T13:27:09.953925-07:00 db-primary nginx[1200]: 10.8.243.43 - root "POST /static/main.css HTTP/1.1" 200 64398 "-" "python-requests/2.32.3" 2026-10-09T13:27:09.986253-07:00 db-replica postgres[19908]: LOG: checkpoint complete: wrote 1949 buffers (61%); 0 WAL file(s) added, 0 removed, 88 recycled; write=7901.187 s, sync=0.187 s, total=7901.187 s 2026-10-09T13:27:10.007857-07:00 web-01 app[30329]: INFO order 46400 confirmed for backup in 2357 ms (region us-east-1, queue invoices) 2026-10-09T13:27:10.020040-07:00 edge-fr-1 nginx[1209]: 91.46.232.154 - - "GET /static/app.js HTTP/1.1" 200 47666 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:10.133331-07:00 api-07 app[30855]: INFO worker 22 finished job 7bcc8df944e4384a in 5796 ms 2026-10-09T13:27:10.555150-07:00 bastion kubelet[800]: I1009 13:27:10.614385 2476 kubelet.go:2476] "Pod is terminating, skipping pod status update" pod="default/api-2a5a8a85f93d5597" 2026-10-09T13:27:10.721943-07:00 worker-12 postgres[16999]: LOG: duration: 5498.604 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:10.760603-07:00 web-02 sshd[24131]: Invalid user müller from 192.35.224.83 port 48957 2026-10-09T13:27:10.775278-07:00 web-02 sshd[34618]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:27:10.820083-07:00 edge-fr-1 sshd[63501]: pam_unix(sshd:session): session opened for user müller(uid=5434) by (uid=0) 2026-10-09T13:27:11.316896-07:00 web-01 systemd[1]: Started Session 84734 of User deploy. 2026-10-09T13:27:11.344386-07:00 web-02 kernel: [76288.794420] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.65.203.175 DST=10.0.902.902 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=76288 DF PROTO=TCP SPT=7883 DPT=7883 WINDOW=76288 RES=0x00 SYN URGP=0 2026-10-09T13:27:11.422077-07:00 api-07 sshd[35452]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:27:11.427697-07:00 api-08 sshd[64139]: Received disconnect from 10.7.8.156 port 26239:11: Bye Bye [preauth] 2026-10-09T13:27:11.540003-07:00 bastion haproxy[938]: 172.25.167.17:46865 [73132] http-in app/api-07 817/0/789/789/817 200 53233 - - ---- 380/380/63/63/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:27:11.550263-07:00 web-01 app[30267]: INFO order 45576 confirmed for backup in 4631 ms (region eu-west-1, queue invoices) 2026-10-09T13:27:11.782324-07:00 web-01 haproxy[926]: 45.127.254.43:43532 [48739] http-in app/api-08 302/0/79/79/302 404 49707 - - ---- 286/286/44/44/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:27:11.969235-07:00 cache-3 nginx[1201]: 45.77.46.18 - - "GET /static/app.js HTTP/1.1" 302 74736 "-" "Go-http-client/1.1" 2026-10-09T13:27:12.079240-07:00 bastion app[30136]: DEBUG cache hit ratio 29% over the last minute (13616 lookups) 2026-10-09T13:27:12.175286-07:00 edge-fr-1 app[30104]: INFO health check ok: db 781 ms, cache 781 ms, queue depth 40 2026-10-09T13:27:12.288584-07:00 db-replica nginx[1208]: 45.146.36.87 - root "POST /api/v2/search?q=invoice HTTP/1.1" 301 17748 "-" "kube-probe/1.31" 2026-10-09T13:27:12.500193-07:00 web-03 app[30873]: INFO worker 50 picked job d28e35b2f12e3432 from queue emails 2026-10-09T13:27:12.507614-07:00 edge-fr-1 sshd[15126]: Connection closed by 203.69.68.148 port 43960 [preauth] 2026-10-09T13:27:12.925935-07:00 web-03 kernel: [89621.973553] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.230.15.15 DST=10.0.580.580 LEN=89 TOS=0x00 PREC=0x00 TTL=89 ID=89621 DF PROTO=TCP SPT=2881 DPT=2881 WINDOW=89621 RES=0x00 SYN URGP=0 2026-10-09T13:27:13.141211-07:00 db-replica nginx[1204]: 172.196.67.63 - - "GET /static/app.js HTTP/1.1" 200 32409 "-" "kube-probe/1.31" 2026-10-09T13:27:13.446500-07:00 web-01 sshd[38500]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:27:13.485250-07:00 edge-fr-1 cron[43368]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:27:13.626900-07:00 db-primary app[30303]: INFO worker 14 finished job 69d79911bded3bc1 in 9628 ms 2026-10-09T13:27:13.704122-07:00 api-07 app[30896]: INFO order 14568 confirmed for zoë in 1859 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:27:13.723286-07:00 worker-12 app[30338]: INFO worker 49 finished job b658e154ed376479 in 1827 ms 2026-10-09T13:27:13.764907-07:00 cache-3 app[30975]: WARN slow query (7376 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '81 minutes' 2026-10-09T13:27:14.226735-07:00 web-03 app[30089]: INFO health check ok: db 943 ms, cache 943 ms, queue depth 71 2026-10-09T13:27:14.400075-07:00 api-07 sshd[25500]: Invalid user françois from 172.206.213.189 port 6247 2026-10-09T13:27:14.417345-07:00 web-02 dockerd[700]: time="2026-10-09T13:27:14.417345-07:00" level=warning msg="Health check for container 5fea219a768b189b error: context deadline exceeded" 2026-10-09T13:27:14.470512-07:00 web-01 nginx[1204]: 172.242.202.106 - - "GET /static/app.js HTTP/1.1" 401 51428 "-" "curl/8.4.0" 2026-10-09T13:27:14.715618-07:00 cache-3 app[30769]: INFO health check ok: db 300 ms, cache 300 ms, queue depth 26 2026-10-09T13:27:15.027973-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577635.698:27551): pid=27551 uid=0 auid=2891 ses=939 msg='op=login id=2891 exe="/usr/sbin/sshd" hostname=? addr=203.1.205.58 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:15.136950-07:00 bastion nginx[1200]: 91.216.227.233 - - "GET /login HTTP/1.1" 200 14599 "-" "kube-probe/1.31" 2026-10-09T13:27:15.370561-07:00 web-01 haproxy[932]: 203.149.4.12:57329 [97998] http-in app/web-03 8478/0/336/336/8478 502 48287 - - ---- 329/329/70/70/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:27:15.386134-07:00 worker-12 systemd[1]: Started Session 74506 of User sørensen. 2026-10-09T13:27:15.628036-07:00 edge-fr-1 nginx[1201]: 172.202.82.253 - priya "POST /admin HTTP/1.1" 401 18235 "-" "curl/8.4.0" 2026-10-09T13:27:15.781723-07:00 bastion postgres[6811]: LOG: duration: 6683.68 ms statement: SELECT * FROM orders WHERE customer_id = 52067 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:15.808830-07:00 bastion app[30237]: WARN slow query (6040 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '64 minutes' 2026-10-09T13:27:15.981443-07:00 bastion app[30090]: INFO order 55409 confirmed for backup in 8581 ms (region us-east-1, queue orders) 2026-10-09T13:27:16.103801-07:00 db-primary nginx[1209]: 45.78.19.63 - - "GET /static/app.js HTTP/1.1" 401 61877 "-" "Go-http-client/1.1" 2026-10-09T13:27:16.242068-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577636.743:25761): pid=25761 uid=0 auid=4658 ses=648 msg='op=login id=4658 exe="/usr/sbin/sshd" hostname=? addr=45.225.157.213 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:16.254139-07:00 db-replica postgres[8970]: LOG: duration: 6365.702 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:16.356352-07:00 db-replica sshd[17339]: Connection closed by 45.90.202.246 port 59674 [preauth] 2026-10-09T13:27:16.537590-07:00 web-02 app[30441]: INFO worker 33 finished job 658aec245d7398b4 in 7729 ms 2026-10-09T13:27:16.633030-07:00 edge-fr-1 app[30174]: INFO health check ok: db 59 ms, cache 59 ms, queue depth 78 2026-10-09T13:27:16.648452-07:00 api-08 app[30354]: INFO order 36965 confirmed for deploy in 4426 ms (region us-east-1, queue invoices) 2026-10-09T13:27:16.672006-07:00 web-01 nginx[1205]: 45.182.72.198 - - "GET /metrics HTTP/1.1" 302 79712 "-" "python-requests/2.32.3" 2026-10-09T13:27:16.702912-07:00 web-02 app[30479]: INFO worker 71 finished job 918f88e65369d48e in 1013 ms 2026-10-09T13:27:16.824126-07:00 edge-fr-1 haproxy[949]: 192.54.93.83:23890 [29983] http-in app/worker-12 2894/0/455/455/2894 502 23698 - - ---- 401/401/52/52/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:27:17.198175-07:00 web-03 app[30115]: INFO worker 71 picked job 4c8649db342e91fc from queue invoices 2026-10-09T13:27:17.232255-07:00 db-replica postgres[19945]: LOG: duration: 8614.541 ms statement: SELECT * FROM orders WHERE customer_id = 81048 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:17.380582-07:00 api-08 nginx[1203]: 203.30.20.110 - - "GET /api/v2/orders/8841 HTTP/1.1" 401 59869 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:17.447345-07:00 cache-3 app[30129]: INFO order 72222 confirmed for priya in 873 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:27:17.449544-07:00 db-replica postgres[2465]: LOG: duration: 2650.758 ms statement: SELECT * FROM orders WHERE customer_id = 60778 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:17.573411-07:00 bastion app[30557]: INFO request_id=3025217e69d8a8b6 method=GET path=/.env status=404 duration=9477ms 2026-10-09T13:27:17.577915-07:00 cache-3 nginx[1207]: 203.55.77.107 - - "GET /static/main.css HTTP/1.1" 204 10707 "-" "kube-probe/1.31" 2026-10-09T13:27:17.605838-07:00 bastion app[30051]: INFO order 81853 confirmed for priya in 8719 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:17.765585-07:00 web-01 app[30806]: INFO request_id=3a72b9f2c33bc284 method=GET path=/api/v2/users status=404 duration=4280ms 2026-10-09T13:27:18.192439-07:00 api-07 haproxy[948]: 172.87.110.68:12630 [60709] http-in app/db-primary 4154/0/474/474/4154 200 72531 - - ---- 460/460/80/80/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:18.350103-07:00 worker-12 dockerd[700]: time="2026-10-09T13:27:18.350103-07:00" level=info msg="Container 52d3f6ece8a9f00a exited with code 0" 2026-10-09T13:27:18.500307-07:00 api-07 app[30255]: INFO order 70906 confirmed for root in 3163 ms (region us-east-1, queue emails) 2026-10-09T13:27:18.641264-07:00 db-replica sshd[7550]: Received disconnect from 91.184.72.240 port 52839:11: Bye Bye [preauth] 2026-10-09T13:27:18.942258-07:00 edge-fr-1 sshd[21529]: Failed password for invalid user akira from 91.235.135.97 port 51621 ssh2 2026-10-09T13:27:19.126823-07:00 api-07 app[30031]: INFO worker 93 finished job 72df0cdd505d1def in 9010 ms 2026-10-09T13:27:19.242459-07:00 cache-3 app[30121]: INFO order 21069 confirmed for zoë in 6118 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:19.264044-07:00 edge-fr-1 sshd[1376]: Invalid user zoë from 203.187.219.118 port 40590 2026-10-09T13:27:19.381730-07:00 web-01 haproxy[907]: 10.196.73.164:37163 [49210] http-in app/db-replica 3172/0/786/786/3172 204 12809 - - ---- 429/429/71/71/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:27:19.686229-07:00 api-07 nginx[1204]: 10.187.9.20 - - "GET /api/v2/orders HTTP/1.1" 200 48463 "-" "kube-probe/1.31" 2026-10-09T13:27:19.718944-07:00 web-02 postgres[2191]: LOG: duration: 4637.827 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:19.728796-07:00 worker-12 systemd[1]: session-19387.scope: Deactivated successfully. 2026-10-09T13:27:20.242582-07:00 edge-fr-1 app[30051]: INFO health check ok: db 384 ms, cache 384 ms, queue depth 11 2026-10-09T13:27:20.245785-07:00 api-07 nginx[1205]: 10.3.175.16 - - "GET /admin HTTP/1.1" 301 44900 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:20.247257-07:00 bastion nginx[1200]: 192.254.205.146 - backup "POST /static/app.js HTTP/1.1" 301 39390 "-" "Go-http-client/1.1" 2026-10-09T13:27:20.276229-07:00 worker-12 app[30923]: DEBUG cache hit ratio 77% over the last minute (34522 lookups) 2026-10-09T13:27:20.400025-07:00 api-07 kubelet[800]: I1009 13:27:20.101240 5574 kubelet.go:5574] "Pod is terminating, skipping pod status update" pod="default/api-0963bc9682368875" 2026-10-09T13:27:20.672773-07:00 db-replica sshd[63757]: Connection closed by 91.111.119.129 port 23991 [preauth] 2026-10-09T13:27:20.685159-07:00 web-02 haproxy[900]: 172.46.24.104:20083 [25820] http-in app/web-02 5745/0/82/82/5745 404 49654 - - ---- 988/988/37/37/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:27:20.939574-07:00 edge-fr-1 app[30493]: INFO worker 27 finished job 24bf550d0cf02bc1 in 1263 ms 2026-10-09T13:27:21.048974-07:00 cache-3 haproxy[929]: 91.55.40.195:16127 [71756] http-in app/cache-3 4451/0/868/868/4451 200 22547 - - ---- 904/904/97/97/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:27:21.079803-07:00 web-01 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:27:21.134920-07:00 api-07 haproxy[934]: 172.43.72.224:25483 [20162] http-in app/worker-12 9288/0/525/525/9288 200 31828 - - ---- 134/134/70/70/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:21.167733-07:00 web-01 app[30987]: INFO request_id=f8b193d9c6eea23c method=GET path=/wp-login.php status=302 duration=4491ms 2026-10-09T13:27:21.553866-07:00 bastion app[30153]: INFO request_id=410563cc351ab168 method=GET path=/wp-login.php status=200 duration=958ms 2026-10-09T13:27:21.575737-07:00 worker-12 app[30191]: INFO order 59282 confirmed for deploy in 4879 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:27:21.713420-07:00 web-01 nginx[1203]: 45.19.146.143 - - "GET /api/v2/users HTTP/1.1" 301 81356 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:21.720827-07:00 bastion app[30365]: INFO order 50151 confirmed for backup in 5306 ms (region us-east-1, queue webhooks) 2026-10-09T13:27:21.815772-07:00 web-03 sshd[41807]: pam_unix(sshd:session): session opened for user root(uid=2445) by (uid=0) 2026-10-09T13:27:21.950235-07:00 bastion app[30305]: INFO order 10146 confirmed for françois in 7478 ms (region us-east-1, queue orders) 2026-10-09T13:27:22.006023-07:00 edge-fr-1 systemd[1]: session-19056.scope: Deactivated successfully. 2026-10-09T13:27:22.013977-07:00 cache-3 app[30981]: INFO request_id=808ea9ca979f377a method=GET path=/wp-login.php status=500 duration=5891ms 2026-10-09T13:27:22.089045-07:00 api-08 app[30686]: INFO request_id=9315d55c10cba2ef method=GET path=/login status=500 duration=3760ms 2026-10-09T13:27:22.218040-07:00 bastion app[30610]: INFO worker 97 picked job 0cc617ab238f7a50 from queue emails 2026-10-09T13:27:22.399615-07:00 web-03 nginx[1201]: 10.130.121.103 - - "GET /static/app.js HTTP/1.1" 204 18900 "-" "curl/8.4.0" 2026-10-09T13:27:22.492235-07:00 cache-3 sshd[48590]: Connection closed by 45.129.63.243 port 21973 [preauth] 2026-10-09T13:27:22.591695-07:00 api-08 haproxy[942]: 10.177.240.68:32094 [69107] http-in app/api-08 8052/0/994/994/8052 404 61471 - - ---- 879/879/64/64/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:22.609998-07:00 bastion postgres[28343]: LOG: checkpoint complete: wrote 9049 buffers (91%); 0 WAL file(s) added, 0 removed, 76 recycled; write=9043.31 s, sync=0.31 s, total=9043.31 s 2026-10-09T13:27:22.768781-07:00 edge-fr-1 haproxy[904]: 172.142.7.18:28130 [86921] http-in app/db-primary 6652/0/366/366/6652 502 50639 - - ---- 598/598/30/30/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:27:22.974071-07:00 api-08 app[30694]: INFO request_id=04254f02e21d32e5 method=GET path=/api/v2/users status=200 duration=6635ms 2026-10-09T13:27:23.008578-07:00 edge-fr-1 app[30531]: INFO order 42457 confirmed for müller in 6364 ms (region ap-northeast-1, queue emails) 2026-10-09T13:27:23.010256-07:00 web-03 app[30304]: INFO order 99065 confirmed for root in 3863 ms (region eu-west-1, queue invoices) 2026-10-09T13:27:23.022069-07:00 edge-fr-1 app[30471]: INFO request_id=35d72b1df487e592 method=GET path=/favicon.ico status=200 duration=9845ms 2026-10-09T13:27:23.223059-07:00 web-01 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:27:23.274397-07:00 api-07 haproxy[936]: 45.225.254.212:8318 [87841] http-in app/bastion 9557/0/199/199/9557 200 6161 - - ---- 676/676/29/29/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:23.350864-07:00 api-07 sshd[48600]: Received disconnect from 172.118.217.158 port 32784:11: Bye Bye [preauth] 2026-10-09T13:27:23.758900-07:00 web-03 dockerd[700]: time="2026-10-09T13:27:23.758900-07:00" level=info msg="Container 474c8814e8f6ba56 exited with code 0" 2026-10-09T13:27:23.922997-07:00 api-08 app[30933]: INFO order 51918 confirmed for root in 2485 ms (region us-east-1, queue emails) 2026-10-09T13:27:24.065814-07:00 edge-fr-1 haproxy[923]: 203.137.116.228:27878 [47936] http-in app/cache-3 6526/0/277/277/6526 401 87009 - - ---- 690/690/18/18/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:27:24.111693-07:00 api-07 nginx[1208]: 203.73.180.31 - - "GET /admin HTTP/1.1" 500 28293 "-" "Go-http-client/1.1" 2026-10-09T13:27:24.228127-07:00 db-replica haproxy[947]: 10.101.189.119:28933 [50606] http-in app/cache-3 5998/0/567/567/5998 200 45237 - - ---- 944/944/60/60/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:27:24.291904-07:00 web-01 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:27:24.422599-07:00 web-02 sshd[13035]: Invalid user priya from 192.60.178.243 port 21842 2026-10-09T13:27:24.765134-07:00 db-replica app[30970]: INFO request_id=1ba2db08e751d870 method=GET path=/wp-login.php status=301 duration=7576ms 2026-10-09T13:27:25.077698-07:00 web-02 app[31000]: INFO worker 29 picked job 36282927464a1cd9 from queue webhooks 2026-10-09T13:27:25.259617-07:00 edge-fr-1 sshd[47056]: Accepted publickey for zoë from 203.115.156.93 port 62252 ssh2: ED25519 SHA256:9b3180516abbfc03 2026-10-09T13:27:25.420417-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577645.573:44888): pid=44888 uid=0 auid=1887 ses=232 msg='op=login id=1887 exe="/usr/sbin/sshd" hostname=? addr=172.223.26.101 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:25.470008-07:00 web-01 sshd[44105]: Connection closed by 203.229.224.68 port 55844 [preauth] 2026-10-09T13:27:25.715132-07:00 cache-3 postgres[19773]: LOG: duration: 6814.172 ms statement: SELECT * FROM orders WHERE customer_id = 40548 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:25.794895-07:00 api-07 app[30130]: INFO request_id=e57acd3217f7719f method=GET path=/.env status=401 duration=785ms 2026-10-09T13:27:25.850652-07:00 bastion app[30212]: INFO health check ok: db 324 ms, cache 324 ms, queue depth 85 2026-10-09T13:27:26.055561-07:00 db-primary nginx[1201]: 91.31.107.113 - - "GET /health HTTP/1.1" 500 48075 "-" "kube-probe/1.31" 2026-10-09T13:27:26.064655-07:00 db-replica haproxy[939]: 172.108.254.245:46036 [96296] http-in app/web-03 5504/0/915/915/5504 301 10574 - - ---- 615/615/64/64/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:27:26.313338-07:00 db-replica app[30584]: INFO order 51143 confirmed for root in 8510 ms (region eu-west-1, queue emails) 2026-10-09T13:27:26.384806-07:00 edge-fr-1 app[30340]: WARN retrying upstream 203.58.139.206:17513 after timeout (7132 ms), attempt 2 of 3 2026-10-09T13:27:26.578028-07:00 api-08 nginx[1204]: 172.182.117.90 - - "GET /wp-login.php HTTP/1.1" 200 61631 "-" "kube-probe/1.31" 2026-10-09T13:27:26.582342-07:00 api-08 nginx[1205]: 172.22.234.193 - - "GET /login HTTP/1.1" 404 44797 "-" "python-requests/2.32.3" 2026-10-09T13:27:26.630842-07:00 worker-12 app[30151]: DEBUG cache hit ratio 11% over the last minute (67048 lookups) 2026-10-09T13:27:26.730281-07:00 edge-fr-1 app[30878]: INFO order 67117 confirmed for ci in 8413 ms (region us-east-1, queue orders) 2026-10-09T13:27:26.758648-07:00 worker-12 postgres[20063]: LOG: duration: 4396.12 ms statement: SELECT * FROM orders WHERE customer_id = 76215 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:26.771071-07:00 db-primary haproxy[904]: 203.249.253.113:58874 [93864] http-in app/api-07 252/0/734/734/252 401 14782 - - ---- 353/353/27/27/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:27:26.846916-07:00 web-03 app[30363]: INFO request_id=404b077ff542d38e method=GET path=/.env status=404 duration=3080ms 2026-10-09T13:27:27.057826-07:00 db-primary nginx[1205]: 172.72.27.75 - - "GET /login HTTP/1.1" 200 58334 "-" "curl/8.4.0" 2026-10-09T13:27:27.206569-07:00 web-02 app[30553]: ERROR payment declined for order 19532: card_declined (code 80), customer notified 2026-10-09T13:27:27.270322-07:00 web-02 app[30704]: INFO health check ok: db 303 ms, cache 303 ms, queue depth 74 2026-10-09T13:27:27.475172-07:00 web-03 nginx[1210]: 192.22.93.111 - - "GET /admin HTTP/1.1" 200 24273 "-" "python-requests/2.32.3" 2026-10-09T13:27:27.515683-07:00 web-01 app[30583]: INFO request_id=b8c89dd503bc6dfa method=GET path=/wp-login.php status=200 duration=7257ms 2026-10-09T13:27:27.679658-07:00 web-03 sshd[18079]: Invalid user root from 10.108.71.157 port 53628 2026-10-09T13:27:27.730254-07:00 api-07 postgres[16291]: LOG: checkpoint complete: wrote 9151 buffers (45%); 0 WAL file(s) added, 0 removed, 11 recycled; write=7679.798 s, sync=0.798 s, total=7679.798 s 2026-10-09T13:27:27.790368-07:00 api-08 app[30642]: INFO request_id=dc4c4261c2660b8f method=GET path=/static/main.css status=200 duration=924ms 2026-10-09T13:27:28.123003-07:00 bastion app[30201]: INFO request_id=df9e315280ca8c43 method=GET path=/favicon.ico status=200 duration=4392ms 2026-10-09T13:27:28.141266-07:00 web-02 haproxy[936]: 91.97.57.4:26712 [48005] http-in app/web-01 2600/0/487/487/2600 401 14568 - - ---- 881/881/18/18/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:27:28.277123-07:00 api-07 kernel: [96752.514991] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.211.119.205 DST=10.0.995.995 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=96752 DF PROTO=TCP SPT=31379 DPT=31379 WINDOW=96752 RES=0x00 SYN URGP=0 2026-10-09T13:27:28.309193-07:00 db-primary sshd[39424]: Failed password for invalid user sørensen from 203.205.62.155 port 55920 ssh2 2026-10-09T13:27:28.353580-07:00 web-01 nginx[1207]: 91.25.42.210 - - "GET /wp-login.php HTTP/1.1" 200 44817 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:28.607786-07:00 edge-fr-1 systemd[1]: session-21926.scope: Deactivated successfully. 2026-10-09T13:27:28.643439-07:00 api-08 app[30593]: INFO order 28292 confirmed for sørensen in 2919 ms (region us-east-1, queue orders) 2026-10-09T13:27:28.740220-07:00 web-03 app[30427]: INFO health check ok: db 882 ms, cache 882 ms, queue depth 27 2026-10-09T13:27:28.845028-07:00 db-primary app[30752]: INFO request_id=ab5d00e3ac8abda0 method=GET path=/api/v2/search?q=invoice status=200 duration=4530ms 2026-10-09T13:27:28.917157-07:00 api-07 app[30233]: INFO request_id=163f5d3c7c8d2a67 method=GET path=/favicon.ico status=301 duration=554ms 2026-10-09T13:27:28.978969-07:00 edge-fr-1 app[30973]: INFO order 40092 confirmed for müller in 1742 ms (region us-east-1, queue webhooks) 2026-10-09T13:27:29.179900-07:00 worker-12 nginx[1200]: 172.9.149.76 - - "GET /metrics HTTP/1.1" 200 3343 "-" "curl/8.4.0" 2026-10-09T13:27:29.209842-07:00 db-primary nginx[1201]: 203.134.120.199 - - "GET /metrics HTTP/1.1" 200 30120 "-" "kube-probe/1.31" 2026-10-09T13:27:29.315191-07:00 web-03 cron[44201]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:27:29.356939-07:00 web-01 sshd[64273]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:27:29.394556-07:00 web-01 sshd[57026]: Received disconnect from 172.242.121.34 port 1795:11: Bye Bye [preauth] 2026-10-09T13:27:29.506012-07:00 cache-3 nginx[1206]: 172.219.204.2 - - "GET /wp-login.php HTTP/1.1" 500 65566 "-" "curl/8.4.0" 2026-10-09T13:27:29.520956-07:00 cache-3 postgres[14996]: LOG: duration: 1315.34 ms statement: SELECT * FROM orders WHERE customer_id = 74884 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:29.599745-07:00 web-02 nginx[1200]: 91.21.55.23 - - "GET /static/main.css HTTP/1.1" 200 15235 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:29.670517-07:00 api-07 sshd[12278]: Invalid user françois from 192.128.16.156 port 51928 2026-10-09T13:27:30.057764-07:00 web-01 nginx[1208]: 192.147.205.56 - akira "POST /admin HTTP/1.1" 500 46947 "-" "python-requests/2.32.3" 2026-10-09T13:27:30.523228-07:00 db-primary sshd[1270]: Received disconnect from 192.93.104.3 port 62986:11: Bye Bye [preauth] 2026-10-09T13:27:30.553634-07:00 db-replica app[30743]: DEBUG cache hit ratio 48% over the last minute (78705 lookups) 2026-10-09T13:27:30.651531-07:00 web-03 sshd[15878]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:27:31.287973-07:00 edge-fr-1 app[30045]: DEBUG cache hit ratio 24% over the last minute (60464 lookups) 2026-10-09T13:27:31.318190-07:00 api-08 kernel: [45473.613180] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.114.218.167 DST=10.0.871.871 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=45473 DF PROTO=TCP SPT=23682 DPT=23682 WINDOW=45473 RES=0x00 SYN URGP=0 2026-10-09T13:27:31.516526-07:00 cache-3 app[30808]: INFO request_id=1bf99c955e1ba544 method=GET path=/login status=200 duration=7754ms 2026-10-09T13:27:31.652677-07:00 web-02 app[30078]: ERROR cache miss storm: 4060 misses in 777 ms, key prefix session:root 2026-10-09T13:27:31.723888-07:00 edge-fr-1 app[30108]: INFO order 11993 confirmed for müller in 6727 ms (region us-east-1, queue emails) 2026-10-09T13:27:31.755875-07:00 web-03 nginx[1203]: 91.29.144.245 - deploy "POST /api/v2/orders HTTP/1.1" 200 7572 "-" "python-requests/2.32.3" 2026-10-09T13:27:32.081002-07:00 db-primary app[30419]: INFO order 55412 confirmed for françois in 1769 ms (region ap-northeast-1, queue orders) 2026-10-09T13:27:32.616336-07:00 web-01 sshd[2757]: pam_unix(sshd:session): session opened for user priya(uid=5178) by (uid=0) 2026-10-09T13:27:32.640204-07:00 edge-fr-1 nginx[1203]: 172.30.255.131 - - "GET /static/app.js HTTP/1.1" 404 52692 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:32.695149-07:00 api-08 kernel: [14946.468027] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.216.217.240 DST=10.0.710.710 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=14946 DF PROTO=TCP SPT=38562 DPT=38562 WINDOW=14946 RES=0x00 SYN URGP=0 2026-10-09T13:27:32.731993-07:00 bastion nginx[1205]: 45.155.7.98 - - "GET /admin HTTP/1.1" 200 49135 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:32.846577-07:00 db-replica kernel: [11366.102059] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.122.113.220 DST=10.0.292.292 LEN=26 TOS=0x00 PREC=0x00 TTL=26 ID=11366 DF PROTO=TCP SPT=13060 DPT=13060 WINDOW=11366 RES=0x00 SYN URGP=0 2026-10-09T13:27:32.846949-07:00 web-01 app[30896]: INFO order 76219 confirmed for backup in 7296 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:27:33.100855-07:00 api-08 sshd[45621]: Invalid user müller from 45.132.46.63 port 35406 2026-10-09T13:27:33.336509-07:00 api-07 app[30440]: INFO worker 83 finished job 723aa8a9290a3040 in 8930 ms 2026-10-09T13:27:33.341556-07:00 worker-12 app[30686]: DEBUG cache hit ratio 89% over the last minute (94532 lookups) 2026-10-09T13:27:33.355345-07:00 worker-12 sshd[62127]: Accepted publickey for backup from 203.114.151.123 port 56129 ssh2: ED25519 SHA256:b6a0117bb64aabdc 2026-10-09T13:27:33.407588-07:00 db-replica sshd[33035]: Received disconnect from 10.33.41.142 port 29068:11: Bye Bye [preauth] 2026-10-09T13:27:33.646880-07:00 api-08 app[30875]: INFO order 95213 confirmed for sørensen in 9030 ms (region ap-northeast-1, queue emails) 2026-10-09T13:27:33.768577-07:00 api-07 nginx[1206]: 91.147.171.246 - - "GET /api/v2/orders HTTP/1.1" 404 37496 "-" "python-requests/2.32.3" 2026-10-09T13:27:33.894110-07:00 edge-fr-1 nginx[1202]: 10.91.33.6 - - "GET /.env HTTP/1.1" 500 27017 "-" "Go-http-client/1.1" 2026-10-09T13:27:33.917545-07:00 web-02 app[30686]: INFO request_id=c6876297ed8e09ac method=GET path=/api/v2/search?q=invoice status=200 duration=3038ms 2026-10-09T13:27:34.209789-07:00 web-01 nginx[1208]: 203.62.154.187 - - "GET /static/main.css HTTP/1.1" 200 49854 "-" "Go-http-client/1.1" 2026-10-09T13:27:34.324240-07:00 api-07 app[30548]: INFO order 38318 confirmed for akira in 6944 ms (region eu-west-1, queue webhooks) 2026-10-09T13:27:34.432629-07:00 web-01 postgres[14050]: LOG: duration: 649.921 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:34.483417-07:00 api-07 app[30963]: INFO worker 60 picked job 50c20c26f4393ffc from queue invoices 2026-10-09T13:27:34.503149-07:00 cache-3 app[30513]: ERROR cache miss storm: 5955 misses in 8699 ms, key prefix session:ci 2026-10-09T13:27:34.636778-07:00 db-primary postgres[21129]: LOG: duration: 4153.482 ms statement: SELECT * FROM orders WHERE customer_id = 86751 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:34.785432-07:00 worker-12 nginx[1205]: 172.205.75.58 - - "GET /wp-login.php HTTP/1.1" 302 85078 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:34.860647-07:00 api-08 app[30933]: INFO order 62993 confirmed for akira in 8562 ms (region eu-west-1, queue orders) 2026-10-09T13:27:34.865993-07:00 cache-3 nginx[1207]: 203.213.116.121 - - "GET /metrics HTTP/1.1" 200 40672 "-" "python-requests/2.32.3" 2026-10-09T13:27:35.268307-07:00 edge-fr-1 app[30319]: ERROR cache miss storm: 3999 misses in 3605 ms, key prefix session:akira 2026-10-09T13:27:35.470162-07:00 cache-3 postgres[25161]: LOG: duration: 8243.134 ms statement: SELECT * FROM orders WHERE customer_id = 32219 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:35.498661-07:00 cache-3 postgres[11028]: LOG: checkpoint complete: wrote 8028 buffers (37%); 0 WAL file(s) added, 0 removed, 14 recycled; write=5774.884 s, sync=0.884 s, total=5774.884 s 2026-10-09T13:27:35.505881-07:00 db-replica sshd[21115]: pam_unix(sshd:session): session opened for user sørensen(uid=7239) by (uid=0) 2026-10-09T13:27:35.537916-07:00 web-01 app[30585]: INFO worker 77 finished job 525c196576b2babc in 7158 ms 2026-10-09T13:27:35.554956-07:00 api-07 app[30713]: INFO worker 28 picked job 973e36f8b1ce8ff4 from queue orders 2026-10-09T13:27:35.730180-07:00 web-03 app[30948]: INFO worker 82 finished job 72011fb0d191fbc5 in 5626 ms 2026-10-09T13:27:35.731967-07:00 worker-12 app[30956]: INFO request_id=ffccb505e962e56d method=GET path=/static/main.css status=302 duration=7117ms 2026-10-09T13:27:35.880531-07:00 api-08 app[30707]: INFO request_id=11f8d9f08fa80385 method=GET path=/api/v2/search?q=invoice status=401 duration=1994ms 2026-10-09T13:27:35.945400-07:00 api-08 sshd[20507]: Received disconnect from 172.0.77.53 port 39949:11: Bye Bye [preauth] 2026-10-09T13:27:35.995508-07:00 worker-12 haproxy[934]: 45.102.233.191:3841 [59336] http-in app/web-03 2112/0/220/220/2112 200 72046 - - ---- 706/706/72/72/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:36.014234-07:00 api-08 systemd[1]: session-73081.scope: Deactivated successfully. 2026-10-09T13:27:36.232233-07:00 worker-12 kernel: [94083.184492] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.174.98.197 DST=10.0.390.390 LEN=68 TOS=0x00 PREC=0x00 TTL=68 ID=94083 DF PROTO=TCP SPT=48055 DPT=48055 WINDOW=94083 RES=0x00 SYN URGP=0 2026-10-09T13:27:36.257139-07:00 bastion haproxy[916]: 45.253.70.103:45180 [58572] http-in app/web-03 9239/0/802/802/9239 302 755 - - ---- 566/566/75/75/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:27:36.305732-07:00 cache-3 app[30362]: INFO worker 73 finished job c68cb9ef037fb958 in 2228 ms 2026-10-09T13:27:36.429543-07:00 web-02 dockerd[700]: time="2026-10-09T13:27:36.429543-07:00" level=info msg="Container ac04f712752f5e0a exited with code 0" 2026-10-09T13:27:36.582929-07:00 bastion sshd[21447]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:27:36.693267-07:00 db-replica app[30014]: INFO request_id=9185a4cd034b49bb method=GET path=/health status=401 duration=9395ms 2026-10-09T13:27:36.850877-07:00 web-02 app[30833]: INFO request_id=2f2fd30c74f0a17a method=GET path=/health status=200 duration=8799ms 2026-10-09T13:27:36.928705-07:00 api-07 nginx[1207]: 172.199.83.130 - - "GET /metrics HTTP/1.1" 404 30839 "-" "Go-http-client/1.1" 2026-10-09T13:27:36.988426-07:00 web-03 nginx[1201]: 45.64.64.34 - - "GET /api/v2/users HTTP/1.1" 502 47831 "-" "curl/8.4.0" 2026-10-09T13:27:37.008574-07:00 cache-3 app[30433]: INFO order 38054 confirmed for deploy in 6748 ms (region eu-west-1, queue emails) 2026-10-09T13:27:37.009862-07:00 worker-12 nginx[1208]: 10.229.146.53 - - "GET /.env HTTP/1.1" 301 22370 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:37.036766-07:00 db-primary kernel: [23971.360165] TCP: request_sock_TCP: Possible SYN flooding on port 50465. Sending cookies. Check SNMP counters. 2026-10-09T13:27:37.078341-07:00 web-03 haproxy[938]: 91.8.77.32:62582 [20110] http-in app/api-07 9386/0/306/306/9386 302 26817 - - ---- 262/262/87/87/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:27:37.079633-07:00 db-replica sshd[58654]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:27:37.245123-07:00 web-02 sshd[18832]: Invalid user priya from 10.163.242.104 port 21832 2026-10-09T13:27:37.340685-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577657.59:89708): pid=89708 uid=0 auid=7063 ses=584 msg='op=login id=7063 exe="/usr/sbin/sshd" hostname=? addr=172.77.234.158 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:37.369605-07:00 bastion app[30163]: INFO order 91420 confirmed for ci in 5999 ms (region us-east-1, queue webhooks) 2026-10-09T13:27:37.485231-07:00 cache-3 app[30864]: INFO worker 93 picked job e9c2a8746699ebbb from queue emails 2026-10-09T13:27:37.538234-07:00 web-03 app[30007]: ERROR unhandled exception in worker 34 while processing job 8767659e916f2387 java.lang.NullPointerException: Cannot invoke "com.example.billing.Invoice.getTotal()" because "invoice" is null at com.example.billing.InvoiceService.charge(InvoiceService.java:140) at com.example.billing.InvoiceService.process(InvoiceService.java:18) at com.example.jobs.Worker.run(Worker.java:554) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:840) 2026-10-09T13:27:37.604824-07:00 edge-fr-1 app[30808]: ERROR payment declined for order 59516: card_declined (code 77), customer notified 2026-10-09T13:27:37.649704-07:00 web-02 app[30693]: INFO worker 99 picked job 61abf646227235f9 from queue orders 2026-10-09T13:27:37.705391-07:00 web-03 sshd[50184]: Failed password for invalid user deploy from 172.188.24.34 port 45185 ssh2 2026-10-09T13:27:37.730743-07:00 cache-3 app[30148]: INFO request_id=9d6416122c46ee39 method=GET path=/api/v2/orders/8841 status=302 duration=5054ms 2026-10-09T13:27:37.778610-07:00 api-08 sshd[41181]: Failed password for invalid user akira from 91.128.11.167 port 53261 ssh2 2026-10-09T13:27:37.887061-07:00 api-07 nginx[1201]: 45.231.103.100 - - "GET /metrics HTTP/1.1" 302 5355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:37.943998-07:00 worker-12 haproxy[911]: Server app/web-03 is DOWN, reason: Layer4 timeout, check duration: 7467ms. 33 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:27:38.117568-07:00 db-primary systemd[1]: session-77835.scope: Deactivated successfully. 2026-10-09T13:27:38.152329-07:00 db-primary systemd[1]: Started Session 92430 of User françois. 2026-10-09T13:27:38.252012-07:00 db-primary nginx[1209]: 10.163.15.119 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 41408 "-" "curl/8.4.0" 2026-10-09T13:27:38.274155-07:00 worker-12 sshd[49495]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:27:38.304310-07:00 bastion postgres[15781]: LOG: duration: 5041.866 ms statement: SELECT * FROM orders WHERE customer_id = 97185 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:38.336501-07:00 web-03 postgres[17031]: LOG: duration: 9149.659 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:38.515574-07:00 db-primary app[30525]: WARN slow query (4494 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '14 minutes' 2026-10-09T13:27:38.534285-07:00 api-08 sshd[48071]: Accepted publickey for priya from 192.41.20.149 port 50171 ssh2: ED25519 SHA256:1f34d21550fd8ff0 2026-10-09T13:27:38.619743-07:00 cache-3 app[30492]: INFO order 59800 confirmed for ci in 7704 ms (region ap-northeast-1, queue emails) 2026-10-09T13:27:38.766385-07:00 edge-fr-1 app[30303]: INFO worker 87 finished job 0daf80d7d85b0ff7 in 388 ms 2026-10-09T13:27:38.825752-07:00 bastion app[30521]: INFO worker 65 picked job b8062d14b7fbb515 from queue orders 2026-10-09T13:27:38.911030-07:00 web-02 app[30432]: INFO worker 22 finished job 5ab96dfbb5cdfb4c in 7115 ms 2026-10-09T13:27:39.179318-07:00 web-02 app[30494]: INFO request_id=e073dcc2ff004140 method=GET path=/.env status=404 duration=3535ms 2026-10-09T13:27:39.221475-07:00 api-07 nginx[1210]: 91.60.102.127 - - "GET /api/v2/users HTTP/1.1" 200 51524 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:39.280277-07:00 worker-12 app[30845]: INFO order 33487 confirmed for müller in 9420 ms (region eu-west-1, queue emails) 2026-10-09T13:27:39.336765-07:00 db-primary systemd[1]: Started Session 13269 of User deploy. 2026-10-09T13:27:39.423803-07:00 web-03 haproxy[938]: 203.117.70.138:17964 [34256] http-in app/api-07 9754/0/819/819/9754 404 66258 - - ---- 251/251/71/71/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:27:39.434526-07:00 edge-fr-1 app[30289]: INFO request_id=e2ca7ed80dee8467 method=GET path=/favicon.ico status=404 duration=8605ms 2026-10-09T13:27:39.473837-07:00 edge-fr-1 app[30856]: INFO order 37064 confirmed for zoë in 7945 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:39.502313-07:00 api-08 kernel: [94051.204089] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.222.177.62 DST=10.0.981.981 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=94051 DF PROTO=TCP SPT=27832 DPT=27832 WINDOW=94051 RES=0x00 SYN URGP=0 2026-10-09T13:27:39.639770-07:00 db-primary nginx[1209]: 172.125.98.153 - - "GET /api/v2/users HTTP/1.1" 200 32994 "-" "Go-http-client/1.1" 2026-10-09T13:27:39.651251-07:00 web-02 kernel: [71116.109355] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.77.104.118 DST=10.0.951.951 LEN=17 TOS=0x00 PREC=0x00 TTL=17 ID=71116 DF PROTO=TCP SPT=47333 DPT=47333 WINDOW=71116 RES=0x00 SYN URGP=0 2026-10-09T13:27:39.758756-07:00 db-replica app[30445]: INFO request_id=db4fd7f3e149ed6f method=GET path=/static/app.js status=500 duration=777ms 2026-10-09T13:27:39.887542-07:00 api-07 sshd[6775]: Failed password for invalid user zoë from 203.156.49.30 port 52304 ssh2 2026-10-09T13:27:39.889010-07:00 bastion nginx[1200]: 172.194.191.34 - - "GET /health HTTP/1.1" 500 35158 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:40.180059-07:00 web-02 kubelet[800]: I1009 13:27:40.795207 8456 kubelet.go:8456] "Pod is terminating, skipping pod status update" pod="default/api-103886a21b38b863" 2026-10-09T13:27:40.240776-07:00 api-08 app[30358]: INFO worker 47 finished job bd723a67b8357369 in 7802 ms 2026-10-09T13:27:40.282552-07:00 db-primary app[30949]: INFO request_id=06944870a3beb1d9 method=GET path=/api/v2/users status=502 duration=1585ms 2026-10-09T13:27:40.341081-07:00 api-08 nginx[1207]: 91.76.146.228 - - "GET /api/v2/users HTTP/1.1" 302 38886 "-" "Go-http-client/1.1" 2026-10-09T13:27:40.475841-07:00 cache-3 postgres[15546]: LOG: duration: 3134.913 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:40.675648-07:00 api-08 haproxy[914]: 203.81.159.47:63964 [29349] http-in app/db-primary 604/0/860/860/604 200 78211 - - ---- 260/260/32/32/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:40.687672-07:00 edge-fr-1 nginx[1205]: 192.184.127.9 - - "GET /health HTTP/1.1" 404 57656 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:40.747438-07:00 web-01 nginx[1208]: 10.109.196.40 - françois "POST /wp-login.php HTTP/1.1" 302 86511 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:40.819304-07:00 db-replica app[30549]: INFO request_id=8f7558c9f6e45cfd method=GET path=/login status=200 duration=3408ms 2026-10-09T13:27:41.101239-07:00 cache-3 nginx[1205]: 192.63.154.7 - - "GET /health HTTP/1.1" 404 22148 "-" "Go-http-client/1.1" 2026-10-09T13:27:41.211687-07:00 db-primary nginx[1204]: 45.229.133.102 - - "GET /api/v2/users HTTP/1.1" 502 15534 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:41.233247-07:00 edge-fr-1 nginx[1209]: 192.178.54.228 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 52350 "-" "curl/8.4.0" 2026-10-09T13:27:41.465225-07:00 api-07 kernel: [36199.979810] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.63.119.72 DST=10.0.717.717 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=36199 DF PROTO=TCP SPT=36924 DPT=36924 WINDOW=36199 RES=0x00 SYN URGP=0 2026-10-09T13:27:41.525940-07:00 api-07 nginx[1208]: 192.46.247.213 - - "GET /static/main.css HTTP/1.1" 200 896 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:41.577448-07:00 worker-12 app[30087]: WARN retrying upstream 45.80.166.191:55947 after timeout (797 ms), attempt 2 of 3 2026-10-09T13:27:41.681924-07:00 edge-fr-1 postgres[10059]: LOG: duration: 1862.824 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:41.782605-07:00 web-01 app[30725]: INFO health check ok: db 4 ms, cache 4 ms, queue depth 18 2026-10-09T13:27:41.896740-07:00 db-primary haproxy[941]: 91.66.186.186:14778 [40850] http-in app/api-07 5052/0/911/911/5052 200 62048 - - ---- 998/998/99/99/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:27:42.180912-07:00 db-replica systemd[1]: session-53603.scope: Deactivated successfully. 2026-10-09T13:27:42.414870-07:00 web-01 sshd[46375]: Accepted publickey for priya from 45.112.183.69 port 20520 ssh2: ED25519 SHA256:5f0ec6606e79e2af 2026-10-09T13:27:42.645510-07:00 db-replica sshd[16812]: Failed password for invalid user backup from 10.179.210.2 port 35223 ssh2 2026-10-09T13:27:42.757349-07:00 web-01 nginx[1205]: 203.236.143.127 - - "GET /health HTTP/1.1" 401 84176 "-" "kube-probe/1.31" 2026-10-09T13:27:43.037558-07:00 api-07 haproxy[941]: 172.158.25.62:28784 [48576] http-in app/api-08 7662/0/656/656/7662 200 12788 - - ---- 440/440/50/50/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:27:43.054855-07:00 web-01 app[30442]: INFO worker 79 finished job 34246c6cd200806b in 1901 ms 2026-10-09T13:27:43.125973-07:00 edge-fr-1 haproxy[948]: 91.80.77.117:25947 [29109] http-in app/web-03 8197/0/236/236/8197 200 52508 - - ---- 226/226/92/92/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:27:43.131111-07:00 api-08 app[30560]: INFO request_id=c86b7eae8d2762e9 method=GET path=/api/v2/search?q=invoice status=200 duration=3846ms 2026-10-09T13:27:43.303192-07:00 web-03 nginx[1207]: 192.123.225.216 - françois "POST /static/app.js HTTP/1.1" 204 7683 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:43.328366-07:00 web-01 app[30028]: INFO order 31772 confirmed for deploy in 8631 ms (region us-east-1, queue webhooks) 2026-10-09T13:27:43.388232-07:00 api-07 kernel: [15120.340664] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.14.200.145 DST=10.0.485.485 LEN=37 TOS=0x00 PREC=0x00 TTL=37 ID=15120 DF PROTO=TCP SPT=51115 DPT=51115 WINDOW=15120 RES=0x00 SYN URGP=0 2026-10-09T13:27:43.932614-07:00 bastion sshd[61422]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:27:43.984069-07:00 api-08 app[30242]: INFO worker 95 picked job 0c6af07adabdb695 from queue invoices 2026-10-09T13:27:44.329651-07:00 web-01 haproxy[901]: 203.55.142.182:7661 [96503] http-in app/cache-3 4013/0/268/268/4013 401 43429 - - ---- 800/800/27/27/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:27:44.359434-07:00 db-primary haproxy[912]: 91.12.55.186:42222 [73461] http-in app/web-03 8038/0/99/99/8038 302 18544 - - ---- 425/425/64/64/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:27:44.473141-07:00 worker-12 nginx[1207]: 45.70.199.191 - - "GET /metrics HTTP/1.1" 200 12130 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:44.643369-07:00 db-replica systemd[1]: Started Session 58080 of User root. 2026-10-09T13:27:44.703379-07:00 api-07 nginx[1203]: 172.86.238.233 - - "GET /favicon.ico HTTP/1.1" 204 20301 "-" "kube-probe/1.31" 2026-10-09T13:27:44.885906-07:00 worker-12 app[30561]: INFO request_id=f3bd276c38cebfbd method=GET path=/static/app.js status=200 duration=1366ms 2026-10-09T13:27:45.090767-07:00 web-01 sshd[64018]: Failed password for invalid user root from 45.34.32.99 port 52084 ssh2 2026-10-09T13:27:45.141890-07:00 web-02 app[30874]: INFO order 66045 confirmed for root in 3815 ms (region ap-northeast-1, queue orders) 2026-10-09T13:27:45.153804-07:00 db-replica haproxy[903]: 192.182.122.90:20685 [33827] http-in app/web-01 9438/0/796/796/9438 200 43213 - - ---- 226/226/73/73/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:45.290801-07:00 db-primary nginx[1210]: 203.20.162.2 - - "GET /api/v2/users HTTP/1.1" 200 580 "-" "python-requests/2.32.3" 2026-10-09T13:27:45.321966-07:00 cache-3 nginx[1203]: 45.58.28.113 - müller "POST /.env HTTP/1.1" 404 25398 "-" "Go-http-client/1.1" 2026-10-09T13:27:45.350116-07:00 bastion sshd[7674]: Invalid user backup from 91.146.182.177 port 8727 2026-10-09T13:27:45.418253-07:00 worker-12 systemd[1]: Started Session 11303 of User backup. 2026-10-09T13:27:45.578632-07:00 api-07 app[30953]: INFO worker 86 picked job 44b44a993f5f7b45 from queue orders 2026-10-09T13:27:45.654320-07:00 edge-fr-1 nginx[1208]: 91.211.20.69 - - "GET /favicon.ico HTTP/1.1" 401 61017 "-" "curl/8.4.0" 2026-10-09T13:27:45.664982-07:00 cache-3 nginx[1200]: 45.166.43.251 - - "GET /wp-login.php HTTP/1.1" 200 58907 "-" "python-requests/2.32.3" 2026-10-09T13:27:45.853531-07:00 api-08 kernel: [13756.440470] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.138.84.242 DST=10.0.322.322 LEN=37 TOS=0x00 PREC=0x00 TTL=37 ID=13756 DF PROTO=TCP SPT=23133 DPT=23133 WINDOW=13756 RES=0x00 SYN URGP=0 2026-10-09T13:27:45.986193-07:00 db-replica haproxy[932]: 45.228.34.236:53828 [87274] http-in app/api-08 6036/0/359/359/6036 204 85254 - - ---- 434/434/29/29/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:27:46.247580-07:00 db-primary nginx[1200]: 203.4.184.203 - - "GET /api/v2/orders HTTP/1.1" 500 39201 "-" "Go-http-client/1.1" 2026-10-09T13:27:46.293119-07:00 web-01 sshd[64950]: Invalid user deploy from 203.81.72.253 port 10557 2026-10-09T13:27:46.326347-07:00 cache-3 app[30031]: INFO worker 11 picked job 0beecd021f88bce9 from queue webhooks 2026-10-09T13:27:46.372469-07:00 api-07 nginx[1205]: 203.85.152.178 - - "GET /static/app.js HTTP/1.1" 404 47678 "-" "Go-http-client/1.1" 2026-10-09T13:27:46.404108-07:00 api-07 sshd[4978]: Accepted publickey for sørensen from 10.107.72.124 port 5691 ssh2: ED25519 SHA256:d2fa19b17563c349 2026-10-09T13:27:46.435933-07:00 bastion app[30935]: INFO request_id=ef2f6638d655c72a method=GET path=/admin status=200 duration=1228ms 2026-10-09T13:27:46.449587-07:00 web-01 postgres[17830]: LOG: duration: 3803.116 ms statement: SELECT * FROM orders WHERE customer_id = 50844 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:46.459670-07:00 db-primary systemd[1]: Started Session 62000 of User zoë. 2026-10-09T13:27:46.462309-07:00 api-08 app[30156]: INFO request_id=ac55196de4a9ef81 method=GET path=/api/v2/orders/8841 status=200 duration=2431ms 2026-10-09T13:27:46.648478-07:00 db-replica nginx[1209]: 45.63.4.30 - - "GET /static/main.css HTTP/1.1" 200 30245 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:46.649405-07:00 api-07 postgres[19725]: LOG: duration: 9342.262 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:27:46.661623-07:00 bastion app[30654]: INFO worker 94 picked job b520379ebc3a0c49 from queue emails 2026-10-09T13:27:46.838074-07:00 bastion haproxy[903]: 10.48.16.216:44801 [21132] http-in app/worker-12 7682/0/452/452/7682 502 88906 - - ---- 374/374/95/95/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:47.177151-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791577667.411:13168): pid=13168 uid=0 auid=1409 ses=198 msg='op=login id=1409 exe="/usr/sbin/sshd" hostname=? addr=45.205.196.167 terminal=/dev/pts/0 res=success' 2026-10-09T13:27:47.188338-07:00 api-08 app[30171]: INFO worker 62 picked job 2f78eacd03c86ab7 from queue emails 2026-10-09T13:27:47.346229-07:00 web-02 nginx[1201]: 172.43.61.180 - - "GET /metrics HTTP/1.1" 200 86947 "-" "Go-http-client/1.1" 2026-10-09T13:27:47.565093-07:00 worker-12 app[30668]: INFO request_id=9ed912114ca103b9 method=GET path=/login status=200 duration=8795ms 2026-10-09T13:27:47.746301-07:00 worker-12 nginx[1209]: 45.40.88.141 - - "GET /favicon.ico HTTP/1.1" 401 52255 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:48.017646-07:00 cache-3 sshd[13045]: Connection closed by 45.133.139.32 port 40038 [preauth] 2026-10-09T13:27:48.070635-07:00 db-primary app[30442]: INFO health check ok: db 533 ms, cache 533 ms, queue depth 20 2026-10-09T13:27:48.096367-07:00 worker-12 app[30556]: INFO order 86633 confirmed for sørensen in 9659 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:48.116965-07:00 db-primary app[30307]: INFO worker 30 finished job 44dfe44014c202ad in 7236 ms 2026-10-09T13:27:48.226670-07:00 api-08 kubelet[800]: I1009 13:27:48.065009 3587 kubelet.go:3587] "Pod is terminating, skipping pod status update" pod="default/api-6fba474a8843b778" 2026-10-09T13:27:48.305296-07:00 db-primary app[30209]: INFO request_id=ea0af06a6dfd92c8 method=GET path=/static/app.js status=401 duration=1490ms 2026-10-09T13:27:48.430072-07:00 worker-12 app[30395]: INFO request_id=26401b96f07a803b method=GET path=/api/v2/orders/8841 status=200 duration=9211ms 2026-10-09T13:27:48.493319-07:00 cache-3 kubelet[800]: I1009 13:27:48.081406 8151 kubelet.go:8151] "Pod is terminating, skipping pod status update" pod="default/api-80c4e7ddbda675dd" 2026-10-09T13:27:48.544813-07:00 db-primary app[30090]: INFO health check ok: db 513 ms, cache 513 ms, queue depth 67 2026-10-09T13:27:48.622194-07:00 web-01 haproxy[903]: 192.132.31.153:4843 [37963] http-in app/web-01 1756/0/901/901/1756 404 39224 - - ---- 565/565/35/35/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:27:48.690705-07:00 bastion nginx[1208]: 203.108.190.93 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 30433 "-" "curl/8.4.0" 2026-10-09T13:27:48.713746-07:00 web-03 app[30667]: INFO worker 65 finished job c419351fced96f35 in 9417 ms 2026-10-09T13:27:48.805852-07:00 bastion haproxy[906]: 203.178.141.75:32652 [26608] http-in app/worker-12 6159/0/5/5/6159 500 58257 - - ---- 639/639/83/83/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:27:48.835641-07:00 web-01 haproxy[933]: 172.136.187.63:54880 [85864] http-in app/web-03 254/0/174/174/254 404 26684 - - ---- 475/475/41/41/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:27:48.953166-07:00 cache-3 app[30689]: DEBUG cache hit ratio 52% over the last minute (47783 lookups) 2026-10-09T13:27:49.199748-07:00 web-01 nginx[1208]: 10.117.185.209 - - "GET /favicon.ico HTTP/1.1" 200 81424 "-" "Go-http-client/1.1" 2026-10-09T13:27:49.471493-07:00 edge-fr-1 sshd[56039]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:27:49.677943-07:00 db-replica sshd[19813]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:27:49.917521-07:00 api-07 nginx[1207]: 45.96.7.215 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 48955 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:50.225289-07:00 web-03 nginx[1206]: 192.58.190.184 - - "GET /.env HTTP/1.1" 404 16218 "-" "kube-probe/1.31" 2026-10-09T13:27:50.668498-07:00 api-07 app[30322]: INFO worker 83 finished job f3b78855278a7fe9 in 5122 ms 2026-10-09T13:27:50.695913-07:00 cache-3 app[30949]: ERROR payment declined for order 87269: card_declined (code 37), customer notified 2026-10-09T13:27:50.746117-07:00 edge-fr-1 app[30321]: WARN retrying upstream 10.57.73.248:19765 after timeout (345 ms), attempt 3 of 3 2026-10-09T13:27:50.803943-07:00 api-07 app[30290]: INFO request_id=72c3031a1dcdd836 method=GET path=/.env status=204 duration=289ms 2026-10-09T13:27:50.885565-07:00 web-03 sshd[47630]: Invalid user zoë from 91.113.144.16 port 15711 2026-10-09T13:27:50.894194-07:00 worker-12 haproxy[909]: Server app/api-08 is UP, reason: Layer7 check passed, code: 200, check duration: 957ms. 19 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:27:51.069792-07:00 db-replica nginx[1200]: 45.212.146.34 - - "GET /static/app.js HTTP/1.1" 200 20434 "-" "python-requests/2.32.3" 2026-10-09T13:27:51.632654-07:00 web-01 systemd[1]: Started Session 59732 of User françois. 2026-10-09T13:27:51.660001-07:00 db-replica systemd[1]: Started Session 70865 of User ci. 2026-10-09T13:27:51.754747-07:00 cache-3 haproxy[931]: 91.135.101.113:25975 [18944] http-in app/web-01 9729/0/753/753/9729 200 47216 - - ---- 178/178/68/68/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:27:52.100803-07:00 edge-fr-1 haproxy[929]: 192.82.148.143:46935 [44230] http-in app/api-07 6560/0/248/248/6560 200 54160 - - ---- 622/622/10/10/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:52.257027-07:00 api-08 app[30130]: INFO worker 73 finished job 65f38a7235744b5c in 566 ms 2026-10-09T13:27:52.362640-07:00 api-08 app[30497]: DEBUG cache hit ratio 21% over the last minute (66257 lookups) 2026-10-09T13:27:52.647524-07:00 db-replica sshd[6592]: pam_unix(sshd:session): session opened for user root(uid=6968) by (uid=0) 2026-10-09T13:27:52.765709-07:00 db-replica app[30941]: INFO order 26963 confirmed for root in 7727 ms (region ap-northeast-1, queue emails) 2026-10-09T13:27:52.833121-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:27:52.833121-07:00" level=info msg="Container 20d8f97cc960d3f8 exited with code 0" 2026-10-09T13:27:52.842924-07:00 web-02 nginx[1205]: 10.222.5.27 - priya "POST /admin HTTP/1.1" 301 13298 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:27:53.082941-07:00 web-01 postgres[14549]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 88871 remain, 5979 scanned (82% of total) 2026-10-09T13:27:53.097454-07:00 web-01 dockerd[700]: time="2026-10-09T13:27:53.097454-07:00" level=info msg="Container f02b325e9615c772 exited with code 0" 2026-10-09T13:27:53.222326-07:00 db-primary sshd[34957]: Invalid user root from 91.177.230.152 port 9619 2026-10-09T13:27:53.481019-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:27:53.481019-07:00" level=info msg="Container be542ba17c31dd46 exited with code 0" 2026-10-09T13:27:53.484326-07:00 web-03 app[30932]: INFO request_id=ef4dad697792f4fb method=GET path=/api/v2/search?q=invoice status=302 duration=4703ms 2026-10-09T13:27:53.510034-07:00 web-03 systemd[1]: Started Session 83576 of User zoë. 2026-10-09T13:27:53.674420-07:00 web-02 haproxy[907]: 192.151.76.49:13218 [55750] http-in app/edge-fr-1 4880/0/909/909/4880 200 45824 - - ---- 450/450/72/72/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:27:53.930737-07:00 edge-fr-1 app[30128]: INFO order 15088 confirmed for root in 4690 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:27:53.935722-07:00 db-replica app[30181]: INFO request_id=f58c17623acc092f method=GET path=/api/v2/orders status=204 duration=4747ms 2026-10-09T13:27:53.985488-07:00 web-02 haproxy[909]: 172.71.219.223:9667 [95849] http-in app/api-08 1301/0/549/549/1301 404 73263 - - ---- 699/699/15/15/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:27:54.051865-07:00 edge-fr-1 sshd[46743]: Invalid user akira from 192.139.40.104 port 34938 2026-10-09T13:27:54.154239-07:00 db-primary app[30228]: INFO order 28586 confirmed for priya in 8009 ms (region eu-west-1, queue orders) 2026-10-09T13:27:54.195051-07:00 edge-fr-1 app[30989]: INFO request_id=104ac3d6f5b2eaf9 method=GET path=/wp-login.php status=301 duration=5958ms 2026-10-09T13:27:54.218775-07:00 bastion haproxy[918]: 45.140.100.94:16399 [22472] http-in app/bastion 3718/0/589/589/3718 200 6408 - - ---- 192/192/64/64/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:27:54.251812-07:00 web-01 app[30106]: INFO worker 20 picked job a6eec308328f3f82 from queue invoices 2026-10-09T13:27:54.479312-07:00 worker-12 sshd[51083]: Invalid user zoë from 203.184.251.148 port 34540 2026-10-09T13:27:54.698382-07:00 worker-12 kernel: [89154.960679] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.105.50.43 DST=10.0.206.206 LEN=53 TOS=0x00 PREC=0x00 TTL=53 ID=89154 DF PROTO=TCP SPT=26062 DPT=26062 WINDOW=89154 RES=0x00 SYN URGP=0 2026-10-09T13:27:54.861682-07:00 edge-fr-1 haproxy[904]: 203.227.147.241:64649 [15163] http-in app/web-01 4130/0/690/690/4130 302 55453 - - ---- 101/101/53/53/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:27:54.896809-07:00 api-07 app[30616]: INFO worker 95 picked job 1d560f732393a4b9 from queue emails 2026-10-09T13:27:55.402106-07:00 cache-3 sshd[11585]: pam_unix(sshd:session): session opened for user zoë(uid=8159) by (uid=0) 2026-10-09T13:27:55.507700-07:00 api-08 app[30288]: INFO worker 73 picked job 4881e88038db4c70 from queue invoices 2026-10-09T13:27:55.723762-07:00 worker-12 haproxy[948]: 172.161.254.4:1117 [10960] http-in app/edge-fr-1 3948/0/85/85/3948 204 53542 - - ---- 469/469/80/80/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:27:56.106522-07:00 web-03 haproxy[936]: 203.5.71.40:47014 [63811] http-in app/web-02 273/0/588/588/273 302 62747 - - ---- 988/988/22/22/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:27:56.160773-07:00 bastion sshd[62240]: Connection closed by 45.0.181.8 port 7006 [preauth] 2026-10-09T13:27:56.328881-07:00 api-07 app[30564]: INFO request_id=20ebfb91db1d3c78 method=GET path=/api/v2/orders status=200 duration=4191ms 2026-10-09T13:27:56.375382-07:00 web-02 kernel: [79847.459837] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.168.114.227 DST=10.0.910.910 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=79847 DF PROTO=TCP SPT=10156 DPT=10156 WINDOW=79847 RES=0x00 SYN URGP=0 2026-10-09T13:27:56.500132-07:00 db-primary postgres[28571]: LOG: duration: 8741.165 ms statement: SELECT * FROM orders WHERE customer_id = 71857 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:56.528488-07:00 db-replica nginx[1206]: 172.247.70.251 - - "GET /api/v2/orders HTTP/1.1" 200 43070 "-" "python-requests/2.32.3" 2026-10-09T13:27:56.570049-07:00 web-02 postgres[18953]: LOG: duration: 8915.349 ms statement: SELECT * FROM orders WHERE customer_id = 42554 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:27:56.876068-07:00 db-replica nginx[1204]: 172.48.217.138 - - "GET /static/app.js HTTP/1.1" 204 67773 "-" "python-requests/2.32.3" 2026-10-09T13:27:57.114844-07:00 cache-3 sshd[28469]: Invalid user akira from 192.16.231.183 port 11347 2026-10-09T13:27:57.233665-07:00 bastion haproxy[919]: 172.92.167.7:54640 [25330] http-in app/web-02 1232/0/77/77/1232 200 322 - - ---- 728/728/29/29/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:27:57.296153-07:00 edge-fr-1 app[30633]: INFO request_id=cd7b4df8648d3614 method=GET path=/api/v2/search?q=invoice status=500 duration=7603ms 2026-10-09T13:27:57.395762-07:00 db-primary app[30731]: INFO worker 89 finished job 967ea3a88a296d5f in 9345 ms 2026-10-09T13:27:57.461075-07:00 web-02 app[30232]: INFO request_id=c9996005588419bd method=GET path=/favicon.ico status=204 duration=9063ms 2026-10-09T13:27:57.575438-07:00 api-08 app[30872]: INFO request_id=5512c29ceb9750c8 method=GET path=/api/v2/orders status=200 duration=1111ms 2026-10-09T13:27:57.660226-07:00 cache-3 nginx[1208]: 91.32.102.91 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 30386 "-" "kube-probe/1.31" 2026-10-09T13:27:57.696844-07:00 worker-12 haproxy[912]: 91.117.3.56:50194 [58617] http-in app/cache-3 8244/0/585/585/8244 200 89356 - - ---- 194/194/55/55/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:27:58.158831-07:00 cache-3 nginx[1205]: 10.17.105.171 - - "GET /static/main.css HTTP/1.1" 302 15979 "-" "Go-http-client/1.1" 2026-10-09T13:27:58.209819-07:00 web-01 nginx[1200]: 45.215.111.186 - zoë "POST /favicon.ico HTTP/1.1" 200 7908 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:27:58.568471-07:00 api-07 nginx[1206]: 203.53.77.168 - - "GET /static/main.css HTTP/1.1" 301 33532 "-" "Go-http-client/1.1" 2026-10-09T13:27:58.714150-07:00 db-primary app[30033]: INFO order 26324 confirmed for akira in 765 ms (region eu-west-1, queue emails) 2026-10-09T13:27:58.912994-07:00 cache-3 app[30977]: INFO request_id=86c738d8823bd83a method=GET path=/api/v2/users status=200 duration=8411ms 2026-10-09T13:27:59.031724-07:00 web-02 app[30403]: INFO request_id=819d88c2d3ac18d4 method=GET path=/api/v2/users status=301 duration=294ms 2026-10-09T13:27:59.130316-07:00 web-02 nginx[1209]: 10.33.179.25 - - "GET /static/main.css HTTP/1.1" 204 56751 "-" "kube-probe/1.31" 2026-10-09T13:27:59.356201-07:00 web-02 app[30166]: INFO order 49460 confirmed for backup in 4005 ms (region us-east-1, queue webhooks) 2026-10-09T13:27:59.447260-07:00 web-01 app[30015]: INFO health check ok: db 254 ms, cache 254 ms, queue depth 26 2026-10-09T13:27:59.482010-07:00 cache-3 haproxy[941]: 192.63.194.209:65423 [36700] http-in app/bastion 4809/0/338/338/4809 401 2091 - - ---- 166/166/50/50/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:27:59.786384-07:00 api-08 nginx[1210]: 172.198.119.101 - - "GET /api/v2/orders HTTP/1.1" 502 50867 "-" "kube-probe/1.31" 2026-10-09T13:27:59.979770-07:00 db-primary nginx[1210]: 45.106.245.18 - - "GET /login HTTP/1.1" 502 23077 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:00.007697-07:00 web-01 nginx[1202]: 192.10.72.86 - deploy "POST /admin HTTP/1.1" 401 61068 "-" "python-requests/2.32.3" 2026-10-09T13:28:00.226992-07:00 web-03 haproxy[930]: 91.112.122.121:9300 [91025] http-in app/cache-3 8913/0/540/540/8913 200 79575 - - ---- 870/870/50/50/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:28:00.376839-07:00 cache-3 app[30552]: INFO worker 77 finished job 4a235fbd1ed5227a in 8333 ms 2026-10-09T13:28:00.595904-07:00 edge-fr-1 nginx[1208]: 45.144.43.234 - - "GET /static/app.js HTTP/1.1" 200 60120 "-" "Go-http-client/1.1" 2026-10-09T13:28:00.958926-07:00 db-replica postgres[27460]: LOG: duration: 6246.679 ms statement: SELECT * FROM orders WHERE customer_id = 72072 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:01.040454-07:00 db-replica app[30534]: INFO order 81710 confirmed for deploy in 1564 ms (region eu-west-1, queue invoices) 2026-10-09T13:28:01.063926-07:00 worker-12 app[30973]: INFO request_id=2f3c50888eb1c23f method=GET path=/login status=301 duration=6580ms 2026-10-09T13:28:01.144337-07:00 cache-3 nginx[1208]: 10.188.112.195 - - "GET /login HTTP/1.1" 204 63167 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:01.229624-07:00 web-03 app[30407]: INFO request_id=3c18ee4586dc7f3d method=GET path=/admin status=401 duration=346ms 2026-10-09T13:28:01.237011-07:00 web-01 nginx[1200]: 91.50.97.74 - - "GET /.env HTTP/1.1" 204 76021 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:01.285474-07:00 worker-12 app[30806]: INFO request_id=edbe3ca63ce41802 method=GET path=/health status=204 duration=4996ms 2026-10-09T13:28:01.359292-07:00 edge-fr-1 app[30128]: INFO worker 82 finished job 70732ceee8ea40ce in 548 ms 2026-10-09T13:28:01.683579-07:00 web-03 app[30089]: INFO request_id=452ccf3dac4216fb method=GET path=/.env status=502 duration=6235ms 2026-10-09T13:28:01.810125-07:00 api-08 app[30491]: INFO request_id=0a6397c2a8ab1f97 method=GET path=/api/v2/search?q=invoice status=500 duration=6625ms 2026-10-09T13:28:01.871392-07:00 bastion app[30492]: INFO worker 93 picked job 463727287340edcf from queue emails 2026-10-09T13:28:02.066870-07:00 api-07 app[30153]: WARN slow query (1109 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '53 minutes' 2026-10-09T13:28:02.107151-07:00 bastion systemd[1]: Started Session 73176 of User akira. 2026-10-09T13:28:02.111459-07:00 api-08 app[30802]: DEBUG cache hit ratio 50% over the last minute (10634 lookups) 2026-10-09T13:28:02.127680-07:00 api-07 sshd[33484]: Connection closed by 172.132.63.197 port 65465 [preauth] 2026-10-09T13:28:02.381122-07:00 api-08 app[30194]: INFO request_id=e662bdf96d46d4c2 method=GET path=/login status=204 duration=6645ms 2026-10-09T13:28:02.510055-07:00 web-02 app[30126]: INFO order 70618 confirmed for sørensen in 3484 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:28:02.571721-07:00 db-primary nginx[1205]: 10.35.184.35 - - "GET /static/main.css HTTP/1.1" 401 38009 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:02.583181-07:00 db-replica app[30680]: INFO order 38057 confirmed for françois in 5297 ms (region eu-west-1, queue orders) 2026-10-09T13:28:02.728516-07:00 web-01 app[30199]: INFO request_id=d95901f0720a3cd6 method=GET path=/api/v2/search?q=invoice status=404 duration=797ms 2026-10-09T13:28:02.810601-07:00 cache-3 sshd[7535]: Received disconnect from 192.216.46.196 port 59123:11: Bye Bye [preauth] 2026-10-09T13:28:02.828671-07:00 worker-12 app[30765]: ERROR cache miss storm: 9768 misses in 6463 ms, key prefix session:deploy 2026-10-09T13:28:02.877701-07:00 api-07 app[30735]: INFO request_id=f69575befcdeaba2 method=GET path=/api/v2/search?q=invoice status=404 duration=7790ms 2026-10-09T13:28:02.928610-07:00 bastion sshd[42104]: Connection closed by 172.169.181.215 port 35206 [preauth] 2026-10-09T13:28:03.022162-07:00 web-02 app[30775]: INFO health check ok: db 72 ms, cache 72 ms, queue depth 69 2026-10-09T13:28:03.244594-07:00 db-replica app[30054]: INFO request_id=89884d724d5e3a85 method=GET path=/static/main.css status=302 duration=9266ms 2026-10-09T13:28:03.262291-07:00 worker-12 app[30842]: INFO worker 68 picked job 230b682b7a11746b from queue orders 2026-10-09T13:28:03.315990-07:00 cache-3 app[30903]: INFO worker 12 finished job 1b3a9f1ee011fa8b in 8293 ms 2026-10-09T13:28:03.384525-07:00 web-01 sshd[28106]: Failed password for invalid user sørensen from 172.137.15.246 port 54598 ssh2 2026-10-09T13:28:03.431750-07:00 worker-12 haproxy[948]: 45.171.149.6:60311 [56894] http-in app/api-07 7608/0/860/860/7608 502 72660 - - ---- 511/511/95/95/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:03.477594-07:00 cache-3 haproxy[931]: 203.246.47.153:11901 [28890] http-in app/api-08 835/0/784/784/835 200 74091 - - ---- 720/720/35/35/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:03.487726-07:00 web-01 haproxy[930]: 192.0.215.185:23601 [28953] http-in app/db-primary 3783/0/998/998/3783 200 83487 - - ---- 871/871/32/32/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:28:03.519591-07:00 edge-fr-1 nginx[1205]: 10.70.242.240 - - "GET /api/v2/users HTTP/1.1" 404 89345 "-" "Go-http-client/1.1" 2026-10-09T13:28:03.756249-07:00 api-08 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:28:03.925280-07:00 web-02 dockerd[700]: time="2026-10-09T13:28:03.925280-07:00" level=info msg="Container 709592105d175460 exited with code 0" 2026-10-09T13:28:04.185977-07:00 bastion nginx[1205]: 10.252.27.115 - - "GET /metrics HTTP/1.1" 200 67445 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:04.325701-07:00 worker-12 app[30741]: INFO order 26598 confirmed for ci in 4990 ms (region ap-northeast-1, queue orders) 2026-10-09T13:28:04.328274-07:00 bastion sshd[36152]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:28:04.419468-07:00 api-08 app[30144]: INFO order 65682 confirmed for root in 7346 ms (region us-east-1, queue orders) 2026-10-09T13:28:04.659931-07:00 db-primary nginx[1207]: 172.130.249.172 - - "GET /metrics HTTP/1.1" 200 62681 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:04.754529-07:00 worker-12 haproxy[908]: 10.84.167.212:24005 [39421] http-in app/bastion 1890/0/362/362/1890 200 18827 - - ---- 386/386/20/20/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:28:04.977885-07:00 web-01 app[30768]: DEBUG cache hit ratio 82% over the last minute (73448 lookups) 2026-10-09T13:28:05.121582-07:00 edge-fr-1 postgres[8505]: LOG: duration: 9725.657 ms statement: SELECT * FROM orders WHERE customer_id = 16177 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:05.158544-07:00 web-02 app[30617]: INFO order 77339 confirmed for akira in 2718 ms (region us-east-1, queue webhooks) 2026-10-09T13:28:05.169678-07:00 bastion systemd[1]: session-48814.scope: Deactivated successfully. 2026-10-09T13:28:05.176037-07:00 bastion app[30663]: INFO request_id=75318ef557f45f9d method=GET path=/api/v2/orders/8841 status=200 duration=272ms 2026-10-09T13:28:05.454085-07:00 db-replica sshd[41822]: Accepted publickey for zoë from 45.183.226.158 port 30891 ssh2: ED25519 SHA256:1c876fb2976f4fc0 2026-10-09T13:28:05.482335-07:00 bastion kubelet[800]: E1009 13:28:05.359725 5567 pod_workers.go:5567] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-87a9006a3da31bc1" 2026-10-09T13:28:05.926695-07:00 web-03 app[30378]: INFO health check ok: db 793 ms, cache 793 ms, queue depth 91 2026-10-09T13:28:05.977479-07:00 worker-12 postgres[14623]: LOG: duration: 2528.256 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:06.051122-07:00 edge-fr-1 nginx[1200]: 172.221.161.39 - root "POST /api/v2/search?q=invoice HTTP/1.1" 502 12873 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:06.312590-07:00 worker-12 systemd[1]: session-92415.scope: Deactivated successfully. 2026-10-09T13:28:06.351115-07:00 web-02 nginx[1203]: 192.19.51.173 - - "GET /static/main.css HTTP/1.1" 302 69935 "-" "curl/8.4.0" 2026-10-09T13:28:06.460050-07:00 web-03 sshd[10634]: pam_unix(sshd:session): session opened for user ci(uid=6387) by (uid=0) 2026-10-09T13:28:06.574594-07:00 web-03 app[30326]: WARN slow query (3083 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '74 minutes' 2026-10-09T13:28:06.764455-07:00 api-07 sshd[22142]: Failed password for invalid user françois from 45.45.80.10 port 55661 ssh2 2026-10-09T13:28:06.790606-07:00 web-01 nginx[1205]: 91.171.205.109 - - "GET /favicon.ico HTTP/1.1" 500 61553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:06.824181-07:00 bastion haproxy[902]: 10.55.94.94:47166 [61693] http-in app/web-03 2336/0/11/11/2336 301 9386 - - ---- 595/595/12/12/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:28:06.891310-07:00 db-primary nginx[1208]: 172.194.150.23 - - "GET /favicon.ico HTTP/1.1" 200 64362 "-" "python-requests/2.32.3" 2026-10-09T13:28:07.003628-07:00 web-02 sshd[2349]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:28:07.155954-07:00 bastion nginx[1202]: 10.39.95.168 - - "GET /api/v2/orders HTTP/1.1" 401 71806 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:07.233977-07:00 web-02 app[30460]: INFO order 68023 confirmed for sørensen in 6690 ms (region eu-west-1, queue emails) 2026-10-09T13:28:07.275562-07:00 api-08 sshd[5326]: Failed password for invalid user akira from 45.150.113.81 port 55360 ssh2 2026-10-09T13:28:07.312152-07:00 worker-12 app[30206]: WARN retrying upstream 203.43.226.254:22042 after timeout (6374 ms), attempt 3 of 3 2026-10-09T13:28:07.330005-07:00 web-03 sshd[22155]: pam_unix(sshd:session): session opened for user zoë(uid=6397) by (uid=0) 2026-10-09T13:28:07.555871-07:00 api-08 sshd[44955]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:28:07.572600-07:00 db-primary app[30251]: DEBUG cache hit ratio 41% over the last minute (44696 lookups) 2026-10-09T13:28:08.438138-07:00 worker-12 haproxy[934]: 192.4.191.9:42706 [76846] http-in app/edge-fr-1 5885/0/215/215/5885 404 62380 - - ---- 268/268/23/23/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:28:08.507207-07:00 web-02 app[30353]: INFO request_id=5778bac309a1b58b method=GET path=/api/v2/search?q=invoice status=200 duration=1194ms 2026-10-09T13:28:08.537598-07:00 bastion postgres[10283]: LOG: checkpoint complete: wrote 5152 buffers (76%); 0 WAL file(s) added, 0 removed, 14 recycled; write=4968.112 s, sync=0.112 s, total=4968.112 s 2026-10-09T13:28:08.744975-07:00 edge-fr-1 app[30600]: INFO order 66892 confirmed for müller in 4453 ms (region us-east-1, queue orders) 2026-10-09T13:28:08.838606-07:00 api-07 nginx[1206]: 192.110.182.246 - - "GET /metrics HTTP/1.1" 200 31588 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:09.071824-07:00 api-08 app[30517]: INFO request_id=97c8d8a96e20988e method=GET path=/api/v2/users status=500 duration=1996ms 2026-10-09T13:28:09.230578-07:00 edge-fr-1 postgres[5554]: LOG: duration: 791.42 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:09.317727-07:00 edge-fr-1 nginx[1202]: 192.60.63.110 - - "GET /static/app.js HTTP/1.1" 301 20000 "-" "Go-http-client/1.1" 2026-10-09T13:28:09.329369-07:00 api-08 dockerd[700]: time="2026-10-09T13:28:09.329369-07:00" level=info msg="Container 50752bb10e12ae87 exited with code 0" 2026-10-09T13:28:09.416668-07:00 api-07 sshd[25557]: Invalid user root from 172.66.245.171 port 45609 2026-10-09T13:28:09.540191-07:00 api-07 nginx[1204]: 172.241.202.213 - - "GET /api/v2/users HTTP/1.1" 401 81500 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:09.742667-07:00 web-02 app[30150]: INFO request_id=6246c64cb045385e method=GET path=/login status=200 duration=8640ms 2026-10-09T13:28:09.834307-07:00 web-02 nginx[1201]: 172.214.215.41 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 52992 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:09.877604-07:00 bastion app[30685]: INFO health check ok: db 441 ms, cache 441 ms, queue depth 94 2026-10-09T13:28:09.899684-07:00 db-primary sshd[14780]: Received disconnect from 45.49.215.168 port 63902:11: Bye Bye [preauth] 2026-10-09T13:28:10.251616-07:00 web-02 sshd[61512]: Received disconnect from 172.213.111.126 port 58807:11: Bye Bye [preauth] 2026-10-09T13:28:10.333618-07:00 web-03 haproxy[948]: 172.178.186.200:14221 [19214] http-in app/db-replica 8159/0/102/102/8159 204 81933 - - ---- 164/164/51/51/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:28:10.362003-07:00 worker-12 haproxy[923]: 91.98.239.46:41072 [23336] http-in app/db-primary 3856/0/396/396/3856 200 84712 - - ---- 313/313/49/49/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:28:10.427512-07:00 api-07 nginx[1210]: 45.205.232.180 - - "GET /metrics HTTP/1.1" 200 310 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:10.450306-07:00 web-01 app[30369]: INFO worker 19 finished job e44aa1a8e096c41f in 207 ms 2026-10-09T13:28:10.579873-07:00 web-01 systemd[1]: Started Session 82456 of User françois. 2026-10-09T13:28:10.743697-07:00 api-08 nginx[1207]: 192.202.121.39 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 51181 "-" "python-requests/2.32.3" 2026-10-09T13:28:10.966230-07:00 db-primary nginx[1208]: 192.134.61.195 - müller "POST /admin HTTP/1.1" 200 79627 "-" "python-requests/2.32.3" 2026-10-09T13:28:11.325763-07:00 worker-12 nginx[1204]: 10.90.138.159 - - "GET /login HTTP/1.1" 301 18385 "-" "Go-http-client/1.1" 2026-10-09T13:28:11.385224-07:00 web-02 app[30965]: INFO request_id=cc2904387c858368 method=GET path=/metrics status=200 duration=6743ms 2026-10-09T13:28:11.580893-07:00 web-01 sshd[45734]: Received disconnect from 172.221.54.59 port 36016:11: Bye Bye [preauth] 2026-10-09T13:28:11.593866-07:00 api-07 app[30641]: INFO health check ok: db 544 ms, cache 544 ms, queue depth 11 2026-10-09T13:28:11.776112-07:00 db-replica sshd[49127]: Connection closed by 192.118.114.189 port 2698 [preauth] 2026-10-09T13:28:12.045558-07:00 api-07 haproxy[945]: 172.59.1.215:62030 [73846] http-in app/db-replica 264/0/258/258/264 404 89635 - - ---- 467/467/99/99/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:28:12.096350-07:00 api-08 app[30973]: INFO order 38840 confirmed for deploy in 5975 ms (region eu-west-1, queue invoices) 2026-10-09T13:28:12.102275-07:00 web-02 postgres[19125]: LOG: duration: 8890.513 ms statement: SELECT * FROM orders WHERE customer_id = 76590 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:12.251611-07:00 web-03 sshd[44541]: Accepted publickey for sørensen from 172.39.21.216 port 32148 ssh2: ED25519 SHA256:b7040e593fc6d4ee 2026-10-09T13:28:12.439477-07:00 web-01 haproxy[947]: 45.255.43.152:13230 [60579] http-in app/db-primary 1477/0/293/293/1477 401 31951 - - ---- 506/506/84/84/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:28:12.526798-07:00 cache-3 app[30437]: INFO health check ok: db 15 ms, cache 15 ms, queue depth 53 2026-10-09T13:28:12.653633-07:00 api-08 app[30827]: INFO request_id=1be6bbc8b1418298 method=GET path=/wp-login.php status=404 duration=4960ms 2026-10-09T13:28:12.657248-07:00 worker-12 haproxy[945]: 203.202.251.231:5314 [66747] http-in app/api-08 4239/0/839/839/4239 200 25622 - - ---- 386/386/70/70/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:28:12.790735-07:00 web-01 systemd[1]: Started Session 62305 of User zoë. 2026-10-09T13:28:12.840060-07:00 api-08 app[30121]: INFO worker 88 picked job a245533d9faa86e0 from queue orders 2026-10-09T13:28:12.996458-07:00 bastion app[30839]: INFO worker 52 finished job 6dd1aa2571d6b5b2 in 5509 ms 2026-10-09T13:28:13.066475-07:00 edge-fr-1 postgres[5989]: LOG: duration: 2823.891 ms statement: SELECT * FROM orders WHERE customer_id = 70032 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:13.189787-07:00 db-replica app[30212]: INFO request_id=6bd8dc190b2eb2e5 method=GET path=/api/v2/users status=200 duration=1120ms 2026-10-09T13:28:13.283677-07:00 db-primary postgres[8212]: LOG: duration: 3062.352 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:13.345166-07:00 web-02 nginx[1203]: 91.82.28.187 - - "GET /health HTTP/1.1" 401 48437 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:13.580893-07:00 web-03 nginx[1208]: 172.122.168.28 - - "GET /api/v2/users HTTP/1.1" 301 81166 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:13.596785-07:00 bastion nginx[1203]: 10.82.124.108 - ci "POST /api/v2/users HTTP/1.1" 502 38620 "-" "Go-http-client/1.1" 2026-10-09T13:28:13.712496-07:00 web-03 sshd[25562]: Connection closed by 172.38.148.226 port 51027 [preauth] 2026-10-09T13:28:13.925833-07:00 edge-fr-1 nginx[1201]: 203.224.51.75 - müller "POST /static/main.css HTTP/1.1" 500 33132 "-" "kube-probe/1.31" 2026-10-09T13:28:13.968142-07:00 db-replica nginx[1204]: 91.72.116.96 - - "GET /api/v2/orders HTTP/1.1" 200 53722 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:14.030718-07:00 db-primary nginx[1202]: 45.12.118.106 - root "POST /static/main.css HTTP/1.1" 302 13406 "-" "python-requests/2.32.3" 2026-10-09T13:28:14.040849-07:00 db-replica haproxy[944]: 192.47.106.157:38739 [71749] http-in app/api-08 9009/0/787/787/9009 200 20610 - - ---- 448/448/77/77/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:28:14.084159-07:00 cache-3 systemd[1]: Started Session 41308 of User ci. 2026-10-09T13:28:14.121031-07:00 api-08 sshd[37815]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:28:14.140129-07:00 edge-fr-1 haproxy[922]: 10.100.145.76:59882 [21085] http-in app/bastion 7375/0/335/335/7375 404 45913 - - ---- 180/180/18/18/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:28:14.143383-07:00 db-primary sshd[56687]: Connection closed by 203.127.177.108 port 46474 [preauth] 2026-10-09T13:28:14.202839-07:00 db-primary postgres[16504]: LOG: duration: 5679.697 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:14.341005-07:00 web-01 kernel: [23288.642159] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.144.182.141 DST=10.0.533.533 LEN=98 TOS=0x00 PREC=0x00 TTL=98 ID=23288 DF PROTO=TCP SPT=14376 DPT=14376 WINDOW=23288 RES=0x00 SYN URGP=0 2026-10-09T13:28:14.428014-07:00 worker-12 app[30702]: DEBUG cache hit ratio 61% over the last minute (79918 lookups) 2026-10-09T13:28:14.589874-07:00 api-07 app[30308]: WARN slow query (329 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '51 minutes' 2026-10-09T13:28:14.619882-07:00 bastion app[30998]: INFO worker 91 finished job aadb7906156bda59 in 2731 ms 2026-10-09T13:28:14.670312-07:00 worker-12 sshd[22465]: Connection closed by 192.80.32.164 port 59606 [preauth] 2026-10-09T13:28:14.718515-07:00 api-07 sshd[33729]: Failed password for invalid user root from 45.129.45.128 port 1096 ssh2 2026-10-09T13:28:14.778916-07:00 api-08 nginx[1205]: 172.58.96.236 - deploy "POST /health HTTP/1.1" 301 1848 "-" "curl/8.4.0" 2026-10-09T13:28:14.808786-07:00 web-01 postgres[9223]: LOG: duration: 3063.701 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:14.935605-07:00 db-replica systemd[1]: session-15219.scope: Deactivated successfully. 2026-10-09T13:28:15.078202-07:00 db-primary cron[57332]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:28:15.145550-07:00 api-08 sshd[7442]: Accepted publickey for zoë from 91.224.145.48 port 35897 ssh2: ED25519 SHA256:e5d8be7761b57624 2026-10-09T13:28:15.167505-07:00 cache-3 app[30136]: INFO request_id=322d5cb106347ddd method=GET path=/health status=200 duration=1492ms 2026-10-09T13:28:15.226442-07:00 web-02 app[30481]: INFO worker 30 finished job 6c8031a10d818130 in 9020 ms 2026-10-09T13:28:15.229196-07:00 web-02 app[30859]: INFO worker 18 picked job ea79f1566dd1a139 from queue webhooks 2026-10-09T13:28:15.399066-07:00 db-replica haproxy[937]: 10.141.169.71:23479 [16937] http-in app/edge-fr-1 5439/0/104/104/5439 200 3783 - - ---- 487/487/49/49/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:28:15.455479-07:00 bastion nginx[1203]: 172.165.33.42 - - "GET /static/app.js HTTP/1.1" 404 17492 "-" "curl/8.4.0" 2026-10-09T13:28:15.661217-07:00 web-02 app[30494]: INFO worker 31 finished job c4f9e74b7a38ab4f in 6284 ms 2026-10-09T13:28:15.991547-07:00 web-02 sshd[46385]: Connection closed by 45.153.215.167 port 2203 [preauth] 2026-10-09T13:28:16.002296-07:00 api-07 sshd[33454]: Failed password for invalid user deploy from 203.157.209.3 port 60685 ssh2 2026-10-09T13:28:16.307248-07:00 api-08 postgres[14414]: LOG: duration: 4438.500 ms statement: SELECT * FROM orders WHERE customer_id = 28884 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:16.325499-07:00 bastion nginx[1206]: 192.118.222.110 - - "GET /login HTTP/1.1" 502 11859 "-" "curl/8.4.0" 2026-10-09T13:28:16.386106-07:00 web-01 postgres[25032]: LOG: checkpoint complete: wrote 9451 buffers (4%); 0 WAL file(s) added, 0 removed, 25 recycled; write=7216.484 s, sync=0.484 s, total=7216.484 s 2026-10-09T13:28:16.423698-07:00 db-primary nginx[1203]: 192.8.73.105 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 71913 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:16.641242-07:00 db-replica app[30447]: INFO worker 71 finished job 510ab4ff0eb54e85 in 587 ms 2026-10-09T13:28:16.698596-07:00 web-01 app[30708]: INFO worker 50 picked job ae022e5c366c7706 from queue orders 2026-10-09T13:28:17.284074-07:00 web-01 postgres[24664]: LOG: duration: 4491.327 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:17.356964-07:00 api-07 nginx[1207]: 203.66.79.68 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 80029 "-" "kube-probe/1.31" 2026-10-09T13:28:17.439127-07:00 edge-fr-1 sshd[3563]: Failed password for invalid user akira from 172.231.195.228 port 64271 ssh2 2026-10-09T13:28:17.504771-07:00 api-08 sshd[54198]: Failed password for invalid user françois from 172.78.240.59 port 37055 ssh2 2026-10-09T13:28:17.613432-07:00 bastion nginx[1206]: 172.195.76.203 - - "GET /wp-login.php HTTP/1.1" 204 64540 "-" "kube-probe/1.31" 2026-10-09T13:28:17.732515-07:00 bastion sshd[19394]: Accepted publickey for ci from 172.198.20.156 port 22218 ssh2: ED25519 SHA256:0550f5ff0daee318 2026-10-09T13:28:17.803695-07:00 api-07 postgres[7532]: LOG: checkpoint complete: wrote 8043 buffers (25%); 0 WAL file(s) added, 0 removed, 39 recycled; write=8791.784 s, sync=0.784 s, total=8791.784 s 2026-10-09T13:28:17.879721-07:00 api-08 sshd[26930]: pam_unix(sshd:session): session opened for user müller(uid=9193) by (uid=0) 2026-10-09T13:28:18.027452-07:00 api-08 app[30329]: INFO health check ok: db 738 ms, cache 738 ms, queue depth 12 2026-10-09T13:28:18.105051-07:00 web-03 app[30359]: INFO request_id=0e5259de6d146a1c method=GET path=/login status=404 duration=1471ms 2026-10-09T13:28:18.361300-07:00 cache-3 systemd[1]: session-95435.scope: Deactivated successfully. 2026-10-09T13:28:18.562665-07:00 web-01 app[30206]: INFO request_id=3dc6e9fac690edae method=GET path=/metrics status=302 duration=209ms 2026-10-09T13:28:18.621130-07:00 web-03 app[30682]: INFO order 64503 confirmed for sørensen in 3330 ms (region us-east-1, queue webhooks) 2026-10-09T13:28:18.629451-07:00 edge-fr-1 haproxy[946]: 10.78.69.65:17854 [55819] http-in app/api-07 3715/0/170/170/3715 502 49491 - - ---- 822/822/38/38/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:28:18.998078-07:00 worker-12 app[30435]: INFO order 48379 confirmed for root in 5904 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:28:19.009310-07:00 cache-3 app[30867]: INFO order 17089 confirmed for priya in 6244 ms (region us-east-1, queue emails) 2026-10-09T13:28:19.131379-07:00 web-02 nginx[1201]: 192.114.50.19 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 76574 "-" "kube-probe/1.31" 2026-10-09T13:28:19.405520-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577699.706:35069): pid=35069 uid=0 auid=8991 ses=608 msg='op=login id=8991 exe="/usr/sbin/sshd" hostname=? addr=203.251.216.79 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:19.654239-07:00 db-replica app[30750]: INFO order 41565 confirmed for ci in 4089 ms (region eu-west-1, queue invoices) 2026-10-09T13:28:19.705754-07:00 web-02 sshd[18322]: Connection closed by 91.64.67.168 port 30630 [preauth] 2026-10-09T13:28:19.757808-07:00 web-01 postgres[20356]: LOG: checkpoint complete: wrote 5391 buffers (0%); 0 WAL file(s) added, 0 removed, 68 recycled; write=1791.752 s, sync=0.752 s, total=1791.752 s 2026-10-09T13:28:19.917946-07:00 cache-3 nginx[1207]: 91.103.182.92 - - "GET /api/v2/orders HTTP/1.1" 200 23534 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:19.976881-07:00 edge-fr-1 app[30270]: WARN retrying upstream 10.121.60.245:56497 after timeout (7547 ms), attempt 2 of 3 2026-10-09T13:28:19.978116-07:00 api-07 nginx[1202]: 172.116.59.198 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 25786 "-" "kube-probe/1.31" 2026-10-09T13:28:20.114449-07:00 edge-fr-1 app[30788]: ERROR payment declined for order 22763: card_declined (code 60), customer notified 2026-10-09T13:28:20.129023-07:00 web-02 haproxy[904]: 10.243.156.167:57924 [86543] http-in app/db-replica 6272/0/412/412/6272 301 67770 - - ---- 390/390/12/12/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:28:20.235872-07:00 web-02 nginx[1204]: 91.76.74.33 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 29742 "-" "curl/8.4.0" 2026-10-09T13:28:20.448442-07:00 bastion nginx[1203]: 91.10.226.1 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 57691 "-" "python-requests/2.32.3" 2026-10-09T13:28:20.496827-07:00 web-01 nginx[1200]: 91.5.1.187 - - "GET /admin HTTP/1.1" 301 31891 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:20.564531-07:00 web-03 app[30474]: INFO worker 35 picked job e63654de37a5a33d from queue emails 2026-10-09T13:28:20.590359-07:00 api-07 app[30064]: INFO request_id=01f9264f68900f0c method=GET path=/.env status=500 duration=9445ms 2026-10-09T13:28:20.702173-07:00 web-02 sshd[15247]: Connection closed by 203.148.199.70 port 35787 [preauth] 2026-10-09T13:28:20.975219-07:00 bastion systemd[1]: session-17873.scope: Deactivated successfully. 2026-10-09T13:28:21.166903-07:00 cache-3 app[30250]: WARN slow query (3662 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '13 minutes' 2026-10-09T13:28:21.275877-07:00 worker-12 app[30026]: INFO worker 65 picked job bebf747bbc9a84c9 from queue emails 2026-10-09T13:28:21.289591-07:00 api-07 app[30536]: INFO worker 72 finished job 11c5a058ab5169ec in 9978 ms 2026-10-09T13:28:21.394548-07:00 bastion app[30388]: INFO request_id=78790c44cea83770 method=GET path=/login status=404 duration=5989ms 2026-10-09T13:28:21.528832-07:00 api-08 haproxy[939]: 192.45.214.239:46348 [56062] http-in app/db-primary 8280/0/4/4/8280 404 21004 - - ---- 637/637/39/39/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:28:21.714040-07:00 web-03 app[30550]: INFO request_id=5184ec32021435c1 method=GET path=/static/main.css status=200 duration=4399ms 2026-10-09T13:28:21.732905-07:00 db-primary app[30987]: INFO worker 42 finished job a6f805cb719c5fb2 in 4665 ms 2026-10-09T13:28:21.784789-07:00 api-07 nginx[1206]: 192.147.74.12 - - "GET /health HTTP/1.1" 500 49932 "-" "kube-probe/1.31" 2026-10-09T13:28:21.839002-07:00 cache-3 app[30541]: INFO order 39338 confirmed for ci in 6799 ms (region us-east-1, queue invoices) 2026-10-09T13:28:21.897222-07:00 bastion app[30500]: WARN slow query (2918 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '74 minutes' 2026-10-09T13:28:22.215353-07:00 db-replica app[30130]: INFO request_id=aebbd009fba5004d method=GET path=/favicon.ico status=200 duration=6548ms 2026-10-09T13:28:22.230456-07:00 cache-3 app[30514]: INFO request_id=db0bb55d83ad6265 method=GET path=/api/v2/users status=200 duration=9956ms 2026-10-09T13:28:22.299005-07:00 web-01 postgres[8463]: LOG: duration: 4958.146 ms statement: SELECT * FROM orders WHERE customer_id = 11280 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:22.384355-07:00 api-08 sshd[25824]: Received disconnect from 91.19.232.201 port 47091:11: Bye Bye [preauth] 2026-10-09T13:28:22.658466-07:00 edge-fr-1 sshd[6367]: Failed password for invalid user deploy from 192.48.255.219 port 32983 ssh2 2026-10-09T13:28:22.801680-07:00 db-replica systemd[1]: Started Session 49784 of User root. 2026-10-09T13:28:22.959041-07:00 edge-fr-1 sshd[57115]: Invalid user müller from 45.238.41.44 port 5956 2026-10-09T13:28:23.073005-07:00 web-03 app[30509]: INFO worker 35 finished job 460456028ff43207 in 6032 ms 2026-10-09T13:28:23.323157-07:00 bastion app[30024]: INFO worker 92 picked job 446a15918d99ae5f from queue invoices 2026-10-09T13:28:23.341136-07:00 db-replica sshd[40590]: Accepted publickey for akira from 91.139.21.50 port 29709 ssh2: ED25519 SHA256:88606d60364af234 2026-10-09T13:28:23.514126-07:00 api-07 sshd[57349]: Failed password for invalid user müller from 203.155.27.54 port 12331 ssh2 2026-10-09T13:28:23.597492-07:00 db-primary sshd[11065]: Connection closed by 172.107.236.135 port 18351 [preauth] 2026-10-09T13:28:23.646764-07:00 api-08 app[30416]: WARN slow query (2833 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '29 minutes' 2026-10-09T13:28:23.812384-07:00 api-08 systemd[1]: session-95662.scope: Deactivated successfully. 2026-10-09T13:28:23.866673-07:00 db-replica sshd[46819]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:28:23.871408-07:00 api-07 app[30652]: INFO worker 66 finished job 937d21565e141467 in 5516 ms 2026-10-09T13:28:24.186098-07:00 api-08 app[30338]: INFO health check ok: db 960 ms, cache 960 ms, queue depth 53 2026-10-09T13:28:24.218020-07:00 cache-3 app[30080]: INFO request_id=944715616e8266f3 method=GET path=/admin status=200 duration=820ms 2026-10-09T13:28:24.239355-07:00 api-07 sshd[31722]: Accepted publickey for zoë from 91.60.72.4 port 35576 ssh2: ED25519 SHA256:13c0918df3c778b0 2026-10-09T13:28:24.434085-07:00 web-02 app[30774]: INFO request_id=5f657b884014297c method=GET path=/api/v2/orders status=200 duration=4511ms 2026-10-09T13:28:24.477699-07:00 worker-12 app[30639]: INFO request_id=46691add5b60f985 method=GET path=/health status=200 duration=805ms 2026-10-09T13:28:24.493575-07:00 api-08 app[30382]: INFO request_id=769881ca26fc7202 method=GET path=/favicon.ico status=404 duration=1948ms 2026-10-09T13:28:24.782907-07:00 db-replica app[30986]: INFO request_id=041c39658e4dd090 method=GET path=/.env status=404 duration=2043ms 2026-10-09T13:28:24.796869-07:00 web-01 postgres[30058]: LOG: duration: 710.775 ms statement: SELECT * FROM orders WHERE customer_id = 37863 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:24.850710-07:00 web-02 app[30912]: INFO worker 50 finished job 811aa4d50e6e8185 in 3089 ms 2026-10-09T13:28:24.913841-07:00 db-replica postgres[23429]: LOG: duration: 5013.635 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:24.986640-07:00 db-primary app[30989]: INFO order 85655 confirmed for ci in 1442 ms (region us-east-1, queue invoices) 2026-10-09T13:28:25.168784-07:00 api-08 app[30769]: INFO health check ok: db 229 ms, cache 229 ms, queue depth 21 2026-10-09T13:28:25.210795-07:00 bastion app[30369]: INFO order 11159 confirmed for ci in 2411 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:28:25.524642-07:00 db-replica nginx[1202]: 91.200.161.241 - ci "POST /.env HTTP/1.1" 200 32633 "-" "Go-http-client/1.1" 2026-10-09T13:28:25.953052-07:00 cache-3 kubelet[800]: I1009 13:28:25.204458 4684 kubelet.go:4684] "Pod is terminating, skipping pod status update" pod="default/api-60046bba47696dab" 2026-10-09T13:28:25.954214-07:00 db-primary sshd[25226]: Received disconnect from 91.148.144.77 port 2867:11: Bye Bye [preauth] 2026-10-09T13:28:25.988524-07:00 api-08 nginx[1202]: 10.246.157.119 - ci "POST /.env HTTP/1.1" 404 60789 "-" "python-requests/2.32.3" 2026-10-09T13:28:26.147153-07:00 api-07 haproxy[910]: 172.9.67.176:57870 [39073] http-in app/worker-12 6453/0/32/32/6453 401 80267 - - ---- 532/532/83/83/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:26.628287-07:00 worker-12 app[30221]: INFO health check ok: db 707 ms, cache 707 ms, queue depth 82 2026-10-09T13:28:26.677005-07:00 api-08 nginx[1204]: 203.252.214.76 - - "GET /static/app.js HTTP/1.1" 200 61505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:26.746306-07:00 worker-12 dockerd[700]: time="2026-10-09T13:28:26.746306-07:00" level=info msg="Container 31b90b5a9dfe8fa0 exited with code 0" 2026-10-09T13:28:26.750120-07:00 db-primary app[30070]: INFO order 90447 confirmed for ci in 1499 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:28:26.924555-07:00 web-02 nginx[1203]: 192.84.99.34 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 62359 "-" "curl/8.4.0" 2026-10-09T13:28:26.930237-07:00 web-01 systemd[1]: session-40914.scope: Deactivated successfully. 2026-10-09T13:28:26.965735-07:00 api-08 app[30823]: INFO worker 57 picked job 16da994a695fcc3f from queue orders 2026-10-09T13:28:27.026122-07:00 edge-fr-1 nginx[1200]: 10.251.116.178 - - "GET /health HTTP/1.1" 200 14184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:27.216115-07:00 edge-fr-1 nginx[1203]: 10.37.123.48 - - "GET /favicon.ico HTTP/1.1" 302 37769 "-" "Go-http-client/1.1" 2026-10-09T13:28:27.274199-07:00 web-02 haproxy[901]: 203.78.51.193:43439 [10029] http-in app/db-primary 4678/0/753/753/4678 301 54223 - - ---- 621/621/75/75/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:28:27.458616-07:00 api-07 app[30227]: INFO request_id=ef4d1553e3f5f163 method=GET path=/api/v2/search?q=invoice status=401 duration=9694ms 2026-10-09T13:28:27.514556-07:00 api-08 postgres[20291]: LOG: duration: 1155.289 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:27.603543-07:00 web-02 nginx[1204]: 172.44.237.102 - - "GET /.env HTTP/1.1" 200 17456 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:27.790527-07:00 web-03 app[30778]: INFO request_id=e9c2660aa2a2a360 method=GET path=/metrics status=200 duration=180ms 2026-10-09T13:28:27.870177-07:00 web-03 haproxy[930]: 10.59.32.16:26585 [67508] http-in app/db-replica 9426/0/201/201/9426 404 66712 - - ---- 357/357/14/14/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:28:27.907969-07:00 web-01 nginx[1209]: 172.237.138.81 - - "GET /.env HTTP/1.1" 200 23041 "-" "curl/8.4.0" 2026-10-09T13:28:27.990112-07:00 web-01 nginx[1203]: 192.52.78.126 - - "GET /wp-login.php HTTP/1.1" 401 70655 "-" "kube-probe/1.31" 2026-10-09T13:28:28.292986-07:00 db-primary sshd[2240]: Accepted publickey for ci from 172.231.213.228 port 36241 ssh2: ED25519 SHA256:fb867d2118d9ff44 2026-10-09T13:28:28.327031-07:00 edge-fr-1 sshd[28811]: Received disconnect from 192.17.150.66 port 9449:11: Bye Bye [preauth] 2026-10-09T13:28:28.379303-07:00 edge-fr-1 kubelet[800]: I1009 13:28:28.541392 1263 kubelet.go:1263] "Pod is terminating, skipping pod status update" pod="default/api-5f9e0b0e6aabebee" 2026-10-09T13:28:28.432887-07:00 db-primary dockerd[700]: time="2026-10-09T13:28:28.432887-07:00" level=warning msg="Health check for container 0f62d81956db7109 error: context deadline exceeded" 2026-10-09T13:28:28.507337-07:00 web-03 sshd[1650]: Invalid user ci from 91.87.23.129 port 2393 2026-10-09T13:28:28.678110-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577708.941:30351): pid=30351 uid=0 auid=4394 ses=994 msg='op=login id=4394 exe="/usr/sbin/sshd" hostname=? addr=192.113.255.88 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:28.979519-07:00 edge-fr-1 postgres[22640]: LOG: checkpoint complete: wrote 5201 buffers (15%); 0 WAL file(s) added, 0 removed, 93 recycled; write=9277.915 s, sync=0.915 s, total=9277.915 s 2026-10-09T13:28:29.000188-07:00 edge-fr-1 nginx[1210]: 203.207.28.113 - - "GET /api/v2/users HTTP/1.1" 301 56845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:29.094739-07:00 edge-fr-1 app[30043]: INFO worker 43 picked job da07ba910a6454d2 from queue invoices 2026-10-09T13:28:29.268318-07:00 worker-12 haproxy[917]: 172.175.86.190:18013 [98305] http-in app/worker-12 5515/0/473/473/5515 404 63493 - - ---- 247/247/16/16/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:28:29.502499-07:00 bastion sshd[3446]: Accepted publickey for zoë from 203.207.25.161 port 51027 ssh2: ED25519 SHA256:f9f1ac9523e0619d 2026-10-09T13:28:29.526552-07:00 web-03 app[30444]: INFO order 20808 confirmed for root in 5265 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:28:29.563712-07:00 db-replica systemd[1]: session-42597.scope: Deactivated successfully. 2026-10-09T13:28:29.564394-07:00 api-08 app[30787]: INFO order 62925 confirmed for deploy in 3752 ms (region us-east-1, queue orders) 2026-10-09T13:28:29.639480-07:00 api-08 sshd[22068]: Connection closed by 10.192.99.102 port 24290 [preauth] 2026-10-09T13:28:29.694809-07:00 web-01 sshd[59138]: Received disconnect from 192.198.106.37 port 4851:11: Bye Bye [preauth] 2026-10-09T13:28:29.724420-07:00 api-07 app[30385]: INFO worker 87 finished job 88c18180461f1680 in 9212 ms 2026-10-09T13:28:29.852995-07:00 cache-3 nginx[1202]: 10.109.24.186 - priya "POST /health HTTP/1.1" 200 58812 "-" "python-requests/2.32.3" 2026-10-09T13:28:29.861571-07:00 api-08 nginx[1206]: 10.171.239.141 - - "GET /favicon.ico HTTP/1.1" 404 39640 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:29.900975-07:00 db-replica nginx[1207]: 172.195.85.227 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 46026 "-" "python-requests/2.32.3" 2026-10-09T13:28:30.262355-07:00 api-07 haproxy[902]: 172.44.97.198:34133 [23322] http-in app/edge-fr-1 6174/0/465/465/6174 302 25646 - - ---- 427/427/92/92/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:28:30.424959-07:00 api-08 nginx[1203]: 91.79.3.127 - - "GET /.env HTTP/1.1" 204 17847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:30.468639-07:00 web-02 nginx[1206]: 192.74.219.70 - - "GET /static/main.css HTTP/1.1" 200 46392 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:30.528052-07:00 bastion sshd[37120]: Failed password for invalid user zoë from 10.200.57.25 port 51793 ssh2 2026-10-09T13:28:30.709030-07:00 web-02 haproxy[950]: 172.49.33.246:50657 [45476] http-in app/edge-fr-1 4077/0/445/445/4077 500 79031 - - ---- 585/585/50/50/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:30.713450-07:00 cache-3 kernel: [55894.822244] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.77.248.181 DST=10.0.542.542 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=55894 DF PROTO=TCP SPT=17006 DPT=17006 WINDOW=55894 RES=0x00 SYN URGP=0 2026-10-09T13:28:30.732887-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577710.114:55715): pid=55715 uid=0 auid=7487 ses=145 msg='op=login id=7487 exe="/usr/sbin/sshd" hostname=? addr=91.206.255.16 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:30.741483-07:00 api-07 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.99.112.198, server: app.example.com, request: "GET /static/app.js HTTP/1.1", upstream: "http://10.0.348.348:8080/static/app.js" 2026-10-09T13:28:30.894923-07:00 web-03 app[30475]: DEBUG cache hit ratio 98% over the last minute (87127 lookups) 2026-10-09T13:28:30.990601-07:00 worker-12 app[30722]: INFO request_id=191f88d0d7e3bb41 method=GET path=/login status=404 duration=1356ms 2026-10-09T13:28:31.054701-07:00 bastion app[30295]: INFO worker 34 finished job ac8bf0468086d267 in 7921 ms 2026-10-09T13:28:31.122935-07:00 api-08 sshd[38673]: Connection closed by 10.70.5.222 port 52949 [preauth] 2026-10-09T13:28:31.300547-07:00 web-01 nginx[1207]: 91.34.70.13 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 83175 "-" "kube-probe/1.31" 2026-10-09T13:28:31.407123-07:00 web-01 nginx[1207]: 91.105.221.239 - - "GET /wp-login.php HTTP/1.1" 404 3376 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:31.432787-07:00 edge-fr-1 app[30806]: INFO worker 12 finished job 7ccf222e70f12443 in 919 ms 2026-10-09T13:28:31.436437-07:00 bastion nginx[1210]: 172.148.115.207 - - "GET /favicon.ico HTTP/1.1" 200 57682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:31.438893-07:00 web-03 app[30606]: INFO worker 74 finished job b0e424471d9caea1 in 4319 ms 2026-10-09T13:28:31.562545-07:00 cache-3 app[30339]: INFO worker 51 finished job a07e7efbcbb401c1 in 6750 ms 2026-10-09T13:28:31.717543-07:00 web-02 app[30456]: INFO order 71415 confirmed for zoë in 367 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:28:31.921950-07:00 db-primary nginx[1203]: 172.249.105.166 - françois "POST /health HTTP/1.1" 204 42056 "-" "curl/8.4.0" 2026-10-09T13:28:32.072736-07:00 web-02 nginx[1200]: 45.52.77.231 - - "GET /static/main.css HTTP/1.1" 200 32361 "-" "python-requests/2.32.3" 2026-10-09T13:28:32.251197-07:00 api-07 nginx[1210]: 91.149.17.43 - - "GET /api/v2/orders HTTP/1.1" 200 48940 "-" "curl/8.4.0" 2026-10-09T13:28:32.381385-07:00 worker-12 nginx[1203]: 45.157.27.123 - - "GET /login HTTP/1.1" 200 78516 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:32.493422-07:00 api-08 app[30552]: DEBUG cache hit ratio 21% over the last minute (79159 lookups) 2026-10-09T13:28:32.649010-07:00 web-03 app[30618]: INFO order 41122 confirmed for priya in 1260 ms (region us-east-1, queue orders) 2026-10-09T13:28:32.798183-07:00 edge-fr-1 nginx[1205]: 172.69.143.108 - - "GET /.env HTTP/1.1" 200 20271 "-" "python-requests/2.32.3" 2026-10-09T13:28:32.911143-07:00 api-08 app[30307]: INFO worker 10 picked job cb47f1526946ce32 from queue webhooks 2026-10-09T13:28:32.915032-07:00 edge-fr-1 app[30543]: INFO request_id=d9f34fe5c064fc3f method=GET path=/wp-login.php status=200 duration=1850ms 2026-10-09T13:28:32.922208-07:00 bastion app[30805]: INFO worker 56 picked job bc06f4991853d290 from queue emails 2026-10-09T13:28:33.008087-07:00 cache-3 app[30550]: INFO request_id=1d62f65e5ef38f9c method=GET path=/wp-login.php status=200 duration=9234ms 2026-10-09T13:28:33.109044-07:00 web-02 kernel: [92120.506034] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.7.27.87 DST=10.0.107.107 LEN=90 TOS=0x00 PREC=0x00 TTL=90 ID=92120 DF PROTO=TCP SPT=34710 DPT=34710 WINDOW=92120 RES=0x00 SYN URGP=0 2026-10-09T13:28:33.195591-07:00 cache-3 nginx[1205]: 10.88.160.236 - - "GET /login HTTP/1.1" 200 43710 "-" "curl/8.4.0" 2026-10-09T13:28:33.256268-07:00 web-03 nginx[1202]: 203.200.249.94 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 33159 "-" "curl/8.4.0" 2026-10-09T13:28:33.325858-07:00 edge-fr-1 haproxy[929]: 91.247.214.42:62966 [98290] http-in app/db-primary 9854/0/992/992/9854 404 11652 - - ---- 850/850/58/58/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:28:33.361354-07:00 web-02 app[30948]: INFO order 39878 confirmed for françois in 5262 ms (region eu-west-1, queue invoices) 2026-10-09T13:28:33.542700-07:00 cache-3 app[30510]: INFO request_id=075aea6166b49a6b method=GET path=/.env status=500 duration=5630ms 2026-10-09T13:28:33.880355-07:00 worker-12 haproxy[914]: 203.18.92.30:3907 [83607] http-in app/db-primary 7324/0/636/636/7324 204 63013 - - ---- 789/789/98/98/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:28:33.944986-07:00 bastion nginx[1207]: 10.99.19.136 - - "GET /admin HTTP/1.1" 200 65920 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:34.065887-07:00 cache-3 app[30730]: WARN retrying upstream 45.25.22.79:39483 after timeout (8406 ms), attempt 3 of 3 2026-10-09T13:28:34.305327-07:00 web-03 sshd[63633]: Accepted publickey for françois from 10.63.147.165 port 25370 ssh2: ED25519 SHA256:cf3e1e68c7f6a138 2026-10-09T13:28:34.385462-07:00 db-primary nginx[1201]: 45.36.142.13 - deploy "POST /api/v2/orders HTTP/1.1" 302 6686 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:34.503357-07:00 worker-12 sshd[45585]: pam_unix(sshd:session): session opened for user akira(uid=2457) by (uid=0) 2026-10-09T13:28:34.687487-07:00 api-08 app[30141]: INFO order 73841 confirmed for françois in 8284 ms (region eu-west-1, queue orders) 2026-10-09T13:28:34.729898-07:00 cache-3 kernel: [51896.949698] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.86.212.185 DST=10.0.985.985 LEN=35 TOS=0x00 PREC=0x00 TTL=35 ID=51896 DF PROTO=TCP SPT=58298 DPT=58298 WINDOW=51896 RES=0x00 SYN URGP=0 2026-10-09T13:28:34.826780-07:00 web-02 nginx[1202]: 91.148.105.209 - - "GET /login HTTP/1.1" 301 33398 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:34.840780-07:00 web-01 postgres[16764]: LOG: duration: 1479.31 ms statement: SELECT * FROM orders WHERE customer_id = 15605 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:34.918818-07:00 cache-3 postgres[11841]: LOG: duration: 5715.665 ms statement: SELECT * FROM orders WHERE customer_id = 91444 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:35.130910-07:00 cache-3 nginx[1209]: 91.200.184.80 - - "GET /admin HTTP/1.1" 200 48652 "-" "curl/8.4.0" 2026-10-09T13:28:35.157476-07:00 web-03 app[30814]: INFO request_id=731455af2934781d method=GET path=/admin status=200 duration=7790ms 2026-10-09T13:28:35.215967-07:00 db-primary sshd[51502]: Accepted publickey for backup from 172.174.79.57 port 9105 ssh2: ED25519 SHA256:24bb110fd0bc8588 2026-10-09T13:28:35.839932-07:00 api-08 nginx[1205]: 192.205.149.225 - deploy "POST /favicon.ico HTTP/1.1" 301 58166 "-" "kube-probe/1.31" 2026-10-09T13:28:35.894546-07:00 bastion app[30445]: INFO order 86751 confirmed for akira in 9664 ms (region eu-west-1, queue orders) 2026-10-09T13:28:35.903951-07:00 web-01 app[30151]: INFO worker 21 picked job b2bcf4b4e6eb4b8f from queue webhooks 2026-10-09T13:28:36.000964-07:00 web-03 nginx[1206]: 192.86.16.175 - - "GET /metrics HTTP/1.1" 200 63487 "-" "kube-probe/1.31" 2026-10-09T13:28:36.001852-07:00 api-07 app[30858]: INFO order 82449 confirmed for ci in 8286 ms (region ap-northeast-1, queue emails) 2026-10-09T13:28:36.223678-07:00 db-replica app[30001]: INFO health check ok: db 532 ms, cache 532 ms, queue depth 28 2026-10-09T13:28:36.258133-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577716.40:52391): pid=52391 uid=0 auid=3106 ses=853 msg='op=login id=3106 exe="/usr/sbin/sshd" hostname=? addr=192.78.175.242 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:36.438392-07:00 db-replica nginx[1203]: 45.203.1.136 - - "GET /admin HTTP/1.1" 502 53546 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:36.545638-07:00 cache-3 postgres[20292]: LOG: duration: 8625.695 ms statement: SELECT * FROM orders WHERE customer_id = 57305 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:36.596847-07:00 cache-3 app[30228]: INFO order 14291 confirmed for deploy in 6746 ms (region eu-west-1, queue emails) 2026-10-09T13:28:36.663448-07:00 web-01 sshd[11352]: Invalid user deploy from 91.243.168.132 port 2235 2026-10-09T13:28:36.716609-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577716.573:33800): pid=33800 uid=0 auid=4837 ses=565 msg='op=login id=4837 exe="/usr/sbin/sshd" hostname=? addr=10.240.80.171 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:36.764068-07:00 web-01 app[30057]: INFO request_id=77b22a1731b21e1a method=GET path=/static/main.css status=200 duration=2301ms 2026-10-09T13:28:36.808267-07:00 api-08 nginx[1200]: 192.251.26.13 - - "GET /api/v2/orders HTTP/1.1" 301 24768 "-" "python-requests/2.32.3" 2026-10-09T13:28:36.872371-07:00 bastion cron[35122]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:28:36.903915-07:00 db-replica sshd[64460]: Invalid user backup from 10.238.157.136 port 64224 2026-10-09T13:28:36.973731-07:00 db-primary haproxy[931]: 203.159.26.42:31933 [30000] http-in app/worker-12 5565/0/886/886/5565 204 86933 - - ---- 190/190/37/37/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:28:37.237513-07:00 edge-fr-1 haproxy[917]: 45.129.140.66:15333 [62268] http-in app/edge-fr-1 9829/0/577/577/9829 401 5034 - - ---- 156/156/94/94/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:28:37.440225-07:00 web-02 app[30022]: INFO request_id=56d5ffa13d96d2d1 method=GET path=/api/v2/orders/8841 status=404 duration=1646ms 2026-10-09T13:28:37.803879-07:00 db-replica haproxy[930]: 45.169.137.101:35343 [30123] http-in app/web-01 7174/0/244/244/7174 200 7855 - - ---- 594/594/76/76/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:28:38.202061-07:00 db-primary postgres[21548]: LOG: duration: 1296.92 ms statement: SELECT * FROM orders WHERE customer_id = 24748 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:38.328730-07:00 api-07 app[30198]: INFO worker 64 finished job d56e133313dc4971 in 2051 ms 2026-10-09T13:28:38.449342-07:00 web-01 cron[5519]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:28:38.475646-07:00 web-03 postgres[18672]: LOG: duration: 7102.175 ms statement: SELECT * FROM orders WHERE customer_id = 42767 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:28:38.507634-07:00 bastion app[30046]: WARN retrying upstream 91.225.242.238:21931 after timeout (7618 ms), attempt 1 of 3 2026-10-09T13:28:38.600429-07:00 bastion postgres[8802]: LOG: duration: 3084.881 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:38.644102-07:00 api-08 nginx[1200]: 172.152.167.71 - priya "POST /login HTTP/1.1" 404 35883 "-" "python-requests/2.32.3" 2026-10-09T13:28:38.891717-07:00 edge-fr-1 app[30902]: INFO order 97361 confirmed for backup in 3592 ms (region eu-west-1, queue orders) 2026-10-09T13:28:38.903622-07:00 db-replica haproxy[928]: 192.90.191.93:10600 [10797] http-in app/edge-fr-1 642/0/264/264/642 404 60310 - - ---- 642/642/56/56/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:28:39.062065-07:00 cache-3 nginx[1204]: 10.140.34.121 - - "GET /static/main.css HTTP/1.1" 401 35858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:39.151585-07:00 edge-fr-1 sshd[31643]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:28:39.191263-07:00 web-01 postgres[6987]: ERROR: deadlock detected 2026-10-09T13:28:39.203059-07:00 api-08 sshd[52496]: pam_unix(sshd:session): session opened for user sørensen(uid=9060) by (uid=0) 2026-10-09T13:28:39.355628-07:00 cache-3 nginx[1200]: 10.136.204.238 - - "GET /static/app.js HTTP/1.1" 200 46166 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:39.440842-07:00 web-01 nginx[1200]: 10.137.10.199 - - "GET /favicon.ico HTTP/1.1" 500 77781 "-" "kube-probe/1.31" 2026-10-09T13:28:39.443615-07:00 web-02 app[30971]: INFO worker 41 picked job bb08e9537a41f09c from queue webhooks 2026-10-09T13:28:39.612598-07:00 worker-12 app[30956]: INFO request_id=849380d66acf3291 method=GET path=/metrics status=500 duration=5894ms 2026-10-09T13:28:39.646887-07:00 web-03 haproxy[926]: 172.180.170.185:7121 [86352] http-in app/api-08 7967/0/942/942/7967 200 15590 - - ---- 397/397/32/32/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:39.868512-07:00 cache-3 postgres[22431]: LOG: duration: 4855.447 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:40.217007-07:00 web-03 haproxy[918]: 45.190.111.149:22597 [98029] http-in app/db-replica 3921/0/3/3/3921 200 37443 - - ---- 268/268/85/85/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:28:40.261381-07:00 web-01 haproxy[941]: 192.18.194.4:21039 [70635] http-in app/db-replica 4615/0/40/40/4615 200 4431 - - ---- 724/724/66/66/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:28:40.335106-07:00 db-replica app[30479]: INFO order 49957 confirmed for priya in 9608 ms (region eu-west-1, queue webhooks) 2026-10-09T13:28:40.573200-07:00 api-08 nginx[1201]: 172.67.61.162 - - "GET /static/main.css HTTP/1.1" 302 39482 "-" "Go-http-client/1.1" 2026-10-09T13:28:40.993568-07:00 worker-12 app[30537]: INFO order 14836 confirmed for priya in 8857 ms (region eu-west-1, queue orders) 2026-10-09T13:28:41.230870-07:00 bastion sshd[44601]: Failed password for invalid user deploy from 203.106.135.67 port 4460 ssh2 2026-10-09T13:28:41.253481-07:00 edge-fr-1 app[30220]: INFO worker 39 picked job d6ea3a5a90a60c98 from queue webhooks 2026-10-09T13:28:41.267546-07:00 web-03 sshd[26120]: Failed password for invalid user akira from 203.138.172.225 port 4617 ssh2 2026-10-09T13:28:41.294234-07:00 web-02 app[30571]: INFO request_id=27da8a396943b92b method=GET path=/static/main.css status=401 duration=6516ms 2026-10-09T13:28:41.344907-07:00 cache-3 app[30245]: INFO request_id=ab21048b5ccc3c85 method=GET path=/api/v2/orders/8841 status=404 duration=81ms 2026-10-09T13:28:41.414210-07:00 edge-fr-1 haproxy[915]: 203.171.205.158:61894 [26781] http-in app/cache-3 9122/0/244/244/9122 404 84470 - - ---- 606/606/88/88/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:41.772050-07:00 web-03 nginx[1200]: 203.115.104.202 - zoë "POST /admin HTTP/1.1" 401 73291 "-" "python-requests/2.32.3" 2026-10-09T13:28:41.822536-07:00 api-07 haproxy[948]: 45.113.57.113:10346 [73019] http-in app/web-02 1559/0/147/147/1559 200 46627 - - ---- 254/254/80/80/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:28:42.172859-07:00 web-01 nginx[1201]: 91.13.23.115 - - "GET /.env HTTP/1.1" 200 37040 "-" "curl/8.4.0" 2026-10-09T13:28:42.184168-07:00 web-03 app[30168]: INFO worker 12 picked job 67ced493886deb00 from queue orders 2026-10-09T13:28:42.272417-07:00 api-07 nginx[1205]: 203.205.129.18 - root "POST /api/v2/users HTTP/1.1" 404 53288 "-" "kube-probe/1.31" 2026-10-09T13:28:42.445824-07:00 cache-3 sshd[8448]: Received disconnect from 172.45.166.60 port 46445:11: Bye Bye [preauth] 2026-10-09T13:28:42.475353-07:00 db-primary app[30807]: INFO worker 33 finished job 274fbb9a4f5878ef in 6651 ms 2026-10-09T13:28:42.585947-07:00 web-01 haproxy[902]: 203.154.154.147:10897 [11367] http-in app/api-08 2817/0/125/125/2817 204 87809 - - ---- 989/989/66/66/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:28:42.761316-07:00 worker-12 sshd[22286]: Connection closed by 45.202.65.100 port 57654 [preauth] 2026-10-09T13:28:42.761945-07:00 cache-3 app[30484]: INFO order 88093 confirmed for backup in 3946 ms (region us-east-1, queue emails) 2026-10-09T13:28:42.809801-07:00 web-03 app[30345]: INFO worker 60 picked job d19643d1e79c71a6 from queue emails 2026-10-09T13:28:42.885743-07:00 edge-fr-1 haproxy[906]: 192.153.14.146:22212 [15438] http-in app/web-02 3145/0/356/356/3145 204 35476 - - ---- 779/779/12/12/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:28:43.007899-07:00 web-03 haproxy[920]: 203.118.98.122:16971 [83986] http-in app/web-02 2202/0/970/970/2202 404 5792 - - ---- 852/852/46/46/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:28:43.204080-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577723.218:10355): pid=10355 uid=0 auid=2578 ses=995 msg='op=login id=2578 exe="/usr/sbin/sshd" hostname=? addr=91.199.62.3 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:43.388518-07:00 web-01 app[30749]: INFO worker 74 finished job 290e2a85d9e506c1 in 7591 ms 2026-10-09T13:28:43.414840-07:00 api-08 nginx[1207]: 91.33.154.59 - - "GET /health HTTP/1.1" 200 50537 "-" "python-requests/2.32.3" 2026-10-09T13:28:43.531244-07:00 web-01 kernel: [57041.391807] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.69.160.178 DST=10.0.116.116 LEN=81 TOS=0x00 PREC=0x00 TTL=81 ID=57041 DF PROTO=TCP SPT=11163 DPT=11163 WINDOW=57041 RES=0x00 SYN URGP=0 2026-10-09T13:28:43.627054-07:00 db-primary systemd[1]: Started Session 98852 of User zoë. 2026-10-09T13:28:43.685231-07:00 worker-12 postgres[19602]: LOG: duration: 9194.272 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:43.712096-07:00 db-primary haproxy[913]: 172.191.149.209:3837 [55163] http-in app/db-replica 802/0/14/14/802 200 71461 - - ---- 354/354/30/30/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:28:43.741023-07:00 api-08 app[30457]: INFO order 81257 confirmed for deploy in 428 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:28:43.857686-07:00 web-02 sshd[64660]: pam_unix(sshd:session): session opened for user root(uid=2854) by (uid=0) 2026-10-09T13:28:44.122796-07:00 api-08 kernel: [72686.136774] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.81.43.24 DST=10.0.334.334 LEN=88 TOS=0x00 PREC=0x00 TTL=88 ID=72686 DF PROTO=TCP SPT=24705 DPT=24705 WINDOW=72686 RES=0x00 SYN URGP=0 2026-10-09T13:28:44.184123-07:00 web-01 app[30428]: INFO order 91008 confirmed for ci in 2930 ms (region us-east-1, queue webhooks) 2026-10-09T13:28:44.195131-07:00 db-replica nginx[1203]: 203.194.103.91 - - "GET /api/v2/users HTTP/1.1" 200 58995 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:44.203507-07:00 api-07 app[30484]: INFO order 75718 confirmed for ci in 3474 ms (region us-east-1, queue orders) 2026-10-09T13:28:44.409771-07:00 web-02 app[30843]: INFO worker 73 finished job 8e27a95734fe9b82 in 9588 ms 2026-10-09T13:28:44.548678-07:00 api-08 app[30894]: INFO worker 58 finished job f21ffcc748040a7c in 2061 ms 2026-10-09T13:28:44.648641-07:00 api-07 app[30569]: INFO worker 20 finished job 5638ee49bca66b46 in 1346 ms 2026-10-09T13:28:44.739790-07:00 web-02 nginx[1206]: 45.65.81.205 - sørensen "POST /api/v2/users HTTP/1.1" 404 24713 "-" "curl/8.4.0" 2026-10-09T13:28:45.088269-07:00 api-07 app[30626]: INFO order 40369 confirmed for müller in 3148 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:28:45.110197-07:00 bastion nginx[1205]: 172.214.137.100 - zoë "POST /wp-login.php HTTP/1.1" 200 6563 "-" "Go-http-client/1.1" 2026-10-09T13:28:45.110469-07:00 edge-fr-1 nginx[1204]: 91.226.249.129 - - "GET /health HTTP/1.1" 200 10765 "-" "python-requests/2.32.3" 2026-10-09T13:28:45.307233-07:00 web-03 dockerd[700]: time="2026-10-09T13:28:45.307233-07:00" level=info msg="Container c31fddff0e38a70d exited with code 0" 2026-10-09T13:28:45.554899-07:00 edge-fr-1 nginx[1210]: 203.12.104.95 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 66999 "-" "python-requests/2.32.3" 2026-10-09T13:28:45.768594-07:00 api-08 app[30015]: WARN slow query (7672 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '88 minutes' 2026-10-09T13:28:45.825348-07:00 worker-12 postgres[12034]: LOG: duration: 7140.705 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:46.194545-07:00 db-replica sshd[5671]: Connection closed by 192.156.160.25 port 43753 [preauth] 2026-10-09T13:28:46.509468-07:00 db-replica nginx[1200]: 172.71.26.236 - - "GET /metrics HTTP/1.1" 200 38250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:46.571815-07:00 api-07 nginx[1208]: 172.151.226.157 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 835 "-" "python-requests/2.32.3" 2026-10-09T13:28:46.723437-07:00 worker-12 app[30080]: INFO request_id=b0b9f736f89c9c4f method=GET path=/login status=200 duration=4486ms 2026-10-09T13:28:46.839068-07:00 api-07 postgres[2987]: LOG: duration: 2139.156 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:46.939902-07:00 cache-3 sshd[56862]: pam_unix(sshd:session): session closed for user françois 2026-10-09T13:28:46.992512-07:00 web-02 nginx[1206]: 91.74.146.240 - sørensen "POST /api/v2/orders HTTP/1.1" 200 62475 "-" "kube-probe/1.31" 2026-10-09T13:28:47.188132-07:00 api-07 app[30131]: INFO worker 17 picked job 00e4edf5158724f0 from queue emails 2026-10-09T13:28:47.308273-07:00 db-replica haproxy[923]: 91.20.68.117:2086 [49791] http-in app/bastion 2330/0/987/987/2330 404 32280 - - ---- 132/132/42/42/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:28:47.314090-07:00 db-replica app[30734]: INFO request_id=1db32d20a9dcb374 method=GET path=/static/app.js status=200 duration=827ms 2026-10-09T13:28:47.392271-07:00 bastion nginx[1205]: 45.59.9.14 - - "GET /metrics HTTP/1.1" 200 1524 "-" "Go-http-client/1.1" 2026-10-09T13:28:47.408074-07:00 web-01 nginx[1202]: 192.32.32.7 - ci "POST /admin HTTP/1.1" 301 10682 "-" "kube-probe/1.31" 2026-10-09T13:28:47.535703-07:00 web-03 nginx[1200]: 91.27.153.188 - - "GET /metrics HTTP/1.1" 200 82217 "-" "kube-probe/1.31" 2026-10-09T13:28:47.672733-07:00 web-03 nginx[1207]: 172.41.16.26 - deploy "POST /api/v2/search?q=invoice HTTP/1.1" 502 55863 "-" "curl/8.4.0" 2026-10-09T13:28:47.882970-07:00 cache-3 app[30592]: INFO request_id=6c2a8a55905cb8a5 method=GET path=/static/app.js status=302 duration=7532ms 2026-10-09T13:28:48.066336-07:00 db-primary haproxy[917]: 10.130.138.179:44722 [87615] http-in app/cache-3 461/0/196/196/461 200 43664 - - ---- 301/301/62/62/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:28:48.117592-07:00 cache-3 app[30761]: WARN retrying upstream 203.195.54.72:48931 after timeout (4909 ms), attempt 2 of 3 2026-10-09T13:28:48.118171-07:00 bastion app[30255]: WARN retrying upstream 192.88.119.96:50421 after timeout (8999 ms), attempt 1 of 3 2026-10-09T13:28:48.549984-07:00 db-replica sshd[15325]: Failed password for invalid user müller from 203.123.95.185 port 22313 ssh2 2026-10-09T13:28:48.594914-07:00 api-08 nginx[1202]: 203.11.216.180 - priya "POST /wp-login.php HTTP/1.1" 404 78715 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:48.710336-07:00 web-03 systemd[1]: Started Session 70683 of User ci. 2026-10-09T13:28:48.734627-07:00 api-08 app[30427]: INFO worker 69 finished job 24f76bb099594971 in 1592 ms 2026-10-09T13:28:48.914161-07:00 api-08 nginx[1203]: 45.176.17.240 - - "GET /health HTTP/1.1" 302 11189 "-" "curl/8.4.0" 2026-10-09T13:28:49.035175-07:00 api-07 cron[3050]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:28:49.069830-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577729.270:56449): pid=56449 uid=0 auid=4140 ses=229 msg='op=login id=4140 exe="/usr/sbin/sshd" hostname=? addr=192.21.160.193 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:49.084782-07:00 bastion sshd[28786]: Received disconnect from 91.228.149.7 port 31483:11: Bye Bye [preauth] 2026-10-09T13:28:49.208105-07:00 web-03 sshd[40317]: Received disconnect from 192.85.197.66 port 40492:11: Bye Bye [preauth] 2026-10-09T13:28:49.288980-07:00 cache-3 dockerd[700]: time="2026-10-09T13:28:49.288980-07:00" level=info msg="Container cf11544a153f57af exited with code 0" 2026-10-09T13:28:49.368637-07:00 edge-fr-1 haproxy[907]: 45.56.10.27:43142 [91995] http-in app/web-03 5484/0/984/984/5484 404 8519 - - ---- 157/157/84/84/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:28:49.470991-07:00 bastion app[30839]: INFO health check ok: db 740 ms, cache 740 ms, queue depth 79 2026-10-09T13:28:50.132732-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791577730.861:31452): pid=31452 uid=0 auid=5062 ses=281 msg='op=login id=5062 exe="/usr/sbin/sshd" hostname=? addr=203.40.123.80 terminal=/dev/pts/0 res=success' 2026-10-09T13:28:50.228729-07:00 web-02 app[30964]: INFO request_id=e51947d0dbab2061 method=GET path=/api/v2/orders/8841 status=404 duration=6432ms 2026-10-09T13:28:50.233281-07:00 web-02 kubelet[800]: I1009 13:28:50.321975 2667 kubelet.go:2667] "Pod is terminating, skipping pod status update" pod="default/api-3cc534925ac557a4" 2026-10-09T13:28:50.235623-07:00 web-02 app[30602]: INFO request_id=e7f1ce64978b3afb method=GET path=/api/v2/orders status=200 duration=6818ms 2026-10-09T13:28:50.239150-07:00 worker-12 sshd[59908]: Failed password for invalid user zoë from 91.81.16.184 port 61470 ssh2 2026-10-09T13:28:50.297895-07:00 api-07 nginx[1209]: 192.205.187.115 - - "GET /favicon.ico HTTP/1.1" 404 49510 "-" "Go-http-client/1.1" 2026-10-09T13:28:50.407694-07:00 web-03 app[30904]: WARN retrying upstream 203.245.166.1:3416 after timeout (5451 ms), attempt 2 of 3 2026-10-09T13:28:50.571980-07:00 web-01 kernel: [39449.267349] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.207.1.64 DST=10.0.760.760 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=39449 DF PROTO=TCP SPT=31449 DPT=31449 WINDOW=39449 RES=0x00 SYN URGP=0 2026-10-09T13:28:50.577666-07:00 db-replica sshd[48677]: Connection closed by 192.170.156.26 port 63524 [preauth] 2026-10-09T13:28:51.004888-07:00 bastion nginx[1201]: 45.228.36.85 - - "GET /.env HTTP/1.1" 200 2571 "-" "Go-http-client/1.1" 2026-10-09T13:28:51.085162-07:00 bastion app[30585]: INFO worker 91 picked job d2fec94c1eff64f8 from queue emails 2026-10-09T13:28:51.120175-07:00 worker-12 sshd[35263]: Failed password for invalid user françois from 192.183.18.87 port 37406 ssh2 2026-10-09T13:28:51.126217-07:00 api-08 haproxy[902]: 91.154.42.28:19381 [68639] http-in app/web-02 1865/0/633/633/1865 204 85199 - - ---- 481/481/51/51/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:28:51.151484-07:00 api-07 app[30402]: INFO order 63697 confirmed for backup in 980 ms (region eu-west-1, queue webhooks) 2026-10-09T13:28:51.471393-07:00 api-07 kernel: [76397.113123] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.169.253.229 DST=10.0.666.666 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=76397 DF PROTO=TCP SPT=53051 DPT=53051 WINDOW=76397 RES=0x00 SYN URGP=0 2026-10-09T13:28:51.519002-07:00 db-primary app[30668]: INFO request_id=d430af5ae81377d3 method=GET path=/static/app.js status=200 duration=7634ms 2026-10-09T13:28:51.574471-07:00 bastion nginx[1208]: 91.223.120.28 - - "GET /.env HTTP/1.1" 204 21714 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:51.574757-07:00 db-replica app[30205]: INFO request_id=83f87983020ece5e method=GET path=/login status=200 duration=8289ms 2026-10-09T13:28:51.579942-07:00 bastion nginx[1201]: 45.34.237.170 - sørensen "POST /api/v2/orders HTTP/1.1" 200 66158 "-" "kube-probe/1.31" 2026-10-09T13:28:51.600338-07:00 db-replica sshd[28503]: Accepted publickey for deploy from 192.81.181.226 port 55057 ssh2: ED25519 SHA256:31112a02cebc05ea 2026-10-09T13:28:51.631700-07:00 web-01 app[30189]: DEBUG cache hit ratio 55% over the last minute (80685 lookups) 2026-10-09T13:28:51.683220-07:00 worker-12 app[30285]: INFO request_id=5bb1654d7235c9c0 method=GET path=/favicon.ico status=200 duration=2519ms 2026-10-09T13:28:51.764821-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:28:51.764821-07:00" level=info msg="Container 1f3184ae46bccfcb exited with code 0" 2026-10-09T13:28:51.831614-07:00 db-replica postgres[20810]: LOG: checkpoint complete: wrote 7678 buffers (32%); 0 WAL file(s) added, 0 removed, 98 recycled; write=1471.592 s, sync=0.592 s, total=1471.592 s 2026-10-09T13:28:51.832645-07:00 api-07 haproxy[919]: 91.14.237.143:63734 [57644] http-in app/bastion 5676/0/755/755/5676 200 11820 - - ---- 895/895/80/80/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:28:52.008882-07:00 bastion postgres[24490]: LOG: duration: 4585.215 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:28:52.017772-07:00 web-01 dockerd[700]: time="2026-10-09T13:28:52.017772-07:00" level=warning msg="Health check for container 0d0665eb1354e2fc error: context deadline exceeded" 2026-10-09T13:28:52.295695-07:00 web-01 dockerd[700]: time="2026-10-09T13:28:52.295695-07:00" level=warning msg="Health check for container c1cf19fb0f903646 error: context deadline exceeded" 2026-10-09T13:28:52.387241-07:00 api-08 sshd[53350]: Received disconnect from 192.75.198.28 port 49064:11: Bye Bye [preauth] 2026-10-09T13:28:52.412216-07:00 worker-12 app[30131]: INFO health check ok: db 884 ms, cache 884 ms, queue depth 86 2026-10-09T13:28:52.626453-07:00 db-replica kernel: [39565.371562] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.105.7.250 DST=10.0.909.909 LEN=11 TOS=0x00 PREC=0x00 TTL=11 ID=39565 DF PROTO=TCP SPT=35187 DPT=35187 WINDOW=39565 RES=0x00 SYN URGP=0 2026-10-09T13:28:52.848315-07:00 edge-fr-1 app[30704]: DEBUG cache hit ratio 59% over the last minute (16146 lookups) 2026-10-09T13:28:53.073546-07:00 db-replica nginx[1205]: 192.113.243.83 - - "GET /metrics HTTP/1.1" 502 72962 "-" "python-requests/2.32.3" 2026-10-09T13:28:53.158460-07:00 cache-3 nginx[1209]: 192.103.3.67 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 60552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:53.179224-07:00 api-08 kernel: [83844.271727] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.8.205.161 DST=10.0.229.229 LEN=76 TOS=0x00 PREC=0x00 TTL=76 ID=83844 DF PROTO=TCP SPT=18317 DPT=18317 WINDOW=83844 RES=0x00 SYN URGP=0 2026-10-09T13:28:53.265362-07:00 edge-fr-1 kernel: [42259.428982] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.221.39.100 DST=10.0.778.778 LEN=37 TOS=0x00 PREC=0x00 TTL=37 ID=42259 DF PROTO=TCP SPT=59073 DPT=59073 WINDOW=42259 RES=0x00 SYN URGP=0 2026-10-09T13:28:53.521908-07:00 web-02 app[30600]: INFO health check ok: db 694 ms, cache 694 ms, queue depth 35 2026-10-09T13:28:53.585312-07:00 edge-fr-1 sshd[49482]: Failed password for invalid user priya from 10.191.37.249 port 64450 ssh2 2026-10-09T13:28:53.639066-07:00 db-primary sshd[37595]: pam_unix(sshd:session): session opened for user root(uid=5410) by (uid=0) 2026-10-09T13:28:53.837436-07:00 db-replica sshd[17749]: Connection closed by 172.49.58.117 port 32808 [preauth] 2026-10-09T13:28:53.847438-07:00 db-primary app[30795]: INFO order 72749 confirmed for françois in 2594 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:28:53.919490-07:00 db-primary app[30089]: INFO request_id=59dc02e00128a3dd method=GET path=/api/v2/orders status=502 duration=1785ms 2026-10-09T13:28:53.944853-07:00 cache-3 postgres[11833]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 45735 remain, 6986 scanned (92% of total) 2026-10-09T13:28:54.015128-07:00 db-replica sshd[27017]: pam_unix(sshd:session): session opened for user root(uid=4911) by (uid=0) 2026-10-09T13:28:54.128036-07:00 web-02 systemd[1]: session-65598.scope: Deactivated successfully. 2026-10-09T13:28:54.434459-07:00 web-01 nginx[1203]: 45.229.22.211 - - "GET /favicon.ico HTTP/1.1" 302 72129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:54.510445-07:00 web-02 sshd[56713]: Connection closed by 10.96.44.33 port 9123 [preauth] 2026-10-09T13:28:54.545584-07:00 api-07 dockerd[700]: time="2026-10-09T13:28:54.545584-07:00" level=info msg="Container d8d2f3f7d6c696d0 exited with code 0" 2026-10-09T13:28:54.591250-07:00 db-replica app[30166]: INFO request_id=6e6e53d4a52dda72 method=GET path=/wp-login.php status=200 duration=2203ms 2026-10-09T13:28:54.831326-07:00 cache-3 app[30838]: WARN retrying upstream 91.38.239.130:47516 after timeout (2407 ms), attempt 3 of 3 2026-10-09T13:28:54.891914-07:00 web-02 app[30381]: INFO worker 58 picked job 045eafcdf98dd040 from queue orders 2026-10-09T13:28:55.166676-07:00 api-07 nginx[1210]: 172.89.60.105 - - "GET /wp-login.php HTTP/1.1" 502 23393 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:55.168803-07:00 api-07 app[30947]: INFO request_id=5d1fa99d90c53f3a method=GET path=/.env status=500 duration=8704ms 2026-10-09T13:28:55.334388-07:00 api-07 nginx[1208]: 91.229.232.40 - - "GET /health HTTP/1.1" 404 29002 "-" "Go-http-client/1.1" 2026-10-09T13:28:55.349624-07:00 web-02 nginx[1206]: 192.84.43.220 - - "GET /static/app.js HTTP/1.1" 200 27629 "-" "curl/8.4.0" 2026-10-09T13:28:55.413563-07:00 web-01 haproxy[934]: 45.138.9.36:5355 [73428] http-in app/web-02 5049/0/832/832/5049 200 80929 - - ---- 320/320/56/56/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:28:55.479439-07:00 cache-3 app[30028]: INFO request_id=7970e9ea02e31baa method=GET path=/api/v2/orders/8841 status=302 duration=7291ms 2026-10-09T13:28:55.621303-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:28:55.621303-07:00" level=info msg="Container 433c20dddf92905b exited with code 0" 2026-10-09T13:28:55.747531-07:00 bastion app[30163]: INFO request_id=6e830b18e03c6bfe method=GET path=/metrics status=302 duration=8059ms 2026-10-09T13:28:55.814288-07:00 api-07 app[30148]: INFO worker 62 picked job f19e66c2e30ace14 from queue orders 2026-10-09T13:28:55.891819-07:00 web-02 app[30893]: ERROR payment declined for order 84490: card_declined (code 37), customer notified 2026-10-09T13:28:55.903716-07:00 db-primary app[30591]: INFO request_id=b5edc649201bf9c0 method=GET path=/api/v2/search?q=invoice status=302 duration=4700ms 2026-10-09T13:28:55.939780-07:00 worker-12 haproxy[936]: 91.232.81.13:52001 [31376] http-in app/bastion 7771/0/283/283/7771 302 44771 - - ---- 509/509/99/99/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:28:56.335753-07:00 api-08 nginx[1206]: 192.87.18.124 - - "GET /health HTTP/1.1" 401 2889 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:56.348542-07:00 cache-3 haproxy[937]: 91.53.236.205:59139 [92155] http-in app/db-replica 7550/0/413/413/7550 401 17541 - - ---- 329/329/33/33/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:28:56.505303-07:00 web-03 sshd[50359]: Connection closed by 192.228.83.142 port 57447 [preauth] 2026-10-09T13:28:56.514736-07:00 cache-3 app[30706]: INFO order 13967 confirmed for françois in 2794 ms (region eu-west-1, queue webhooks) 2026-10-09T13:28:56.537029-07:00 cache-3 systemd[1]: Started Session 48660 of User root. 2026-10-09T13:28:56.712026-07:00 bastion haproxy[933]: 203.234.153.100:54868 [20900] http-in app/bastion 1662/0/907/907/1662 200 84939 - - ---- 463/463/89/89/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:28:56.760621-07:00 web-02 cron[43108]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:28:56.795051-07:00 worker-12 cron[7493]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:28:56.831223-07:00 api-07 sshd[50499]: Accepted publickey for backup from 10.159.9.90 port 18724 ssh2: ED25519 SHA256:4ec585616d8188bc 2026-10-09T13:28:57.101253-07:00 web-01 app[30662]: INFO worker 48 picked job 9c4ff47535989cf1 from queue invoices 2026-10-09T13:28:57.228642-07:00 web-01 app[30139]: INFO request_id=7e61de02f0c58294 method=GET path=/admin status=200 duration=1406ms 2026-10-09T13:28:57.701296-07:00 api-08 sshd[49259]: pam_unix(sshd:session): session opened for user deploy(uid=2610) by (uid=0) 2026-10-09T13:28:57.834146-07:00 web-03 app[30138]: INFO request_id=8a30b32ff60093d3 method=GET path=/metrics status=404 duration=1091ms 2026-10-09T13:28:57.986284-07:00 web-02 app[30940]: INFO worker 33 finished job 87c02fd5d71f444f in 6670 ms 2026-10-09T13:28:58.019619-07:00 db-primary nginx[1206]: 203.105.74.9 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 1055 "-" "curl/8.4.0" 2026-10-09T13:28:58.057859-07:00 worker-12 app[30232]: INFO order 43004 confirmed for ci in 5136 ms (region eu-west-1, queue orders) 2026-10-09T13:28:58.099953-07:00 api-08 app[30890]: INFO worker 21 finished job 75afeb49e8370334 in 4256 ms 2026-10-09T13:28:58.174795-07:00 web-03 nginx[1205]: 192.6.225.177 - - "GET /login HTTP/1.1" 502 53998 "-" "python-requests/2.32.3" 2026-10-09T13:28:58.201073-07:00 api-07 app[30648]: INFO worker 31 finished job f10885ef5550f25c in 4528 ms 2026-10-09T13:28:58.683578-07:00 cache-3 nginx[1204]: 192.134.64.121 - backup "POST /admin HTTP/1.1" 401 57159 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:28:58.706043-07:00 web-01 sshd[62377]: Accepted publickey for priya from 203.105.23.57 port 44885 ssh2: ED25519 SHA256:61ff5de9410c5ddf 2026-10-09T13:28:58.748089-07:00 worker-12 nginx[1200]: 192.115.159.238 - ci "POST /api/v2/orders/8841 HTTP/1.1" 302 28163 "-" "curl/8.4.0" 2026-10-09T13:28:58.941135-07:00 api-07 app[30663]: INFO request_id=0664326df0b3db35 method=GET path=/api/v2/orders/8841 status=200 duration=3557ms 2026-10-09T13:28:58.960618-07:00 bastion systemd[1]: Started Session 49539 of User backup. 2026-10-09T13:28:58.962582-07:00 cache-3 systemd[1]: session-69842.scope: Deactivated successfully. 2026-10-09T13:28:59.120815-07:00 web-02 systemd[1]: Started Session 73686 of User ci. 2026-10-09T13:28:59.176309-07:00 db-replica nginx[1207]: 10.143.141.187 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 32946 "-" "python-requests/2.32.3" 2026-10-09T13:28:59.271066-07:00 db-primary sshd[18314]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:28:59.375475-07:00 api-08 haproxy[909]: 45.232.111.249:49053 [56833] http-in app/edge-fr-1 3249/0/283/283/3249 301 65013 - - ---- 531/531/79/79/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:28:59.405302-07:00 worker-12 nginx[1206]: 10.67.95.115 - zoë "POST /wp-login.php HTTP/1.1" 404 1522 "-" "Go-http-client/1.1" 2026-10-09T13:28:59.496708-07:00 db-primary kernel: [88567.356383] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.243.12.195 DST=10.0.618.618 LEN=60 TOS=0x00 PREC=0x00 TTL=60 ID=88567 DF PROTO=TCP SPT=58403 DPT=58403 WINDOW=88567 RES=0x00 SYN URGP=0 2026-10-09T13:28:59.531372-07:00 worker-12 kernel: [97289.045947] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.21.231.250 DST=10.0.933.933 LEN=27 TOS=0x00 PREC=0x00 TTL=27 ID=97289 DF PROTO=TCP SPT=47762 DPT=47762 WINDOW=97289 RES=0x00 SYN URGP=0 2026-10-09T13:28:59.829129-07:00 db-primary nginx[1205]: 192.105.140.106 - - "GET /admin HTTP/1.1" 204 33100 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:28:59.870267-07:00 edge-fr-1 kernel: [11118.654572] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.219.48.158 DST=10.0.379.379 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=11118 DF PROTO=TCP SPT=34130 DPT=34130 WINDOW=11118 RES=0x00 SYN URGP=0 2026-10-09T13:29:00.289606-07:00 web-01 systemd[1]: session-55048.scope: Deactivated successfully. 2026-10-09T13:29:00.450510-07:00 edge-fr-1 sshd[53231]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:29:00.534464-07:00 web-03 sshd[10555]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:29:00.619535-07:00 bastion haproxy[932]: 172.176.11.123:55847 [92073] http-in app/web-03 5254/0/757/757/5254 502 60214 - - ---- 632/632/50/50/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:29:00.651778-07:00 web-01 nginx[1206]: 192.26.225.81 - - "GET /admin HTTP/1.1" 200 21599 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:00.705444-07:00 edge-fr-1 kernel: [18099.401283] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.170.55.220 DST=10.0.732.732 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=18099 DF PROTO=TCP SPT=26399 DPT=26399 WINDOW=18099 RES=0x00 SYN URGP=0 2026-10-09T13:29:01.138857-07:00 api-08 app[30668]: INFO worker 43 finished job e2dea844598d4dda in 3111 ms 2026-10-09T13:29:01.272410-07:00 db-primary kernel: [33143.575870] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.140.233.150 DST=10.0.186.186 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=33143 DF PROTO=TCP SPT=54313 DPT=54313 WINDOW=33143 RES=0x00 SYN URGP=0 2026-10-09T13:29:01.396090-07:00 db-replica app[30754]: INFO order 34759 confirmed for deploy in 6993 ms (region eu-west-1, queue invoices) 2026-10-09T13:29:01.419090-07:00 web-02 app[30256]: INFO health check ok: db 306 ms, cache 306 ms, queue depth 80 2026-10-09T13:29:01.624929-07:00 db-replica app[30356]: INFO worker 76 finished job f7136c57f9b7e270 in 1930 ms 2026-10-09T13:29:01.630094-07:00 web-03 nginx[1200]: 192.125.169.195 - - "GET /.env HTTP/1.1" 500 20417 "-" "Go-http-client/1.1" 2026-10-09T13:29:01.703519-07:00 api-08 sshd[46015]: Invalid user root from 172.253.38.212 port 60270 2026-10-09T13:29:01.889507-07:00 web-02 app[30513]: INFO worker 47 picked job b111ed4cda14c067 from queue orders 2026-10-09T13:29:01.975970-07:00 api-07 app[30587]: INFO worker 24 finished job f55fe4f4a1d338ed in 833 ms 2026-10-09T13:29:01.989619-07:00 bastion app[30098]: DEBUG cache hit ratio 69% over the last minute (37375 lookups) 2026-10-09T13:29:02.255004-07:00 api-08 systemd[1]: session-74466.scope: Deactivated successfully. 2026-10-09T13:29:02.406714-07:00 web-01 app[30396]: INFO request_id=5ec0cff35b7bda58 method=GET path=/wp-login.php status=404 duration=9959ms 2026-10-09T13:29:02.622808-07:00 web-03 app[30087]: INFO request_id=72b1fcf0d86d6729 method=GET path=/api/v2/search?q=invoice status=200 duration=1455ms 2026-10-09T13:29:02.799295-07:00 worker-12 nginx[1205]: 91.1.177.126 - - "GET /api/v2/users HTTP/1.1" 502 42645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:02.838898-07:00 db-primary app[30444]: INFO order 17700 confirmed for françois in 7226 ms (region us-east-1, queue webhooks) 2026-10-09T13:29:02.963837-07:00 db-replica kernel: [20022.241324] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.210.173.162 DST=10.0.176.176 LEN=10 TOS=0x00 PREC=0x00 TTL=10 ID=20022 DF PROTO=TCP SPT=21796 DPT=21796 WINDOW=20022 RES=0x00 SYN URGP=0 2026-10-09T13:29:03.041026-07:00 db-primary nginx[1210]: 203.38.253.125 - - "GET /health HTTP/1.1" 502 2238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:03.041060-07:00 edge-fr-1 kernel: [82633.611339] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.99.21.65 DST=10.0.286.286 LEN=79 TOS=0x00 PREC=0x00 TTL=79 ID=82633 DF PROTO=TCP SPT=64867 DPT=64867 WINDOW=82633 RES=0x00 SYN URGP=0 2026-10-09T13:29:03.238727-07:00 api-07 nginx[1202]: 203.198.122.22 - - "GET /metrics HTTP/1.1" 500 63626 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:03.299280-07:00 web-02 haproxy[909]: 91.154.19.118:64193 [71085] http-in app/edge-fr-1 4874/0/654/654/4874 200 64271 - - ---- 748/748/51/51/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:29:03.322776-07:00 worker-12 sshd[48970]: Failed password for invalid user ci from 10.173.51.110 port 6550 ssh2 2026-10-09T13:29:03.429644-07:00 cache-3 sshd[63692]: Connection closed by 10.250.10.101 port 49531 [preauth] 2026-10-09T13:29:04.016274-07:00 db-replica app[30877]: INFO request_id=84481bcb08f41d79 method=GET path=/api/v2/orders/8841 status=200 duration=3262ms 2026-10-09T13:29:04.076362-07:00 api-07 app[30930]: INFO worker 55 finished job 4c039537afc7330c in 8234 ms 2026-10-09T13:29:04.086492-07:00 api-08 nginx[1209]: 172.89.113.226 - backup "POST /.env HTTP/1.1" 200 33822 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:04.178685-07:00 web-01 nginx[1207]: 91.70.29.34 - - "GET /static/app.js HTTP/1.1" 401 61601 "-" "kube-probe/1.31" 2026-10-09T13:29:04.257371-07:00 edge-fr-1 app[30016]: INFO health check ok: db 770 ms, cache 770 ms, queue depth 48 2026-10-09T13:29:04.627124-07:00 db-primary kernel: [31672.965009] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.8.83.236 DST=10.0.248.248 LEN=26 TOS=0x00 PREC=0x00 TTL=26 ID=31672 DF PROTO=TCP SPT=60368 DPT=60368 WINDOW=31672 RES=0x00 SYN URGP=0 2026-10-09T13:29:04.663046-07:00 edge-fr-1 nginx[1202]: 192.132.253.179 - ci "POST /login HTTP/1.1" 301 8742 "-" "python-requests/2.32.3" 2026-10-09T13:29:04.672845-07:00 web-02 nginx[1205]: 172.136.95.128 - - "GET /api/v2/users HTTP/1.1" 200 27687 "-" "Go-http-client/1.1" 2026-10-09T13:29:04.698440-07:00 web-03 app[30589]: INFO order 25778 confirmed for ci in 5088 ms (region eu-west-1, queue emails) 2026-10-09T13:29:05.158761-07:00 bastion sshd[36792]: Failed password for invalid user priya from 192.180.71.108 port 31756 ssh2 2026-10-09T13:29:05.312025-07:00 cache-3 sshd[43733]: Failed password for invalid user sørensen from 10.136.69.34 port 9458 ssh2 2026-10-09T13:29:05.384517-07:00 worker-12 app[30637]: INFO request_id=8c14c27265a66037 method=GET path=/.env status=200 duration=3604ms 2026-10-09T13:29:05.536230-07:00 db-replica sshd[27405]: Received disconnect from 192.239.173.186 port 49208:11: Bye Bye [preauth] 2026-10-09T13:29:05.960933-07:00 worker-12 app[30921]: INFO worker 91 finished job 636a86650292f71c in 8502 ms 2026-10-09T13:29:06.026314-07:00 api-07 app[30013]: INFO request_id=19017bebf7e3abcc method=GET path=/login status=500 duration=3643ms 2026-10-09T13:29:06.037275-07:00 db-primary kernel: [19714.109853] TCP: request_sock_TCP: Possible SYN flooding on port 64509. Sending cookies. Check SNMP counters. 2026-10-09T13:29:06.066347-07:00 web-02 app[30328]: INFO request_id=2c33681cb5f45f9b method=GET path=/static/main.css status=500 duration=5916ms 2026-10-09T13:29:06.155996-07:00 api-07 haproxy[940]: 91.56.162.96:59285 [65252] http-in app/web-03 4226/0/294/294/4226 404 49912 - - ---- 806/806/43/43/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:06.191925-07:00 web-02 sshd[26177]: Received disconnect from 10.159.41.246 port 8710:11: Bye Bye [preauth] 2026-10-09T13:29:06.300548-07:00 api-08 haproxy[922]: 91.65.117.116:1995 [60534] http-in app/api-08 429/0/919/919/429 401 79656 - - ---- 447/447/59/59/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:29:06.412247-07:00 api-08 app[30056]: INFO request_id=13396ce85633a11a method=GET path=/login status=200 duration=3369ms 2026-10-09T13:29:06.583484-07:00 edge-fr-1 systemd[1]: session-17920.scope: Deactivated successfully. 2026-10-09T13:29:06.686481-07:00 worker-12 app[30359]: INFO request_id=6bfbb478ec3c1c5b method=GET path=/static/app.js status=301 duration=7849ms 2026-10-09T13:29:06.898549-07:00 worker-12 systemd[1]: Started Session 16403 of User priya. 2026-10-09T13:29:06.998510-07:00 api-08 app[30726]: DEBUG cache hit ratio 84% over the last minute (31115 lookups) 2026-10-09T13:29:07.151057-07:00 db-replica app[30750]: INFO worker 29 picked job 912db620aa1f85df from queue emails 2026-10-09T13:29:07.267972-07:00 worker-12 app[30668]: INFO request_id=5a8beabee04dac6b method=GET path=/favicon.ico status=200 duration=1018ms 2026-10-09T13:29:07.458144-07:00 db-primary haproxy[913]: 172.243.152.181:10300 [44491] http-in app/web-02 4719/0/843/843/4719 502 85812 - - ---- 810/810/42/42/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:29:07.502102-07:00 db-primary app[30385]: INFO request_id=a63b77ecf715a48b method=GET path=/health status=200 duration=8759ms 2026-10-09T13:29:07.622120-07:00 web-03 nginx[1205]: 203.180.98.61 - - "GET /favicon.ico HTTP/1.1" 200 7773 "-" "kube-probe/1.31" 2026-10-09T13:29:07.867813-07:00 web-02 app[30976]: INFO worker 26 picked job fc39594afdccd420 from queue emails 2026-10-09T13:29:07.895582-07:00 db-replica app[30914]: DEBUG cache hit ratio 42% over the last minute (36182 lookups) 2026-10-09T13:29:08.049416-07:00 edge-fr-1 sshd[26033]: Received disconnect from 203.111.132.231 port 1388:11: Bye Bye [preauth] 2026-10-09T13:29:08.193144-07:00 bastion kernel: [70805.736738] TCP: request_sock_TCP: Possible SYN flooding on port 30033. Sending cookies. Check SNMP counters. 2026-10-09T13:29:08.549415-07:00 web-03 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:29:08.554209-07:00 db-primary app[30643]: INFO request_id=09b8445dabdc5a22 method=GET path=/static/main.css status=200 duration=5539ms 2026-10-09T13:29:08.576900-07:00 cache-3 app[30136]: INFO worker 48 finished job 92472ee79d1d88f0 in 6323 ms 2026-10-09T13:29:08.925015-07:00 worker-12 nginx[1203]: 91.253.204.150 - - "GET /api/v2/users HTTP/1.1" 404 45619 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:09.016302-07:00 worker-12 app[30683]: INFO request_id=f351bcf8195c0e9e method=GET path=/login status=500 duration=9471ms 2026-10-09T13:29:09.089016-07:00 api-08 app[30407]: INFO request_id=9ac0408352968865 method=GET path=/static/main.css status=401 duration=8358ms 2026-10-09T13:29:09.119810-07:00 bastion app[30282]: INFO worker 57 finished job a53a15deccc39b1b in 1712 ms 2026-10-09T13:29:09.134547-07:00 web-02 app[30727]: INFO order 15970 confirmed for müller in 2585 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:09.374158-07:00 api-08 nginx[1205]: 91.160.191.241 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 55918 "-" "python-requests/2.32.3" 2026-10-09T13:29:09.387401-07:00 api-08 app[30083]: INFO worker 95 finished job 33d763a278e0384c in 8831 ms 2026-10-09T13:29:09.388563-07:00 web-02 sshd[61418]: Accepted publickey for zoë from 10.23.246.204 port 8777 ssh2: ED25519 SHA256:3a6dd7c88a4a8bf3 2026-10-09T13:29:09.590222-07:00 db-replica systemd[1]: Started Session 67287 of User müller. 2026-10-09T13:29:09.669218-07:00 web-02 sshd[8468]: Received disconnect from 203.43.105.31 port 8384:11: Bye Bye [preauth] 2026-10-09T13:29:09.899778-07:00 db-primary sshd[58145]: Connection closed by 91.26.245.59 port 48047 [preauth] 2026-10-09T13:29:10.020764-07:00 cache-3 sshd[7806]: Invalid user ci from 45.217.60.127 port 26582 2026-10-09T13:29:10.030429-07:00 web-03 sshd[33256]: Invalid user root from 10.158.95.35 port 48709 2026-10-09T13:29:10.083853-07:00 api-08 haproxy[911]: 203.137.16.123:41126 [70596] http-in app/edge-fr-1 8446/0/372/372/8446 500 35060 - - ---- 187/187/31/31/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:29:10.101123-07:00 bastion nginx[1201]: 203.155.16.2 - - "GET /login HTTP/1.1" 200 86353 "-" "python-requests/2.32.3" 2026-10-09T13:29:10.137250-07:00 db-primary postgres[10947]: LOG: duration: 4104.725 ms statement: SELECT * FROM orders WHERE customer_id = 68288 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:10.200529-07:00 api-08 sshd[34687]: Failed password for invalid user deploy from 10.190.251.217 port 57328 ssh2 2026-10-09T13:29:10.388624-07:00 worker-12 kernel: [96131.131671] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.48.113.43 DST=10.0.881.881 LEN=71 TOS=0x00 PREC=0x00 TTL=71 ID=96131 DF PROTO=TCP SPT=30628 DPT=30628 WINDOW=96131 RES=0x00 SYN URGP=0 2026-10-09T13:29:10.415748-07:00 web-03 app[30970]: DEBUG cache hit ratio 41% over the last minute (13626 lookups) 2026-10-09T13:29:10.507015-07:00 web-02 systemd[1]: session-11061.scope: Deactivated successfully. 2026-10-09T13:29:10.507882-07:00 db-primary nginx[1208]: 203.65.107.230 - sørensen "POST /api/v2/search?q=invoice HTTP/1.1" 401 25057 "-" "Go-http-client/1.1" 2026-10-09T13:29:10.738572-07:00 db-replica nginx[1203]: 172.222.93.79 - - "GET /health HTTP/1.1" 302 26013 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:10.803519-07:00 api-07 systemd[1]: Started Session 34610 of User ci. 2026-10-09T13:29:10.939038-07:00 web-02 app[30913]: INFO request_id=33ec82faf2eefb33 method=GET path=/api/v2/orders status=200 duration=7848ms 2026-10-09T13:29:11.200845-07:00 bastion app[30116]: INFO health check ok: db 26 ms, cache 26 ms, queue depth 64 2026-10-09T13:29:11.330640-07:00 api-07 app[30775]: INFO request_id=e0469ff209e0696a method=GET path=/metrics status=404 duration=2950ms 2026-10-09T13:29:11.472098-07:00 web-03 nginx[1206]: 91.189.91.79 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 36152 "-" "kube-probe/1.31" 2026-10-09T13:29:11.667621-07:00 web-03 kernel: [30473.378088] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.216.78.158 DST=10.0.537.537 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=30473 DF PROTO=TCP SPT=35224 DPT=35224 WINDOW=30473 RES=0x00 SYN URGP=0 2026-10-09T13:29:11.676210-07:00 cache-3 sshd[48243]: Accepted publickey for akira from 172.221.3.129 port 22253 ssh2: ED25519 SHA256:ff4048cb0e593347 2026-10-09T13:29:11.886232-07:00 edge-fr-1 kernel: [89627.201050] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.80.33.84 DST=10.0.915.915 LEN=89 TOS=0x00 PREC=0x00 TTL=89 ID=89627 DF PROTO=TCP SPT=27977 DPT=27977 WINDOW=89627 RES=0x00 SYN URGP=0 2026-10-09T13:29:11.890457-07:00 api-07 systemd[1]: session-99663.scope: Deactivated successfully. 2026-10-09T13:29:12.042250-07:00 worker-12 app[30699]: INFO worker 53 finished job f345bb5b9d56317f in 8646 ms 2026-10-09T13:29:12.042778-07:00 edge-fr-1 app[30082]: INFO worker 48 picked job 16c3f3e8753a9336 from queue orders 2026-10-09T13:29:12.049451-07:00 bastion haproxy[929]: Server app/db-primary is UP, reason: Layer7 check passed, code: 200, check duration: 327ms. 38 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:29:12.180938-07:00 db-primary app[30428]: INFO order 51059 confirmed for françois in 9757 ms (region us-east-1, queue emails) 2026-10-09T13:29:12.288901-07:00 api-08 nginx[1208]: 192.203.32.103 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 73408 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:12.345922-07:00 web-02 app[30234]: INFO order 48548 confirmed for akira in 8727 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:12.482557-07:00 api-07 nginx[1206]: 172.178.125.168 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 918 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:12.537813-07:00 cache-3 app[30963]: INFO order 78352 confirmed for müller in 5776 ms (region ap-northeast-1, queue orders) 2026-10-09T13:29:12.665564-07:00 db-primary haproxy[903]: 192.116.169.142:26966 [95099] http-in app/bastion 5117/0/261/261/5117 204 81837 - - ---- 249/249/40/40/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:13.177114-07:00 worker-12 haproxy[922]: 45.90.162.150:30561 [55089] http-in app/db-primary 9056/0/649/649/9056 200 35231 - - ---- 467/467/16/16/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:29:13.300308-07:00 web-03 nginx[1207]: 45.148.61.93 - - "GET /favicon.ico HTTP/1.1" 500 28633 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:13.409341-07:00 bastion nginx[1207]: 203.57.34.35 - - "GET /api/v2/orders HTTP/1.1" 200 18111 "-" "Go-http-client/1.1" 2026-10-09T13:29:13.425259-07:00 web-02 haproxy[915]: 203.168.53.128:13921 [43402] http-in app/worker-12 7755/0/111/111/7755 200 10195 - - ---- 123/123/91/91/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:29:13.572255-07:00 web-01 nginx[1203]: 10.24.35.214 - - "GET /static/app.js HTTP/1.1" 404 21028 "-" "python-requests/2.32.3" 2026-10-09T13:29:13.698972-07:00 worker-12 app[30349]: WARN slow query (447 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '39 minutes' 2026-10-09T13:29:13.815529-07:00 web-02 sshd[2760]: Received disconnect from 45.246.176.180 port 37335:11: Bye Bye [preauth] 2026-10-09T13:29:13.847517-07:00 worker-12 app[30573]: DEBUG cache hit ratio 25% over the last minute (78698 lookups) 2026-10-09T13:29:13.968635-07:00 db-replica haproxy[948]: 91.236.227.216:14390 [51417] http-in app/db-replica 420/0/841/841/420 200 58361 - - ---- 689/689/96/96/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:29:13.994656-07:00 api-08 sshd[40734]: Connection closed by 172.251.106.135 port 2146 [preauth] 2026-10-09T13:29:14.125323-07:00 web-01 app[30617]: INFO order 95977 confirmed for müller in 1428 ms (region ap-northeast-1, queue orders) 2026-10-09T13:29:14.159649-07:00 api-07 app[30338]: ERROR payment declined for order 40792: card_declined (code 40), customer notified 2026-10-09T13:29:14.219958-07:00 web-03 app[30524]: INFO order 51362 confirmed for priya in 6269 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:14.227902-07:00 cache-3 nginx[1204]: 45.117.234.9 - - "GET /static/main.css HTTP/1.1" 204 4519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:14.683235-07:00 bastion nginx[1209]: 172.172.72.218 - - "GET /api/v2/orders HTTP/1.1" 301 60085 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:14.838841-07:00 web-02 app[30600]: INFO order 57200 confirmed for root in 1439 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:14.887092-07:00 api-07 haproxy[938]: 10.174.74.125:49168 [75298] http-in app/api-07 2772/0/657/657/2772 302 50898 - - ---- 872/872/16/16/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:29:15.092081-07:00 api-08 app[30822]: INFO worker 90 finished job e2f15aafcad71e81 in 6588 ms 2026-10-09T13:29:15.411224-07:00 web-03 app[30792]: INFO order 69217 confirmed for sørensen in 1480 ms (region us-east-1, queue webhooks) 2026-10-09T13:29:15.671585-07:00 web-01 sshd[21528]: Connection closed by 203.107.45.236 port 14997 [preauth] 2026-10-09T13:29:15.754874-07:00 web-03 app[30615]: INFO order 98522 confirmed for françois in 4885 ms (region ap-northeast-1, queue orders) 2026-10-09T13:29:15.950451-07:00 web-02 haproxy[904]: 203.7.26.177:59027 [51345] http-in app/web-01 5194/0/307/307/5194 502 67963 - - ---- 355/355/71/71/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:29:15.958026-07:00 cache-3 nginx[1204]: 91.178.219.32 - root "POST /api/v2/orders HTTP/1.1" 302 84189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:16.003060-07:00 api-08 nginx[1207]: 91.196.163.245 - - "GET /.env HTTP/1.1" 302 79943 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:16.178751-07:00 web-03 haproxy[906]: 172.87.11.195:60773 [18635] http-in app/web-02 4763/0/240/240/4763 502 75171 - - ---- 640/640/57/57/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:29:16.445091-07:00 db-replica nginx[1208]: 172.24.185.70 - - "GET /wp-login.php HTTP/1.1" 404 72038 "-" "Go-http-client/1.1" 2026-10-09T13:29:16.492566-07:00 bastion nginx[1201]: 172.183.223.14 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 8357 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:16.569485-07:00 api-07 app[30137]: INFO worker 27 picked job f2eb99fa26ccea2f from queue emails 2026-10-09T13:29:16.835541-07:00 db-primary sshd[35680]: Invalid user sørensen from 10.147.143.213 port 53331 2026-10-09T13:29:16.843229-07:00 cache-3 nginx[1210]: 203.162.97.205 - - "GET /api/v2/orders HTTP/1.1" 500 60201 "-" "Go-http-client/1.1" 2026-10-09T13:29:16.937252-07:00 api-07 nginx[1202]: 203.73.1.164 - - "GET /login HTTP/1.1" 200 9875 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:17.000004-07:00 web-02 sshd[21750]: Accepted publickey for priya from 91.125.212.54 port 17054 ssh2: ED25519 SHA256:97c56af648168bbf 2026-10-09T13:29:17.029450-07:00 worker-12 app[30208]: INFO order 69083 confirmed for akira in 68 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:29:17.125005-07:00 web-01 app[30374]: INFO health check ok: db 98 ms, cache 98 ms, queue depth 62 2026-10-09T13:29:17.186895-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791577757.254:65273): pid=65273 uid=0 auid=1285 ses=955 msg='op=login id=1285 exe="/usr/sbin/sshd" hostname=? addr=91.48.20.34 terminal=/dev/pts/0 res=success' 2026-10-09T13:29:17.264520-07:00 db-primary postgres[25342]: LOG: duration: 3081.956 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:17.530307-07:00 worker-12 nginx[1209]: 45.97.76.145 - müller "POST /admin HTTP/1.1" 200 40171 "-" "python-requests/2.32.3" 2026-10-09T13:29:17.789138-07:00 web-01 nginx[1208]: 192.173.232.9 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 85856 "-" "python-requests/2.32.3" 2026-10-09T13:29:17.911258-07:00 api-07 sshd[53374]: Invalid user françois from 45.210.4.45 port 15361 2026-10-09T13:29:18.030130-07:00 bastion nginx[1201]: 10.74.158.101 - - "GET /admin HTTP/1.1" 200 46124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:18.132133-07:00 edge-fr-1 postgres[6139]: LOG: duration: 6965.872 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:18.140634-07:00 web-02 app[30762]: INFO worker 18 finished job 65881d122fa639d8 in 9452 ms 2026-10-09T13:29:18.165178-07:00 edge-fr-1 app[30894]: INFO request_id=d5db66a6ffa024e6 method=GET path=/api/v2/orders status=301 duration=5095ms 2026-10-09T13:29:18.260694-07:00 worker-12 app[30326]: INFO worker 11 picked job a0c19181353170e7 from queue webhooks 2026-10-09T13:29:18.741148-07:00 web-02 cron[47588]: (françois) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:29:18.760688-07:00 bastion nginx[1202]: 91.193.84.132 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 9945 "-" "python-requests/2.32.3" 2026-10-09T13:29:18.851345-07:00 web-03 app[30318]: INFO request_id=30ac8e5b2e5dc802 method=GET path=/health status=401 duration=1807ms 2026-10-09T13:29:18.894894-07:00 db-primary systemd[1]: Started Session 14428 of User backup. 2026-10-09T13:29:19.081072-07:00 worker-12 nginx[1201]: 91.220.85.243 - ci "POST /metrics HTTP/1.1" 401 33471 "-" "curl/8.4.0" 2026-10-09T13:29:19.081618-07:00 web-03 app[30118]: INFO request_id=456d9188170ae1d5 method=GET path=/static/app.js status=204 duration=3275ms 2026-10-09T13:29:19.089403-07:00 web-03 app[30062]: WARN retrying upstream 172.248.205.110:12083 after timeout (6569 ms), attempt 1 of 3 2026-10-09T13:29:19.203086-07:00 db-replica nginx[1204]: 91.114.210.9 - - "GET /.env HTTP/1.1" 404 59224 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:19.240995-07:00 bastion nginx[1201]: 192.143.193.127 - - "GET /.env HTTP/1.1" 200 29204 "-" "python-requests/2.32.3" 2026-10-09T13:29:19.298027-07:00 web-01 app[30833]: INFO request_id=4c0a229e34820109 method=GET path=/favicon.ico status=404 duration=8837ms 2026-10-09T13:29:19.328370-07:00 db-replica app[30538]: WARN slow query (5192 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '56 minutes' 2026-10-09T13:29:19.401456-07:00 api-07 nginx[1207]: 172.30.91.94 - - "GET /login HTTP/1.1" 204 60595 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:19.492407-07:00 bastion systemd[1]: session-21660.scope: Deactivated successfully. 2026-10-09T13:29:19.705462-07:00 cache-3 nginx[1206]: 10.225.47.253 - - "GET /api/v2/users HTTP/1.1" 200 31623 "-" "kube-probe/1.31" 2026-10-09T13:29:19.712395-07:00 db-primary haproxy[936]: 91.113.147.13:62389 [43480] http-in app/web-03 6514/0/955/955/6514 302 33690 - - ---- 210/210/29/29/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:29:19.756037-07:00 api-08 app[30463]: INFO worker 99 finished job 9ce75fddeb587691 in 1681 ms 2026-10-09T13:29:19.987560-07:00 web-02 app[30035]: INFO worker 13 picked job 65a5a41a5238b754 from queue orders 2026-10-09T13:29:20.257497-07:00 worker-12 nginx[1204]: 172.195.228.237 - - "GET /favicon.ico HTTP/1.1" 502 20897 "-" "curl/8.4.0" 2026-10-09T13:29:20.339752-07:00 worker-12 kernel: [89059.430939] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.140.151.186 DST=10.0.763.763 LEN=88 TOS=0x00 PREC=0x00 TTL=88 ID=89059 DF PROTO=TCP SPT=31884 DPT=31884 WINDOW=89059 RES=0x00 SYN URGP=0 2026-10-09T13:29:20.528692-07:00 db-primary app[30490]: DEBUG cache hit ratio 22% over the last minute (52948 lookups) 2026-10-09T13:29:20.559577-07:00 web-01 sshd[2837]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:29:20.632603-07:00 cache-3 app[30652]: INFO order 71267 confirmed for ci in 7356 ms (region eu-west-1, queue emails) 2026-10-09T13:29:20.874138-07:00 api-07 app[30299]: INFO request_id=8c397ae0dca1f0d5 method=GET path=/health status=301 duration=2185ms 2026-10-09T13:29:20.887900-07:00 api-08 app[30049]: INFO order 21837 confirmed for sørensen in 565 ms (region us-east-1, queue webhooks) 2026-10-09T13:29:21.096611-07:00 db-replica app[30458]: INFO order 87959 confirmed for müller in 5411 ms (region ap-northeast-1, queue emails) 2026-10-09T13:29:21.133277-07:00 worker-12 app[30737]: INFO health check ok: db 901 ms, cache 901 ms, queue depth 43 2026-10-09T13:29:21.392734-07:00 cache-3 app[30882]: DEBUG cache hit ratio 41% over the last minute (18772 lookups) 2026-10-09T13:29:21.478338-07:00 worker-12 nginx[1200]: 45.221.165.76 - ci "POST /api/v2/users HTTP/1.1" 204 58601 "-" "python-requests/2.32.3" 2026-10-09T13:29:21.822529-07:00 web-03 nginx[1207]: 91.92.4.141 - - "GET /api/v2/users HTTP/1.1" 204 36922 "-" "kube-probe/1.31" 2026-10-09T13:29:21.966468-07:00 db-replica nginx[1204]: 10.213.66.168 - - "GET /login HTTP/1.1" 502 23470 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:22.033493-07:00 db-replica sshd[43095]: Invalid user backup from 172.11.154.240 port 33621 2026-10-09T13:29:22.250648-07:00 web-02 kernel: [42459.946907] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.21.38.190 DST=10.0.913.913 LEN=10 TOS=0x00 PREC=0x00 TTL=10 ID=42459 DF PROTO=TCP SPT=14599 DPT=14599 WINDOW=42459 RES=0x00 SYN URGP=0 2026-10-09T13:29:22.595601-07:00 db-primary app[30462]: INFO worker 94 picked job a6dd0e1ca6224b8c from queue invoices 2026-10-09T13:29:22.633164-07:00 db-primary cron[48963]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:29:23.277306-07:00 bastion app[30455]: INFO worker 22 finished job c118b8d78210ec44 in 5185 ms 2026-10-09T13:29:23.296067-07:00 edge-fr-1 nginx[1208]: 172.64.162.28 - - "GET /metrics HTTP/1.1" 301 74029 "-" "python-requests/2.32.3" 2026-10-09T13:29:23.363340-07:00 db-replica nginx[1205]: 172.98.70.123 - - "GET /admin HTTP/1.1" 200 48618 "-" "kube-probe/1.31" 2026-10-09T13:29:23.547118-07:00 worker-12 haproxy[950]: 203.41.56.248:31768 [66744] http-in app/db-primary 9295/0/911/911/9295 404 56714 - - ---- 935/935/72/72/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:23.688414-07:00 web-01 kernel: [30612.344486] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.210.238.209 DST=10.0.300.300 LEN=99 TOS=0x00 PREC=0x00 TTL=99 ID=30612 DF PROTO=TCP SPT=10318 DPT=10318 WINDOW=30612 RES=0x00 SYN URGP=0 2026-10-09T13:29:23.764868-07:00 bastion systemd[1]: session-72366.scope: Deactivated successfully. 2026-10-09T13:29:23.807506-07:00 api-07 sshd[43248]: Received disconnect from 10.162.86.147 port 47287:11: Bye Bye [preauth] 2026-10-09T13:29:23.905292-07:00 db-replica sshd[27268]: Connection closed by 203.153.197.206 port 18873 [preauth] 2026-10-09T13:29:23.954480-07:00 db-primary app[30174]: INFO request_id=035c88157ede7c53 method=GET path=/health status=200 duration=3151ms 2026-10-09T13:29:23.987327-07:00 edge-fr-1 kernel: [90844.750208] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.69.40.161 DST=10.0.750.750 LEN=36 TOS=0x00 PREC=0x00 TTL=36 ID=90844 DF PROTO=TCP SPT=23698 DPT=23698 WINDOW=90844 RES=0x00 SYN URGP=0 2026-10-09T13:29:23.997570-07:00 db-replica sshd[26989]: Connection closed by 172.52.201.124 port 8313 [preauth] 2026-10-09T13:29:24.220876-07:00 db-replica systemd[1]: Started Session 88139 of User zoë. 2026-10-09T13:29:24.313341-07:00 db-replica app[30821]: INFO request_id=437d54be6493ff1f method=GET path=/wp-login.php status=200 duration=8304ms 2026-10-09T13:29:24.372804-07:00 bastion app[30242]: INFO order 69192 confirmed for ci in 633 ms (region eu-west-1, queue emails) 2026-10-09T13:29:24.764581-07:00 worker-12 haproxy[908]: 172.216.67.2:22705 [18465] http-in app/web-02 6815/0/638/638/6815 200 59517 - - ---- 142/142/49/49/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:25.167495-07:00 worker-12 sshd[21372]: pam_unix(sshd:session): session opened for user akira(uid=8972) by (uid=0) 2026-10-09T13:29:25.174998-07:00 worker-12 haproxy[950]: 45.137.98.37:44946 [82104] http-in app/worker-12 6755/0/745/745/6755 200 55828 - - ---- 753/753/52/52/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:29:25.208071-07:00 db-replica app[30010]: INFO health check ok: db 974 ms, cache 974 ms, queue depth 76 2026-10-09T13:29:25.350889-07:00 db-replica nginx[1210]: 172.97.177.250 - - "GET /admin HTTP/1.1" 502 69249 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:25.466904-07:00 web-01 app[30651]: INFO worker 69 finished job 94f5bb6d0057bb7b in 3698 ms 2026-10-09T13:29:25.552797-07:00 cache-3 sshd[11593]: Received disconnect from 192.142.218.48 port 1836:11: Bye Bye [preauth] 2026-10-09T13:29:25.668447-07:00 db-replica systemd[1]: Started Session 98422 of User sørensen. 2026-10-09T13:29:25.736213-07:00 api-08 app[30914]: INFO health check ok: db 370 ms, cache 370 ms, queue depth 19 2026-10-09T13:29:25.792270-07:00 api-08 nginx[1200]: 91.46.90.131 - - "GET /wp-login.php HTTP/1.1" 404 67628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:25.917080-07:00 api-07 kernel: [30181.284267] TCP: request_sock_TCP: Possible SYN flooding on port 59153. Sending cookies. Check SNMP counters. 2026-10-09T13:29:25.990915-07:00 web-03 app[30473]: INFO order 46681 confirmed for ci in 225 ms (region eu-west-1, queue orders) 2026-10-09T13:29:26.030093-07:00 db-primary app[30365]: INFO worker 43 picked job 7e503eb78bd8605d from queue emails 2026-10-09T13:29:26.100980-07:00 cache-3 sshd[28583]: Invalid user deploy from 91.114.170.175 port 58977 2026-10-09T13:29:26.204304-07:00 web-03 app[30264]: INFO worker 17 picked job 49c44b19c73d0acf from queue webhooks 2026-10-09T13:29:26.222433-07:00 cache-3 nginx[1203]: 10.227.113.234 - backup "POST /admin HTTP/1.1" 500 80837 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:26.463539-07:00 web-02 sshd[60075]: Connection closed by 10.87.212.64 port 51863 [preauth] 2026-10-09T13:29:26.575544-07:00 web-02 app[30244]: INFO worker 58 finished job be77e0d17352bdc7 in 9757 ms 2026-10-09T13:29:26.788336-07:00 edge-fr-1 app[30705]: INFO health check ok: db 714 ms, cache 714 ms, queue depth 62 2026-10-09T13:29:27.158830-07:00 web-03 nginx[1208]: 192.216.248.84 - - "GET /metrics HTTP/1.1" 200 55372 "-" "python-requests/2.32.3" 2026-10-09T13:29:27.212717-07:00 db-replica haproxy[920]: 91.12.160.128:46831 [39550] http-in app/bastion 5892/0/373/373/5892 204 55183 - - ---- 571/571/80/80/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:29:27.272130-07:00 web-03 sshd[60071]: Failed password for invalid user françois from 203.214.172.173 port 18667 ssh2 2026-10-09T13:29:27.311861-07:00 web-02 postgres[10390]: LOG: duration: 3857.175 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:27.352044-07:00 web-02 app[30813]: INFO worker 66 finished job 0cbc442bc96ba862 in 1746 ms 2026-10-09T13:29:27.702893-07:00 db-primary app[30038]: INFO health check ok: db 104 ms, cache 104 ms, queue depth 75 2026-10-09T13:29:27.781385-07:00 web-03 kernel: [18138.628720] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.105.189.165 DST=10.0.231.231 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=18138 DF PROTO=TCP SPT=54437 DPT=54437 WINDOW=18138 RES=0x00 SYN URGP=0 2026-10-09T13:29:27.883137-07:00 web-02 nginx[1208]: 10.155.15.104 - - "GET /api/v2/users HTTP/1.1" 302 21762 "-" "python-requests/2.32.3" 2026-10-09T13:29:28.002224-07:00 api-07 postgres[20337]: LOG: duration: 4899.838 ms statement: SELECT * FROM orders WHERE customer_id = 28623 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:28.090374-07:00 web-01 app[30123]: INFO request_id=f39a6d9944194a2f method=GET path=/login status=200 duration=3335ms 2026-10-09T13:29:28.226009-07:00 bastion app[30385]: INFO request_id=660b8ad86e4cd20b method=GET path=/wp-login.php status=301 duration=1438ms 2026-10-09T13:29:28.349031-07:00 api-08 app[30063]: WARN retrying upstream 45.35.132.26:25476 after timeout (9993 ms), attempt 1 of 3 2026-10-09T13:29:28.498026-07:00 web-02 app[30556]: INFO worker 18 finished job 43966769fa4ad65b in 1226 ms 2026-10-09T13:29:28.527752-07:00 bastion nginx[1202]: 45.112.237.60 - - "GET /favicon.ico HTTP/1.1" 200 65895 "-" "curl/8.4.0" 2026-10-09T13:29:28.819087-07:00 web-03 app[30637]: INFO worker 75 finished job ca382244e9b62ac2 in 6899 ms 2026-10-09T13:29:29.104873-07:00 api-08 app[30048]: INFO worker 87 finished job c6b754284630d609 in 5193 ms 2026-10-09T13:29:29.164775-07:00 api-08 app[30044]: INFO request_id=047bd874599ee787 method=GET path=/api/v2/search?q=invoice status=500 duration=7695ms 2026-10-09T13:29:29.176133-07:00 api-08 nginx[1200]: 91.121.112.1 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 59896 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:29.531490-07:00 db-replica nginx[1208]: 45.177.20.17 - - "GET /health HTTP/1.1" 302 56279 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:29.741635-07:00 cache-3 sshd[43300]: Connection closed by 45.251.161.119 port 14558 [preauth] 2026-10-09T13:29:29.793347-07:00 db-primary app[30171]: INFO request_id=689fd86e9b3c6cd9 method=GET path=/login status=401 duration=4664ms 2026-10-09T13:29:29.800622-07:00 api-07 app[30133]: INFO worker 99 picked job d8f989f577f8d306 from queue emails 2026-10-09T13:29:30.003342-07:00 edge-fr-1 app[30860]: INFO order 68444 confirmed for françois in 6707 ms (region us-east-1, queue emails) 2026-10-09T13:29:30.049864-07:00 api-07 postgres[8570]: LOG: checkpoint complete: wrote 4240 buffers (85%); 0 WAL file(s) added, 0 removed, 53 recycled; write=9835.118 s, sync=0.118 s, total=9835.118 s 2026-10-09T13:29:30.111221-07:00 edge-fr-1 nginx[1208]: 203.131.29.198 - - "GET /.env HTTP/1.1" 401 7134 "-" "kube-probe/1.31" 2026-10-09T13:29:30.130200-07:00 edge-fr-1 postgres[24087]: LOG: duration: 7106.16 ms statement: SELECT * FROM orders WHERE customer_id = 10083 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:30.213683-07:00 edge-fr-1 app[30848]: INFO worker 93 finished job 7ec395ac8ba678a5 in 7803 ms 2026-10-09T13:29:30.230122-07:00 worker-12 app[30764]: WARN retrying upstream 192.113.228.1:39118 after timeout (1141 ms), attempt 2 of 3 2026-10-09T13:29:30.246462-07:00 bastion app[30465]: INFO health check ok: db 74 ms, cache 74 ms, queue depth 46 2026-10-09T13:29:30.254759-07:00 db-replica kernel: [59073.349424] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.118.121.118 DST=10.0.327.327 LEN=50 TOS=0x00 PREC=0x00 TTL=50 ID=59073 DF PROTO=TCP SPT=17668 DPT=17668 WINDOW=59073 RES=0x00 SYN URGP=0 2026-10-09T13:29:30.316640-07:00 web-01 sshd[14118]: Failed password for invalid user zoë from 203.167.190.8 port 37241 ssh2 2026-10-09T13:29:30.364254-07:00 api-07 sshd[45605]: Accepted publickey for müller from 91.129.16.239 port 18993 ssh2: ED25519 SHA256:db2d528d11893dd3 2026-10-09T13:29:30.412029-07:00 api-08 nginx[1208]: 10.111.121.140 - - "GET /metrics HTTP/1.1" 404 69357 "-" "kube-probe/1.31" 2026-10-09T13:29:30.542561-07:00 web-01 nginx[1206]: 45.71.215.218 - - "GET /api/v2/orders HTTP/1.1" 200 2303 "-" "kube-probe/1.31" 2026-10-09T13:29:30.551553-07:00 db-replica app[30396]: INFO order 80378 confirmed for françois in 1718 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:30.614946-07:00 web-03 nginx[1207]: 10.19.228.76 - - "GET /static/main.css HTTP/1.1" 500 16361 "-" "kube-probe/1.31" 2026-10-09T13:29:30.752584-07:00 worker-12 nginx[1205]: 203.173.104.61 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 56975 "-" "Go-http-client/1.1" 2026-10-09T13:29:31.157374-07:00 cache-3 sshd[43236]: Accepted publickey for root from 91.86.150.140 port 23836 ssh2: ED25519 SHA256:69283f5f997c1949 2026-10-09T13:29:31.170555-07:00 api-08 nginx[1202]: 91.86.107.169 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 2522 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:31.493365-07:00 web-02 haproxy[911]: 91.85.196.167:64225 [57946] http-in app/db-replica 4940/0/883/883/4940 301 67741 - - ---- 180/180/13/13/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:29:31.519732-07:00 web-02 postgres[20960]: LOG: checkpoint complete: wrote 9753 buffers (56%); 0 WAL file(s) added, 0 removed, 33 recycled; write=7341.467 s, sync=0.467 s, total=7341.467 s 2026-10-09T13:29:32.043604-07:00 web-01 nginx[1207]: 10.198.118.41 - zoë "POST /static/app.js HTTP/1.1" 502 39167 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:32.048858-07:00 worker-12 app[30031]: INFO request_id=1ec8dba8cdf5f98e method=GET path=/static/app.js status=500 duration=7566ms 2026-10-09T13:29:32.060319-07:00 web-03 sshd[41725]: Received disconnect from 45.73.207.9 port 25292:11: Bye Bye [preauth] 2026-10-09T13:29:32.204515-07:00 api-08 sshd[17881]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:29:32.297111-07:00 db-primary app[30711]: INFO order 74179 confirmed for müller in 5895 ms (region ap-northeast-1, queue emails) 2026-10-09T13:29:32.358504-07:00 web-01 app[30463]: INFO request_id=30089e6155b1885d method=GET path=/api/v2/orders/8841 status=200 duration=3996ms 2026-10-09T13:29:32.374240-07:00 edge-fr-1 sshd[21007]: Invalid user sørensen from 45.206.177.170 port 42718 2026-10-09T13:29:32.661933-07:00 api-08 app[30391]: INFO worker 68 finished job ba26feeb321f50f4 in 1613 ms 2026-10-09T13:29:32.850393-07:00 db-primary nginx[1204]: 45.86.148.102 - - "GET /metrics HTTP/1.1" 404 21701 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:32.856641-07:00 api-07 app[30976]: INFO health check ok: db 594 ms, cache 594 ms, queue depth 58 2026-10-09T13:29:32.898374-07:00 bastion sshd[48367]: Failed password for invalid user root from 203.4.219.7 port 6959 ssh2 2026-10-09T13:29:33.290338-07:00 api-08 app[30166]: INFO request_id=585cd42a73714dbc method=GET path=/api/v2/users status=204 duration=7453ms 2026-10-09T13:29:33.400728-07:00 web-02 kernel: [99918.134227] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.199.50.121 DST=10.0.584.584 LEN=77 TOS=0x00 PREC=0x00 TTL=77 ID=99918 DF PROTO=TCP SPT=16460 DPT=16460 WINDOW=99918 RES=0x00 SYN URGP=0 2026-10-09T13:29:33.433523-07:00 web-01 nginx[1203]: 172.157.58.227 - - "GET /metrics HTTP/1.1" 200 27087 "-" "kube-probe/1.31" 2026-10-09T13:29:33.510000-07:00 db-replica nginx[1209]: 192.29.118.27 - - "GET /login HTTP/1.1" 200 52947 "-" "curl/8.4.0" 2026-10-09T13:29:33.939100-07:00 web-03 sshd[507]: pam_unix(sshd:session): session opened for user backup(uid=7805) by (uid=0) 2026-10-09T13:29:33.982432-07:00 api-07 app[30333]: INFO order 44042 confirmed for françois in 6856 ms (region eu-west-1, queue emails) 2026-10-09T13:29:34.031061-07:00 db-replica nginx[1202]: 45.143.228.140 - sørensen "POST /health HTTP/1.1" 200 12818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:34.182045-07:00 api-07 sshd[7701]: Failed password for invalid user françois from 203.124.38.129 port 53753 ssh2 2026-10-09T13:29:34.304201-07:00 cache-3 app[30400]: INFO request_id=6b52e8b966f58579 method=GET path=/api/v2/orders status=404 duration=3107ms 2026-10-09T13:29:34.326311-07:00 cache-3 sshd[20871]: Failed password for invalid user root from 203.19.124.114 port 38236 ssh2 2026-10-09T13:29:34.455209-07:00 cache-3 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:29:34.515606-07:00 api-07 app[30117]: INFO order 89365 confirmed for ci in 3272 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:29:34.613660-07:00 api-07 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:29:35.087801-07:00 worker-12 app[30779]: INFO request_id=cc9cb367fb1241f1 method=GET path=/api/v2/users status=401 duration=1739ms 2026-10-09T13:29:35.437027-07:00 db-replica nginx[1209]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.32.252.37, server: app.example.com, request: "GET /admin HTTP/1.1", upstream: "http://10.0.529.529:8080/admin" 2026-10-09T13:29:35.517668-07:00 db-replica nginx[1210]: 203.120.77.160 - - "GET /metrics HTTP/1.1" 404 38354 "-" "python-requests/2.32.3" 2026-10-09T13:29:35.548237-07:00 cache-3 nginx[1203]: 45.103.222.37 - deploy "POST /api/v2/search?q=invoice HTTP/1.1" 301 5664 "-" "python-requests/2.32.3" 2026-10-09T13:29:35.796721-07:00 web-03 postgres[11727]: LOG: duration: 445.327 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:35.804616-07:00 bastion app[30641]: INFO request_id=dc4a020ddb1650e8 method=GET path=/static/app.js status=502 duration=1026ms 2026-10-09T13:29:36.035630-07:00 db-replica app[30290]: INFO worker 32 finished job 42ff313b9b17acf3 in 777 ms 2026-10-09T13:29:36.415584-07:00 web-01 nginx[1204]: 172.178.176.141 - - "GET /api/v2/users HTTP/1.1" 404 69664 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:36.484999-07:00 web-02 sshd[21093]: pam_unix(sshd:session): session opened for user root(uid=4085) by (uid=0) 2026-10-09T13:29:36.521254-07:00 edge-fr-1 nginx[1209]: 45.37.10.13 - - "GET /admin HTTP/1.1" 200 50127 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:36.822051-07:00 worker-12 nginx[1206]: 192.91.92.126 - - "GET /.env HTTP/1.1" 204 29484 "-" "python-requests/2.32.3" 2026-10-09T13:29:36.859978-07:00 web-03 sshd[21903]: Invalid user root from 10.152.142.183 port 16632 2026-10-09T13:29:36.999014-07:00 api-07 sshd[5218]: Failed password for invalid user akira from 45.125.181.123 port 44841 ssh2 2026-10-09T13:29:37.021370-07:00 worker-12 haproxy[944]: 192.1.179.132:54754 [30757] http-in app/web-02 2070/0/441/441/2070 200 88603 - - ---- 791/791/30/30/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:29:37.373128-07:00 bastion app[30445]: INFO health check ok: db 700 ms, cache 700 ms, queue depth 12 2026-10-09T13:29:37.525806-07:00 api-07 nginx[1208]: 45.39.179.6 - - "GET /api/v2/users HTTP/1.1" 502 34891 "-" "curl/8.4.0" 2026-10-09T13:29:38.080705-07:00 db-primary systemd[1]: Started Session 65564 of User sørensen. 2026-10-09T13:29:38.303216-07:00 api-08 nginx[1200]: 45.180.226.24 - - "GET /api/v2/users HTTP/1.1" 401 52824 "-" "curl/8.4.0" 2026-10-09T13:29:38.324025-07:00 web-03 sshd[64827]: Accepted publickey for deploy from 91.224.45.217 port 63061 ssh2: ED25519 SHA256:3da7f3de6c4114ac 2026-10-09T13:29:38.393853-07:00 web-02 nginx[1207]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.36.31.8, server: app.example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.946.946:8080/favicon.ico" 2026-10-09T13:29:38.449026-07:00 bastion postgres[18253]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 49290 remain, 6228 scanned (26% of total) 2026-10-09T13:29:38.611064-07:00 worker-12 kubelet[800]: I1009 13:29:38.914056 8972 kubelet.go:8972] "Pod is terminating, skipping pod status update" pod="default/api-d1df79262f8d48be" 2026-10-09T13:29:38.614911-07:00 api-07 sshd[15852]: Connection closed by 10.26.247.154 port 38756 [preauth] 2026-10-09T13:29:38.672918-07:00 bastion app[30176]: INFO request_id=95b8dd89808d4722 method=GET path=/static/main.css status=500 duration=3895ms 2026-10-09T13:29:38.743087-07:00 api-08 cron[7537]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:29:38.833079-07:00 api-07 nginx[1209]: 10.184.91.54 - priya "POST /login HTTP/1.1" 302 19955 "-" "curl/8.4.0" 2026-10-09T13:29:38.960318-07:00 cache-3 nginx[1203]: 192.114.21.246 - - "GET /api/v2/users HTTP/1.1" 200 14668 "-" "kube-probe/1.31" 2026-10-09T13:29:39.029816-07:00 cache-3 nginx[1203]: 203.136.134.53 - sørensen "POST /admin HTTP/1.1" 200 38788 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:39.192125-07:00 web-01 systemd[1]: session-39527.scope: Deactivated successfully. 2026-10-09T13:29:39.509523-07:00 cache-3 app[30267]: WARN retrying upstream 91.154.86.178:12881 after timeout (5337 ms), attempt 3 of 3 2026-10-09T13:29:39.524028-07:00 db-primary haproxy[927]: 172.47.83.168:39332 [58375] http-in app/web-01 8621/0/488/488/8621 200 74441 - - ---- 177/177/43/43/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:29:39.551750-07:00 edge-fr-1 kernel: [73779.873829] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.61.107.38 DST=10.0.677.677 LEN=53 TOS=0x00 PREC=0x00 TTL=53 ID=73779 DF PROTO=TCP SPT=10744 DPT=10744 WINDOW=73779 RES=0x00 SYN URGP=0 2026-10-09T13:29:39.845052-07:00 web-01 app[30378]: INFO request_id=f50efc2e1c3a6417 method=GET path=/health status=401 duration=383ms 2026-10-09T13:29:39.866148-07:00 bastion dockerd[700]: time="2026-10-09T13:29:39.866148-07:00" level=warning msg="Health check for container 1391d7828ac38dbd error: context deadline exceeded" 2026-10-09T13:29:39.889917-07:00 worker-12 nginx[1202]: 172.9.220.181 - backup "POST /wp-login.php HTTP/1.1" 302 69894 "-" "Go-http-client/1.1" 2026-10-09T13:29:40.035841-07:00 bastion nginx[1207]: 45.180.226.220 - müller "POST /metrics HTTP/1.1" 401 41001 "-" "curl/8.4.0" 2026-10-09T13:29:40.166997-07:00 api-07 nginx[1207]: 91.36.154.199 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 73046 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:40.205589-07:00 bastion app[30355]: INFO order 23205 confirmed for müller in 9096 ms (region us-east-1, queue orders) 2026-10-09T13:29:40.309507-07:00 bastion nginx[1209]: 203.61.147.170 - - "GET /favicon.ico HTTP/1.1" 404 61126 "-" "curl/8.4.0" 2026-10-09T13:29:40.345860-07:00 db-replica nginx[1205]: 45.21.90.230 - - "GET /wp-login.php HTTP/1.1" 301 20933 "-" "kube-probe/1.31" 2026-10-09T13:29:40.382154-07:00 bastion postgres[21462]: LOG: duration: 1843.917 ms statement: SELECT * FROM orders WHERE customer_id = 93669 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:40.444808-07:00 db-primary nginx[1208]: 203.135.193.25 - priya "POST /.env HTTP/1.1" 404 84878 "-" "python-requests/2.32.3" 2026-10-09T13:29:40.490253-07:00 db-replica nginx[1200]: 192.13.216.124 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 42396 "-" "kube-probe/1.31" 2026-10-09T13:29:40.674038-07:00 cache-3 app[30024]: INFO worker 88 finished job 468c9154d35cc442 in 1516 ms 2026-10-09T13:29:41.006313-07:00 api-08 nginx[1210]: 10.43.103.143 - müller "POST /api/v2/search?q=invoice HTTP/1.1" 404 76302 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:41.048709-07:00 web-03 sshd[9694]: Received disconnect from 203.188.215.58 port 18278:11: Bye Bye [preauth] 2026-10-09T13:29:41.254500-07:00 edge-fr-1 app[30147]: INFO worker 14 finished job 35d082b6ea1dbc11 in 3442 ms 2026-10-09T13:29:41.489943-07:00 web-03 cron[46432]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:29:41.700456-07:00 bastion app[30143]: INFO order 16221 confirmed for akira in 1254 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:29:41.868272-07:00 cache-3 app[30521]: WARN retrying upstream 192.195.162.224:31990 after timeout (6761 ms), attempt 1 of 3 2026-10-09T13:29:42.201780-07:00 web-03 nginx[1200]: 91.162.152.212 - - "GET /static/main.css HTTP/1.1" 404 56491 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:42.331850-07:00 bastion kernel: [28979.329799] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.49.238.106 DST=10.0.356.356 LEN=44 TOS=0x00 PREC=0x00 TTL=44 ID=28979 DF PROTO=TCP SPT=37313 DPT=37313 WINDOW=28979 RES=0x00 SYN URGP=0 2026-10-09T13:29:42.344704-07:00 web-02 haproxy[919]: 192.80.150.21:20267 [55241] http-in app/edge-fr-1 4374/0/481/481/4374 200 46091 - - ---- 305/305/28/28/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:29:42.391160-07:00 api-08 nginx[1201]: 91.16.193.144 - - "GET /api/v2/users HTTP/1.1" 200 53067 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:42.422080-07:00 db-primary app[30961]: INFO request_id=d1da95d297abdb2e method=GET path=/health status=301 duration=2713ms 2026-10-09T13:29:42.424854-07:00 web-01 app[30220]: INFO health check ok: db 579 ms, cache 579 ms, queue depth 10 2026-10-09T13:29:42.471211-07:00 bastion haproxy[948]: 192.21.216.1:42112 [95011] http-in app/web-03 6448/0/611/611/6448 302 28950 - - ---- 556/556/81/81/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:29:42.937764-07:00 bastion sshd[16808]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:29:43.014137-07:00 edge-fr-1 nginx[1201]: 203.42.232.127 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 21989 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:43.016930-07:00 web-03 nginx[1203]: 172.53.128.114 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 9697 "-" "kube-probe/1.31" 2026-10-09T13:29:43.080789-07:00 worker-12 nginx[1209]: 10.146.137.22 - backup "POST /.env HTTP/1.1" 204 58480 "-" "kube-probe/1.31" 2026-10-09T13:29:43.436560-07:00 bastion app[30044]: INFO request_id=de5f5c4e1c9b5d02 method=GET path=/static/app.js status=200 duration=6386ms 2026-10-09T13:29:43.533222-07:00 worker-12 haproxy[948]: 192.39.134.172:28610 [24434] http-in app/edge-fr-1 967/0/112/112/967 401 16866 - - ---- 740/740/63/63/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:29:43.595552-07:00 api-07 app[30857]: INFO request_id=9f3ad5caca8bc62d method=GET path=/wp-login.php status=404 duration=2079ms 2026-10-09T13:29:43.671345-07:00 web-03 nginx[1207]: 91.35.228.230 - - "GET /static/app.js HTTP/1.1" 401 44485 "-" "python-requests/2.32.3" 2026-10-09T13:29:43.698304-07:00 web-03 haproxy[916]: 192.137.106.152:6655 [38645] http-in app/api-08 7067/0/746/746/7067 502 42067 - - ---- 745/745/75/75/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:29:43.856709-07:00 web-02 nginx[1203]: 45.181.139.17 - backup "POST /.env HTTP/1.1" 301 60254 "-" "kube-probe/1.31" 2026-10-09T13:29:44.078126-07:00 cache-3 nginx[1205]: 10.167.49.166 - - "GET /admin HTTP/1.1" 500 64393 "-" "curl/8.4.0" 2026-10-09T13:29:44.105121-07:00 worker-12 sshd[52277]: Connection closed by 192.77.153.122 port 29281 [preauth] 2026-10-09T13:29:44.111418-07:00 web-01 app[30434]: INFO health check ok: db 111 ms, cache 111 ms, queue depth 55 2026-10-09T13:29:44.153066-07:00 db-replica app[30972]: INFO request_id=08d3922f809c75c5 method=GET path=/metrics status=301 duration=1735ms 2026-10-09T13:29:44.468091-07:00 bastion sshd[25145]: Accepted publickey for zoë from 192.95.59.25 port 48385 ssh2: ED25519 SHA256:ba78c88ec4f979b8 2026-10-09T13:29:44.470739-07:00 web-03 app[30261]: INFO request_id=3a5056caea578b81 method=GET path=/metrics status=500 duration=771ms 2026-10-09T13:29:44.471685-07:00 api-08 sshd[20055]: Failed password for invalid user ci from 172.173.126.43 port 61229 ssh2 2026-10-09T13:29:44.509905-07:00 api-07 app[30675]: INFO worker 59 finished job 4d9e60de353ac3e0 in 4527 ms 2026-10-09T13:29:44.586084-07:00 web-01 nginx[1209]: 10.188.72.132 - françois "POST /static/app.js HTTP/1.1" 200 64443 "-" "curl/8.4.0" 2026-10-09T13:29:44.682616-07:00 worker-12 app[30635]: INFO order 74499 confirmed for backup in 3931 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:29:45.003296-07:00 web-02 postgres[14539]: LOG: duration: 828.429 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:45.076724-07:00 web-01 app[30434]: INFO request_id=cd0332fdb355f8c3 method=GET path=/metrics status=200 duration=9575ms 2026-10-09T13:29:45.109212-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577785.152:20031): pid=20031 uid=0 auid=6815 ses=818 msg='op=login id=6815 exe="/usr/sbin/sshd" hostname=? addr=203.190.203.208 terminal=/dev/pts/0 res=success' 2026-10-09T13:29:45.128968-07:00 web-03 haproxy[923]: 91.113.139.247:18521 [37005] http-in app/worker-12 7059/0/50/50/7059 200 80657 - - ---- 821/821/27/27/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:29:45.421139-07:00 edge-fr-1 kernel: [11699.592879] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.237.84.8 DST=10.0.105.105 LEN=93 TOS=0x00 PREC=0x00 TTL=93 ID=11699 DF PROTO=TCP SPT=33493 DPT=33493 WINDOW=11699 RES=0x00 SYN URGP=0 2026-10-09T13:29:45.614014-07:00 worker-12 nginx[1207]: 192.104.95.85 - - "GET /api/v2/users HTTP/1.1" 500 61211 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:45.638682-07:00 cache-3 postgres[15658]: LOG: duration: 717.10 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:45.641274-07:00 db-replica sshd[39621]: Received disconnect from 192.227.71.8 port 60143:11: Bye Bye [preauth] 2026-10-09T13:29:45.785521-07:00 db-replica sshd[14081]: Connection closed by 45.188.125.92 port 37699 [preauth] 2026-10-09T13:29:45.845423-07:00 web-02 app[30275]: INFO order 74759 confirmed for priya in 7145 ms (region us-east-1, queue emails) 2026-10-09T13:29:45.932285-07:00 cache-3 app[30016]: INFO worker 23 picked job 9187176105eb67ce from queue orders 2026-10-09T13:29:45.941551-07:00 db-replica sshd[32322]: Failed password for invalid user akira from 192.228.110.137 port 3309 ssh2 2026-10-09T13:29:46.070591-07:00 bastion postgres[19214]: LOG: duration: 82.647 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:46.094944-07:00 edge-fr-1 app[30606]: INFO order 57517 confirmed for françois in 6794 ms (region us-east-1, queue webhooks) 2026-10-09T13:29:46.097687-07:00 worker-12 kernel: [74132.838607] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.52.46.89 DST=10.0.483.483 LEN=81 TOS=0x00 PREC=0x00 TTL=81 ID=74132 DF PROTO=TCP SPT=18373 DPT=18373 WINDOW=74132 RES=0x00 SYN URGP=0 2026-10-09T13:29:46.203432-07:00 web-02 nginx[1207]: 192.185.235.167 - - "GET /metrics HTTP/1.1" 404 1371 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:29:46.281603-07:00 web-01 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:29:46.334155-07:00 api-08 sshd[12191]: Failed password for invalid user backup from 45.249.230.80 port 53160 ssh2 2026-10-09T13:29:46.435176-07:00 bastion cron[34532]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:29:46.779252-07:00 db-replica haproxy[925]: 10.50.43.126:22573 [53594] http-in app/bastion 5715/0/489/489/5715 204 53668 - - ---- 666/666/68/68/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:29:46.995216-07:00 db-replica systemd[1]: Started Session 81918 of User root. 2026-10-09T13:29:47.202113-07:00 db-replica app[30909]: INFO order 32162 confirmed for backup in 6614 ms (region eu-west-1, queue webhooks) 2026-10-09T13:29:47.268032-07:00 db-primary app[30591]: INFO worker 33 finished job 95047c133bde21be in 767 ms 2026-10-09T13:29:47.385169-07:00 edge-fr-1 kernel: [45774.695750] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.68.20.104 DST=10.0.749.749 LEN=90 TOS=0x00 PREC=0x00 TTL=90 ID=45774 DF PROTO=TCP SPT=65308 DPT=65308 WINDOW=45774 RES=0x00 SYN URGP=0 2026-10-09T13:29:47.616739-07:00 cache-3 app[30043]: INFO health check ok: db 265 ms, cache 265 ms, queue depth 29 2026-10-09T13:29:47.822462-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577787.437:21960): pid=21960 uid=0 auid=9195 ses=543 msg='op=login id=9195 exe="/usr/sbin/sshd" hostname=? addr=192.33.247.158 terminal=/dev/pts/0 res=success' 2026-10-09T13:29:47.858834-07:00 api-08 sshd[46467]: Connection closed by 45.157.60.193 port 32704 [preauth] 2026-10-09T13:29:47.860752-07:00 bastion systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:29:47.957525-07:00 edge-fr-1 postgres[11831]: LOG: duration: 1451.953 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:48.018782-07:00 db-replica kernel: [39244.238230] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.199.214.3 DST=10.0.256.256 LEN=87 TOS=0x00 PREC=0x00 TTL=87 ID=39244 DF PROTO=TCP SPT=39456 DPT=39456 WINDOW=39244 RES=0x00 SYN URGP=0 2026-10-09T13:29:48.074884-07:00 web-03 nginx[1203]: 203.40.168.50 - - "GET /api/v2/users HTTP/1.1" 204 53244 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:48.084131-07:00 bastion nginx[1200]: 91.195.107.91 - - "GET /favicon.ico HTTP/1.1" 204 49192 "-" "curl/8.4.0" 2026-10-09T13:29:48.195214-07:00 db-primary postgres[24257]: LOG: duration: 7260.409 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:48.441982-07:00 cache-3 cron[58720]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:29:48.548281-07:00 edge-fr-1 app[30238]: INFO worker 16 finished job dc874fd125b1fc53 in 3849 ms 2026-10-09T13:29:48.719979-07:00 api-07 haproxy[936]: 10.245.166.61:4963 [97492] http-in app/web-02 9047/0/554/554/9047 301 7372 - - ---- 316/316/46/46/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:29:48.720913-07:00 db-replica postgres[29263]: LOG: duration: 4518.432 ms statement: SELECT * FROM orders WHERE customer_id = 74756 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:49.134181-07:00 edge-fr-1 sshd[27751]: Connection closed by 91.108.94.176 port 43416 [preauth] 2026-10-09T13:29:49.252798-07:00 web-03 systemd[1]: session-83178.scope: Deactivated successfully. 2026-10-09T13:29:49.359831-07:00 api-07 sshd[4791]: Invalid user akira from 172.222.94.58 port 16824 2026-10-09T13:29:49.630256-07:00 web-01 nginx[1210]: 192.75.2.71 - root "POST /metrics HTTP/1.1" 500 970 "-" "Go-http-client/1.1" 2026-10-09T13:29:49.630655-07:00 web-03 app[30891]: INFO worker 18 picked job c3f595062b646584 from queue invoices 2026-10-09T13:29:49.738736-07:00 web-01 systemd[1]: Started Session 40308 of User ci. 2026-10-09T13:29:49.784023-07:00 web-01 nginx[1201]: 45.170.217.139 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 37078 "-" "python-requests/2.32.3" 2026-10-09T13:29:49.789020-07:00 db-primary nginx[1210]: 91.228.121.113 - - "GET /favicon.ico HTTP/1.1" 404 39802 "-" "python-requests/2.32.3" 2026-10-09T13:29:49.862384-07:00 edge-fr-1 nginx[1210]: 172.240.195.213 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 76549 "-" "Go-http-client/1.1" 2026-10-09T13:29:50.009801-07:00 web-01 app[30609]: INFO order 46175 confirmed for müller in 9998 ms (region eu-west-1, queue emails) 2026-10-09T13:29:50.030985-07:00 cache-3 nginx[1208]: 10.103.20.210 - - "GET /static/main.css HTTP/1.1" 200 17847 "-" "Go-http-client/1.1" 2026-10-09T13:29:50.126525-07:00 cache-3 haproxy[945]: 192.7.39.151:4871 [62825] http-in app/web-01 7956/0/340/340/7956 200 81493 - - ---- 944/944/80/80/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:29:50.323863-07:00 edge-fr-1 cron[17010]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:29:50.494885-07:00 web-03 app[30096]: INFO request_id=a512c2df5a3260d5 method=GET path=/.env status=404 duration=3354ms 2026-10-09T13:29:50.538688-07:00 bastion app[30075]: INFO request_id=131688790168cce1 method=GET path=/api/v2/users status=404 duration=8122ms 2026-10-09T13:29:50.651187-07:00 api-08 app[30281]: INFO worker 58 picked job 806e65c21a6bbcbd from queue orders 2026-10-09T13:29:50.767854-07:00 web-02 haproxy[928]: 192.190.74.126:7723 [82664] http-in app/api-07 115/0/416/416/115 404 49861 - - ---- 431/431/66/66/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:29:51.203516-07:00 web-02 haproxy[919]: 192.207.235.104:23418 [65336] http-in app/web-03 4969/0/842/842/4969 502 46115 - - ---- 852/852/53/53/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:29:51.243103-07:00 web-03 kernel: [71696.179704] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.6.50.219 DST=10.0.885.885 LEN=48 TOS=0x00 PREC=0x00 TTL=48 ID=71696 DF PROTO=TCP SPT=51322 DPT=51322 WINDOW=71696 RES=0x00 SYN URGP=0 2026-10-09T13:29:51.295449-07:00 worker-12 kernel: [77838.035482] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.188.164.129 DST=10.0.216.216 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=77838 DF PROTO=TCP SPT=53938 DPT=53938 WINDOW=77838 RES=0x00 SYN URGP=0 2026-10-09T13:29:51.851074-07:00 bastion systemd[1]: session-94436.scope: Deactivated successfully. 2026-10-09T13:29:51.881570-07:00 bastion sshd[19194]: Invalid user ci from 203.242.78.241 port 60015 2026-10-09T13:29:51.913817-07:00 api-07 nginx[1208]: 203.66.16.95 - - "GET /metrics HTTP/1.1" 200 65467 "-" "curl/8.4.0" 2026-10-09T13:29:52.023667-07:00 web-02 sshd[10042]: Invalid user zoë from 45.91.86.215 port 58245 2026-10-09T13:29:52.026301-07:00 edge-fr-1 sshd[8354]: Failed password for invalid user akira from 45.206.81.203 port 45571 ssh2 2026-10-09T13:29:52.123419-07:00 bastion nginx[1200]: 172.167.219.245 - - "GET /api/v2/users HTTP/1.1" 404 43032 "-" "python-requests/2.32.3" 2026-10-09T13:29:52.182023-07:00 api-08 app[30518]: INFO worker 42 picked job f74197da10a34436 from queue invoices 2026-10-09T13:29:52.407228-07:00 web-01 app[30377]: INFO request_id=de90d8cb3774936b method=GET path=/api/v2/orders status=502 duration=5333ms 2026-10-09T13:29:52.722525-07:00 db-replica app[30796]: WARN retrying upstream 192.0.220.62:63852 after timeout (6882 ms), attempt 2 of 3 2026-10-09T13:29:52.816959-07:00 api-08 app[30047]: INFO worker 30 finished job 14e1cd9003aa346a in 9833 ms 2026-10-09T13:29:52.845352-07:00 db-replica app[30784]: INFO health check ok: db 151 ms, cache 151 ms, queue depth 69 2026-10-09T13:29:52.890757-07:00 db-primary app[30244]: INFO request_id=21cd72eb38040051 method=GET path=/static/main.css status=500 duration=278ms 2026-10-09T13:29:52.945839-07:00 web-03 nginx[1200]: 91.17.33.186 - - "GET /api/v2/users HTTP/1.1" 500 12046 "-" "Go-http-client/1.1" 2026-10-09T13:29:53.090792-07:00 bastion app[30373]: INFO request_id=ed316700a57e107d method=GET path=/health status=404 duration=5445ms 2026-10-09T13:29:53.224822-07:00 api-08 nginx[1208]: 203.159.186.163 - - "GET /static/main.css HTTP/1.1" 401 10653 "-" "kube-probe/1.31" 2026-10-09T13:29:53.225898-07:00 worker-12 haproxy[905]: 91.203.156.134:18714 [80876] http-in app/worker-12 6846/0/309/309/6846 302 50719 - - ---- 222/222/64/64/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:29:53.252935-07:00 web-03 app[30238]: INFO request_id=9b8aba08c32477e5 method=GET path=/metrics status=500 duration=5288ms 2026-10-09T13:29:53.724862-07:00 web-02 app[30334]: INFO worker 32 picked job a78895f8ffb26d55 from queue emails 2026-10-09T13:29:53.747086-07:00 cache-3 app[30354]: INFO health check ok: db 853 ms, cache 853 ms, queue depth 40 2026-10-09T13:29:53.752246-07:00 cache-3 haproxy[908]: 91.110.138.43:50754 [84027] http-in app/cache-3 2706/0/811/811/2706 200 3377 - - ---- 759/759/63/63/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:53.775931-07:00 web-02 app[30553]: INFO worker 67 picked job 1eda9c5a22d865ca from queue invoices 2026-10-09T13:29:53.806555-07:00 db-primary app[30110]: INFO worker 55 picked job 80bafa208848c46d from queue orders 2026-10-09T13:29:53.937488-07:00 worker-12 app[30308]: INFO order 39531 confirmed for ci in 485 ms (region us-east-1, queue invoices) 2026-10-09T13:29:54.035627-07:00 web-02 app[30315]: INFO worker 88 finished job 6bc6c5975adbc75d in 4711 ms 2026-10-09T13:29:54.038132-07:00 edge-fr-1 haproxy[907]: 91.15.205.147:33218 [95993] http-in app/api-07 4043/0/849/849/4043 200 50260 - - ---- 495/495/17/17/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:29:54.111356-07:00 web-02 nginx[1203]: 91.6.191.250 - deploy "POST /favicon.ico HTTP/1.1" 502 16732 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:54.152645-07:00 web-02 nginx[1208]: 203.194.130.157 - - "GET /wp-login.php HTTP/1.1" 301 18208 "-" "python-requests/2.32.3" 2026-10-09T13:29:54.258033-07:00 db-primary haproxy[939]: 45.50.108.146:41968 [86139] http-in app/cache-3 3527/0/510/510/3527 401 21815 - - ---- 299/299/55/55/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:29:54.311136-07:00 db-primary app[30195]: INFO request_id=113e5d7c5c1c1b32 method=GET path=/static/app.js status=302 duration=9469ms 2026-10-09T13:29:54.464057-07:00 db-replica kernel: [23095.332018] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.32.36.14 DST=10.0.205.205 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=23095 DF PROTO=TCP SPT=12841 DPT=12841 WINDOW=23095 RES=0x00 SYN URGP=0 2026-10-09T13:29:54.472387-07:00 web-02 postgres[11853]: LOG: duration: 2498.610 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:54.682046-07:00 db-primary kernel: [58868.097931] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.143.112.80 DST=10.0.366.366 LEN=70 TOS=0x00 PREC=0x00 TTL=70 ID=58868 DF PROTO=TCP SPT=64214 DPT=64214 WINDOW=58868 RES=0x00 SYN URGP=0 2026-10-09T13:29:54.692595-07:00 web-01 nginx[1200]: 91.25.69.144 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 60745 "-" "python-requests/2.32.3" 2026-10-09T13:29:54.859870-07:00 web-01 app[30588]: INFO order 45958 confirmed for priya in 6257 ms (region us-east-1, queue emails) 2026-10-09T13:29:55.160487-07:00 db-primary sshd[58930]: Accepted publickey for backup from 45.29.177.52 port 28250 ssh2: ED25519 SHA256:ad1e5e6e18461159 2026-10-09T13:29:55.230641-07:00 api-07 sshd[38884]: Accepted publickey for akira from 192.188.224.46 port 44027 ssh2: ED25519 SHA256:1f8e03d55f043cd7 2026-10-09T13:29:55.278779-07:00 api-08 app[30494]: INFO request_id=c4828ecc241b5271 method=GET path=/api/v2/orders/8841 status=500 duration=8372ms 2026-10-09T13:29:55.395960-07:00 bastion app[30109]: INFO worker 19 finished job e0b32e3ce5a86881 in 3207 ms 2026-10-09T13:29:55.590973-07:00 bastion app[30224]: INFO request_id=3dbe7afabac8da5d method=GET path=/health status=404 duration=3466ms 2026-10-09T13:29:55.703487-07:00 api-08 app[30851]: DEBUG cache hit ratio 61% over the last minute (68600 lookups) 2026-10-09T13:29:55.901602-07:00 cache-3 sshd[41312]: Connection closed by 192.85.160.237 port 26582 [preauth] 2026-10-09T13:29:56.086380-07:00 db-replica systemd[1]: session-96336.scope: Deactivated successfully. 2026-10-09T13:29:56.094749-07:00 worker-12 sshd[28411]: Accepted publickey for françois from 192.111.42.205 port 3198 ssh2: ED25519 SHA256:be7e6abdb0f34c9d 2026-10-09T13:29:56.179689-07:00 api-08 postgres[16010]: LOG: duration: 2053.1 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:29:56.297725-07:00 db-replica app[30904]: INFO worker 61 finished job 58a79d6d2bdb4322 in 2339 ms 2026-10-09T13:29:56.370973-07:00 web-01 sshd[62215]: Received disconnect from 203.64.55.192 port 13812:11: Bye Bye [preauth] 2026-10-09T13:29:56.384056-07:00 api-08 sshd[44092]: Accepted publickey for akira from 45.22.10.87 port 39285 ssh2: ED25519 SHA256:36dd0c7761a0749a 2026-10-09T13:29:56.479261-07:00 worker-12 postgres[10464]: LOG: duration: 5313.221 ms statement: SELECT * FROM orders WHERE customer_id = 71459 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:29:56.645705-07:00 web-03 nginx[1204]: 203.204.22.12 - - "GET /health HTTP/1.1" 200 32826 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:56.789494-07:00 cache-3 nginx[1202]: 203.160.90.98 - - "GET /metrics HTTP/1.1" 200 60517 "-" "kube-probe/1.31" 2026-10-09T13:29:56.879790-07:00 cache-3 sshd[52169]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:29:57.093301-07:00 cache-3 app[30321]: INFO worker 82 finished job 5c56354f99c1a3ec in 5739 ms 2026-10-09T13:29:57.318628-07:00 edge-fr-1 app[30373]: INFO request_id=b747eaa869b0ccdc method=GET path=/admin status=302 duration=9451ms 2026-10-09T13:29:57.412249-07:00 worker-12 app[30343]: INFO request_id=b13f79a8bf017bba method=GET path=/static/main.css status=200 duration=4429ms 2026-10-09T13:29:57.416117-07:00 db-primary sshd[21918]: Accepted publickey for zoë from 203.159.128.210 port 32059 ssh2: ED25519 SHA256:315795f89e6e19fe 2026-10-09T13:29:57.639887-07:00 web-02 app[30175]: WARN slow query (8673 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '67 minutes' 2026-10-09T13:29:57.743450-07:00 web-02 app[30985]: INFO request_id=958059a5b2a9ca0a method=GET path=/favicon.ico status=502 duration=6008ms 2026-10-09T13:29:57.802247-07:00 api-07 app[30785]: ERROR cache miss storm: 2175 misses in 7070 ms, key prefix session:zoë 2026-10-09T13:29:57.839306-07:00 edge-fr-1 app[30502]: INFO request_id=11ea0461ffebe075 method=GET path=/api/v2/orders status=200 duration=1868ms 2026-10-09T13:29:57.866238-07:00 bastion app[30590]: INFO request_id=20f78874288e3276 method=GET path=/admin status=200 duration=2676ms 2026-10-09T13:29:57.886258-07:00 web-02 sshd[39609]: Connection closed by 203.190.245.223 port 56255 [preauth] 2026-10-09T13:29:57.948318-07:00 api-07 app[30191]: INFO request_id=e0d77b3f80ed42f4 method=GET path=/favicon.ico status=404 duration=9212ms 2026-10-09T13:29:57.983934-07:00 bastion sshd[554]: Connection closed by 91.125.95.73 port 9166 [preauth] 2026-10-09T13:29:58.532268-07:00 web-01 app[30041]: INFO order 66511 confirmed for müller in 6862 ms (region eu-west-1, queue emails) 2026-10-09T13:29:58.550734-07:00 edge-fr-1 app[30166]: INFO worker 90 finished job 1fedecf7c7add751 in 475 ms 2026-10-09T13:29:58.584051-07:00 web-03 nginx[1205]: 10.241.199.13 - akira "POST /admin HTTP/1.1" 401 65088 "-" "curl/8.4.0" 2026-10-09T13:29:58.692591-07:00 db-replica nginx[1200]: 10.236.190.79 - - "GET /static/app.js HTTP/1.1" 200 65634 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:29:58.786136-07:00 worker-12 sshd[33431]: Accepted publickey for root from 91.249.222.139 port 40271 ssh2: ED25519 SHA256:a3f8107a8ecd8642 2026-10-09T13:29:58.802735-07:00 web-03 kernel: [77716.507916] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.235.99.145 DST=10.0.517.517 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=77716 DF PROTO=TCP SPT=28094 DPT=28094 WINDOW=77716 RES=0x00 SYN URGP=0 2026-10-09T13:29:58.946209-07:00 api-07 app[30155]: INFO request_id=9a0a068a173f720c method=GET path=/metrics status=200 duration=1487ms 2026-10-09T13:29:59.087381-07:00 api-08 systemd[1]: session-84618.scope: Deactivated successfully. 2026-10-09T13:29:59.128835-07:00 edge-fr-1 app[30744]: WARN retrying upstream 203.164.191.209:54524 after timeout (2262 ms), attempt 3 of 3 2026-10-09T13:29:59.275303-07:00 cache-3 app[30289]: INFO order 11179 confirmed for backup in 9951 ms (region eu-west-1, queue orders) 2026-10-09T13:29:59.298834-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791577799.627:39184): pid=39184 uid=0 auid=2234 ses=259 msg='op=login id=2234 exe="/usr/sbin/sshd" hostname=? addr=45.192.243.82 terminal=/dev/pts/0 res=success' 2026-10-09T13:29:59.340830-07:00 api-07 haproxy[931]: 91.24.41.20:22109 [28102] http-in app/api-07 6768/0/758/758/6768 404 70114 - - ---- 747/747/18/18/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:29:59.754862-07:00 api-08 sshd[58274]: Received disconnect from 10.64.123.245 port 1650:11: Bye Bye [preauth] 2026-10-09T13:29:59.805891-07:00 api-08 systemd[1]: session-79712.scope: Deactivated successfully. 2026-10-09T13:29:59.954238-07:00 cache-3 app[30256]: INFO worker 85 picked job f296fa489e55f29a from queue orders 2026-10-09T13:30:00.041493-07:00 web-02 app[30055]: INFO order 69069 confirmed for zoë in 614 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:00.042278-07:00 api-08 app[30751]: INFO worker 93 finished job fb5ddd292033a95f in 965 ms 2026-10-09T13:30:00.047486-07:00 db-primary app[30678]: INFO health check ok: db 909 ms, cache 909 ms, queue depth 86 2026-10-09T13:30:00.139736-07:00 web-03 sshd[2807]: Connection closed by 203.111.173.167 port 34331 [preauth] 2026-10-09T13:30:00.152726-07:00 api-08 nginx[1205]: 45.117.167.133 - sørensen "POST /metrics HTTP/1.1" 500 26130 "-" "kube-probe/1.31" 2026-10-09T13:30:00.164772-07:00 web-03 nginx[1207]: 172.53.218.82 - root "POST /api/v2/orders/8841 HTTP/1.1" 404 31613 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:00.324391-07:00 web-01 sshd[27149]: Received disconnect from 91.103.46.48 port 22134:11: Bye Bye [preauth] 2026-10-09T13:30:00.332285-07:00 bastion app[30976]: INFO worker 53 finished job a89158988e60781a in 7746 ms 2026-10-09T13:30:00.521618-07:00 web-03 app[30264]: INFO request_id=106f687ee742eaf9 method=GET path=/static/main.css status=200 duration=399ms 2026-10-09T13:30:00.669837-07:00 web-02 nginx[1203]: 172.90.159.195 - - "GET /api/v2/orders HTTP/1.1" 200 20415 "-" "curl/8.4.0" 2026-10-09T13:30:00.744917-07:00 api-07 app[30264]: INFO worker 82 picked job 1c6c2ab07c4b745f from queue emails 2026-10-09T13:30:00.766742-07:00 cache-3 nginx[1209]: 192.161.10.24 - - "GET /admin HTTP/1.1" 302 45537 "-" "python-requests/2.32.3" 2026-10-09T13:30:01.003620-07:00 web-01 app[30421]: INFO worker 24 finished job 666951169fd9f02b in 7605 ms 2026-10-09T13:30:01.207171-07:00 db-replica sshd[33711]: Failed password for invalid user akira from 45.19.49.39 port 24105 ssh2 2026-10-09T13:30:01.316837-07:00 db-primary sshd[35012]: Connection closed by 172.165.210.201 port 39345 [preauth] 2026-10-09T13:30:01.320129-07:00 worker-12 app[30570]: INFO order 49895 confirmed for françois in 6584 ms (region us-east-1, queue webhooks) 2026-10-09T13:30:01.699947-07:00 edge-fr-1 nginx[1210]: 91.3.239.59 - - "GET /api/v2/orders HTTP/1.1" 200 18996 "-" "curl/8.4.0" 2026-10-09T13:30:01.761844-07:00 edge-fr-1 sshd[3447]: Invalid user müller from 192.12.114.65 port 17892 2026-10-09T13:30:01.846769-07:00 web-02 haproxy[909]: 10.194.157.26:35144 [78309] http-in app/bastion 1934/0/510/510/1934 200 48606 - - ---- 692/692/74/74/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:01.853319-07:00 api-08 nginx[1206]: 91.248.237.165 - - "GET /.env HTTP/1.1" 200 54377 "-" "kube-probe/1.31" 2026-10-09T13:30:02.186928-07:00 edge-fr-1 systemd[1]: Started Session 70249 of User ci. 2026-10-09T13:30:02.348706-07:00 db-replica sshd[10041]: Connection closed by 91.212.60.25 port 37538 [preauth] 2026-10-09T13:30:02.604211-07:00 bastion nginx[1204]: 203.79.177.41 - - "GET /favicon.ico HTTP/1.1" 502 71653 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:02.641545-07:00 web-03 app[30103]: INFO order 88946 confirmed for françois in 7440 ms (region us-east-1, queue invoices) 2026-10-09T13:30:02.689325-07:00 api-08 sshd[57714]: Failed password for invalid user priya from 45.149.36.216 port 25486 ssh2 2026-10-09T13:30:02.774115-07:00 cache-3 postgres[27232]: LOG: duration: 5228.783 ms statement: SELECT * FROM orders WHERE customer_id = 57862 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:02.859695-07:00 edge-fr-1 sshd[15371]: Failed password for invalid user françois from 45.140.203.167 port 53425 ssh2 2026-10-09T13:30:02.884894-07:00 web-02 nginx[1203]: 45.166.212.47 - akira "POST /wp-login.php HTTP/1.1" 200 25177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:03.020523-07:00 db-primary systemd[1]: Started Session 26219 of User sørensen. 2026-10-09T13:30:03.199727-07:00 web-02 postgres[22931]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 56720 remain, 2883 scanned (16% of total) 2026-10-09T13:30:03.300962-07:00 edge-fr-1 kernel: [47580.848096] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.154.147.197 DST=10.0.280.280 LEN=32 TOS=0x00 PREC=0x00 TTL=32 ID=47580 DF PROTO=TCP SPT=14298 DPT=14298 WINDOW=47580 RES=0x00 SYN URGP=0 2026-10-09T13:30:03.322677-07:00 api-08 app[30688]: INFO worker 17 picked job 80d9bdf51c2129d1 from queue webhooks 2026-10-09T13:30:03.326273-07:00 cache-3 app[30656]: INFO request_id=e1689dcf812d2631 method=GET path=/wp-login.php status=404 duration=2567ms 2026-10-09T13:30:03.850415-07:00 web-01 nginx[1210]: 192.197.85.5 - zoë "POST /.env HTTP/1.1" 404 44853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:03.985806-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577803.904:55879): pid=55879 uid=0 auid=7594 ses=799 msg='op=login id=7594 exe="/usr/sbin/sshd" hostname=? addr=203.173.32.251 terminal=/dev/pts/0 res=success' 2026-10-09T13:30:04.310074-07:00 web-02 cron[31730]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:30:04.345816-07:00 worker-12 haproxy[934]: 172.2.73.133:28470 [79539] http-in app/cache-3 315/0/92/92/315 401 40769 - - ---- 617/617/88/88/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:04.446552-07:00 worker-12 nginx[1209]: 45.47.69.34 - sørensen "POST /api/v2/orders HTTP/1.1" 200 52796 "-" "python-requests/2.32.3" 2026-10-09T13:30:04.517729-07:00 cache-3 nginx[1205]: 203.150.223.80 - - "GET /health HTTP/1.1" 500 13697 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:04.622721-07:00 web-01 app[30087]: INFO health check ok: db 148 ms, cache 148 ms, queue depth 28 2026-10-09T13:30:04.667121-07:00 worker-12 app[30207]: INFO request_id=3aa72de89ae94155 method=GET path=/metrics status=200 duration=8989ms 2026-10-09T13:30:05.211201-07:00 web-02 app[30879]: INFO worker 68 finished job 22e1725ac6521791 in 4031 ms 2026-10-09T13:30:05.266601-07:00 edge-fr-1 app[30462]: INFO request_id=bfd8463e5ea55f3b method=GET path=/wp-login.php status=200 duration=5238ms 2026-10-09T13:30:05.318914-07:00 cache-3 app[30284]: INFO request_id=fb576ab682b8a0ae method=GET path=/.env status=200 duration=8224ms 2026-10-09T13:30:05.363123-07:00 cache-3 app[30960]: INFO health check ok: db 416 ms, cache 416 ms, queue depth 82 2026-10-09T13:30:05.461607-07:00 db-primary app[30971]: INFO request_id=2e34832ff8db98c9 method=GET path=/.env status=302 duration=4204ms 2026-10-09T13:30:05.470962-07:00 web-02 nginx[1206]: 10.62.35.129 - - "GET /login HTTP/1.1" 302 59598 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:05.612545-07:00 bastion kernel: [45464.844180] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.159.230.116 DST=10.0.664.664 LEN=33 TOS=0x00 PREC=0x00 TTL=33 ID=45464 DF PROTO=TCP SPT=1158 DPT=1158 WINDOW=45464 RES=0x00 SYN URGP=0 2026-10-09T13:30:05.628114-07:00 cache-3 app[30889]: INFO worker 40 finished job b86ee188c5bd4f90 in 6154 ms 2026-10-09T13:30:05.753656-07:00 db-replica postgres[30929]: LOG: duration: 545.851 ms statement: SELECT * FROM orders WHERE customer_id = 50267 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:05.904930-07:00 web-01 app[30529]: WARN slow query (8004 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '75 minutes' 2026-10-09T13:30:05.932952-07:00 db-replica sshd[59165]: Failed password for invalid user backup from 203.201.5.211 port 10791 ssh2 2026-10-09T13:30:06.041155-07:00 web-03 kubelet[800]: I1009 13:30:06.804272 3140 kubelet.go:3140] "Pod is terminating, skipping pod status update" pod="default/api-18752d836837befb" 2026-10-09T13:30:06.293147-07:00 api-07 app[30928]: INFO health check ok: db 104 ms, cache 104 ms, queue depth 58 2026-10-09T13:30:06.303522-07:00 api-07 nginx[1203]: 45.14.198.193 - - "GET /wp-login.php HTTP/1.1" 404 64798 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:06.328684-07:00 worker-12 app[30154]: INFO request_id=ebe0df3decac5757 method=GET path=/api/v2/users status=500 duration=7053ms 2026-10-09T13:30:06.427319-07:00 web-01 app[30779]: INFO request_id=694228a2d6142601 method=GET path=/api/v2/orders status=302 duration=2437ms 2026-10-09T13:30:06.499562-07:00 bastion postgres[14903]: LOG: duration: 4103.247 ms statement: SELECT * FROM orders WHERE customer_id = 43835 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:06.942898-07:00 bastion app[30739]: INFO request_id=c2f8012124eea61a method=GET path=/api/v2/orders status=200 duration=2239ms 2026-10-09T13:30:07.013383-07:00 api-08 app[30504]: INFO request_id=f7ba54395ce5e679 method=GET path=/admin status=204 duration=7243ms 2026-10-09T13:30:07.143088-07:00 bastion sshd[25502]: Invalid user sørensen from 10.101.2.251 port 8351 2026-10-09T13:30:07.248782-07:00 web-01 app[30014]: INFO health check ok: db 158 ms, cache 158 ms, queue depth 92 2026-10-09T13:30:07.331876-07:00 bastion nginx[1207]: 172.113.233.78 - müller "POST /login HTTP/1.1" 500 50993 "-" "Go-http-client/1.1" 2026-10-09T13:30:07.353190-07:00 edge-fr-1 app[30947]: INFO request_id=a1180547f7c02242 method=GET path=/api/v2/orders status=500 duration=2644ms 2026-10-09T13:30:07.354045-07:00 worker-12 app[30093]: INFO request_id=34be01bd6c3731a1 method=GET path=/api/v2/orders/8841 status=301 duration=3242ms 2026-10-09T13:30:07.366652-07:00 worker-12 postgres[19590]: LOG: duration: 6172.82 ms statement: SELECT * FROM orders WHERE customer_id = 42905 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:07.419342-07:00 cache-3 app[30551]: INFO worker 88 picked job c900d1b49538b89a from queue invoices 2026-10-09T13:30:07.517926-07:00 db-primary sshd[8241]: Received disconnect from 91.192.245.231 port 64054:11: Bye Bye [preauth] 2026-10-09T13:30:07.676402-07:00 web-03 app[30126]: INFO order 24293 confirmed for sørensen in 7272 ms (region us-east-1, queue webhooks) 2026-10-09T13:30:07.731375-07:00 web-01 sshd[606]: Failed password for invalid user akira from 10.252.136.173 port 44889 ssh2 2026-10-09T13:30:07.866003-07:00 web-01 app[30932]: INFO health check ok: db 118 ms, cache 118 ms, queue depth 79 2026-10-09T13:30:08.021851-07:00 web-03 sshd[42000]: Invalid user zoë from 91.67.3.209 port 23562 2026-10-09T13:30:08.115605-07:00 api-08 app[30113]: INFO worker 56 picked job c1f9cae7e680fbbf from queue emails 2026-10-09T13:30:08.130335-07:00 api-08 haproxy[926]: 192.112.202.164:64225 [68492] http-in app/worker-12 5073/0/134/134/5073 301 5246 - - ---- 933/933/69/69/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:08.136972-07:00 web-01 app[30144]: WARN slow query (6300 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '29 minutes' 2026-10-09T13:30:08.318472-07:00 db-primary postgres[3005]: LOG: duration: 2912.627 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:08.402616-07:00 db-primary app[30831]: INFO request_id=9bd4f1db6c8b96f4 method=GET path=/admin status=301 duration=9656ms 2026-10-09T13:30:08.411536-07:00 worker-12 app[30055]: INFO request_id=bb986ab2408f40e6 method=GET path=/.env status=200 duration=6503ms 2026-10-09T13:30:08.449342-07:00 web-03 app[30600]: INFO request_id=90385805f9fda60d method=GET path=/static/main.css status=200 duration=7865ms 2026-10-09T13:30:08.594523-07:00 web-02 sshd[64813]: Received disconnect from 45.64.190.131 port 49462:11: Bye Bye [preauth] 2026-10-09T13:30:08.602256-07:00 web-02 app[30609]: INFO request_id=670f8ae9675df6f0 method=GET path=/wp-login.php status=404 duration=7036ms 2026-10-09T13:30:08.643637-07:00 api-08 nginx[1201]: 203.19.172.183 - - "GET /favicon.ico HTTP/1.1" 404 34712 "-" "python-requests/2.32.3" 2026-10-09T13:30:08.746106-07:00 api-07 app[30223]: INFO request_id=02ef15b386e4e710 method=GET path=/static/main.css status=302 duration=9315ms 2026-10-09T13:30:08.962004-07:00 cache-3 nginx[1202]: 172.134.138.134 - - "GET /api/v2/orders HTTP/1.1" 502 31444 "-" "Go-http-client/1.1" 2026-10-09T13:30:09.112633-07:00 db-replica systemd[1]: Started Session 76557 of User zoë. 2026-10-09T13:30:09.113918-07:00 worker-12 postgres[9521]: LOG: duration: 3796.712 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:09.515939-07:00 web-03 nginx[1210]: 91.6.230.25 - akira "POST /favicon.ico HTTP/1.1" 200 36290 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:09.526495-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577809.134:19952): pid=19952 uid=0 auid=1574 ses=352 msg='op=login id=1574 exe="/usr/sbin/sshd" hostname=? addr=203.70.50.104 terminal=/dev/pts/0 res=success' 2026-10-09T13:30:09.534895-07:00 edge-fr-1 nginx[1200]: 45.18.89.217 - - "GET /favicon.ico HTTP/1.1" 401 77963 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:09.541039-07:00 db-primary haproxy[913]: 45.118.136.136:32015 [27152] http-in app/db-replica 9518/0/288/288/9518 200 49536 - - ---- 332/332/59/59/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:09.557460-07:00 api-08 app[30595]: INFO request_id=0bd5a9af73ecc9a7 method=GET path=/health status=500 duration=2846ms 2026-10-09T13:30:09.732477-07:00 db-primary nginx[1201]: 192.44.125.224 - - "GET /admin HTTP/1.1" 200 46482 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:09.994753-07:00 db-replica haproxy[947]: 203.140.209.167:19517 [19940] http-in app/api-07 1337/0/95/95/1337 200 80302 - - ---- 626/626/78/78/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:30:10.030033-07:00 db-replica app[30638]: INFO worker 42 finished job 24b2b902d39572d5 in 3877 ms 2026-10-09T13:30:10.387097-07:00 web-01 haproxy[930]: 203.237.102.97:47067 [14877] http-in app/db-primary 4146/0/13/13/4146 204 42450 - - ---- 642/642/85/85/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:30:10.432494-07:00 bastion app[30123]: ERROR cache miss storm: 5142 misses in 5224 ms, key prefix session:backup 2026-10-09T13:30:10.564800-07:00 web-02 nginx[1203]: 10.48.111.180 - backup "POST /static/main.css HTTP/1.1" 204 18317 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:10.922965-07:00 db-primary app[30265]: INFO request_id=5196d0a131b41f2d method=GET path=/api/v2/search?q=invoice status=302 duration=9256ms 2026-10-09T13:30:10.926365-07:00 api-08 app[30400]: WARN slow query (923 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '72 minutes' 2026-10-09T13:30:11.331785-07:00 api-08 postgres[20260]: LOG: duration: 7727.400 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:11.421452-07:00 edge-fr-1 nginx[1204]: 45.253.218.191 - - "GET /api/v2/users HTTP/1.1" 500 49364 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:11.532672-07:00 web-03 nginx[1203]: 45.53.86.46 - - "GET /admin HTTP/1.1" 204 36978 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:11.602545-07:00 cache-3 haproxy[950]: 192.4.1.219:53076 [62400] http-in app/cache-3 9570/0/264/264/9570 200 65106 - - ---- 424/424/61/61/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:30:12.035631-07:00 api-07 postgres[10922]: LOG: duration: 3199.501 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:12.042283-07:00 api-08 app[30828]: INFO worker 82 finished job c0afa2517c3a7390 in 9371 ms 2026-10-09T13:30:12.191806-07:00 db-replica app[30150]: INFO health check ok: db 90 ms, cache 90 ms, queue depth 57 2026-10-09T13:30:12.243904-07:00 web-02 nginx[1209]: 172.143.136.136 - - "GET /favicon.ico HTTP/1.1" 200 9392 "-" "kube-probe/1.31" 2026-10-09T13:30:12.794799-07:00 api-07 app[30668]: INFO health check ok: db 425 ms, cache 425 ms, queue depth 57 2026-10-09T13:30:12.918206-07:00 worker-12 app[30854]: DEBUG cache hit ratio 12% over the last minute (30934 lookups) 2026-10-09T13:30:13.019780-07:00 web-01 app[30005]: INFO request_id=21c335f0541a390f method=GET path=/api/v2/orders status=200 duration=798ms 2026-10-09T13:30:13.107058-07:00 cache-3 kubelet[800]: E1009 13:30:13.069804 3660 pod_workers.go:3660] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-8dff305a09f0d126" 2026-10-09T13:30:13.490213-07:00 db-primary kernel: [40192.568841] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.192.4.226 DST=10.0.799.799 LEN=51 TOS=0x00 PREC=0x00 TTL=51 ID=40192 DF PROTO=TCP SPT=4667 DPT=4667 WINDOW=40192 RES=0x00 SYN URGP=0 2026-10-09T13:30:13.666964-07:00 db-primary haproxy[914]: 91.2.82.98:15400 [15143] http-in app/api-08 3716/0/948/948/3716 301 84046 - - ---- 309/309/29/29/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:30:13.855430-07:00 cache-3 app[30311]: DEBUG cache hit ratio 11% over the last minute (63513 lookups) 2026-10-09T13:30:14.153171-07:00 web-02 sshd[34303]: Accepted publickey for root from 203.202.50.176 port 47714 ssh2: ED25519 SHA256:ae45097119c96d56 2026-10-09T13:30:14.354256-07:00 web-03 app[30500]: INFO order 20394 confirmed for akira in 6861 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:14.608753-07:00 api-08 dockerd[700]: time="2026-10-09T13:30:14.608753-07:00" level=info msg="Container 02ebd85e7c1fe14a exited with code 0" 2026-10-09T13:30:14.698275-07:00 cache-3 app[30127]: INFO order 75914 confirmed for müller in 2955 ms (region eu-west-1, queue orders) 2026-10-09T13:30:14.726484-07:00 edge-fr-1 app[30976]: INFO request_id=351093b725bdd94b method=GET path=/api/v2/search?q=invoice status=404 duration=2392ms 2026-10-09T13:30:15.052039-07:00 web-03 kernel: [27262.766449] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.111.237.135 DST=10.0.133.133 LEN=98 TOS=0x00 PREC=0x00 TTL=98 ID=27262 DF PROTO=TCP SPT=42520 DPT=42520 WINDOW=27262 RES=0x00 SYN URGP=0 2026-10-09T13:30:15.086403-07:00 edge-fr-1 nginx[1207]: 10.43.137.45 - - "GET /login HTTP/1.1" 200 49186 "-" "Go-http-client/1.1" 2026-10-09T13:30:15.227576-07:00 edge-fr-1 app[30239]: INFO request_id=ae4b4245962ed679 method=GET path=/admin status=204 duration=5046ms 2026-10-09T13:30:15.344473-07:00 api-07 nginx[1209]: 172.176.196.112 - - "GET /wp-login.php HTTP/1.1" 401 81426 "-" "Go-http-client/1.1" 2026-10-09T13:30:15.460029-07:00 db-primary app[30713]: INFO worker 22 finished job ea454e6d579223b7 in 6599 ms 2026-10-09T13:30:15.756045-07:00 api-08 sshd[34157]: Invalid user root from 45.83.146.169 port 46345 2026-10-09T13:30:15.931585-07:00 web-02 sshd[59582]: Accepted publickey for sørensen from 10.100.95.253 port 1506 ssh2: ED25519 SHA256:aa41e05ac8f9ebfb 2026-10-09T13:30:15.944679-07:00 api-07 app[30187]: INFO worker 73 picked job 2402fc5b9d60a9b2 from queue emails 2026-10-09T13:30:15.972390-07:00 bastion sshd[34179]: Received disconnect from 203.4.155.36 port 8670:11: Bye Bye [preauth] 2026-10-09T13:30:15.991247-07:00 edge-fr-1 app[30591]: INFO worker 88 finished job 92a724a9a6da882a in 5230 ms 2026-10-09T13:30:16.086130-07:00 web-01 sshd[6754]: Accepted publickey for root from 45.227.34.150 port 51584 ssh2: ED25519 SHA256:3c500a7f0bbb2862 2026-10-09T13:30:16.197144-07:00 worker-12 nginx[1209]: 172.230.59.140 - - "GET /health HTTP/1.1" 301 67765 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:16.200839-07:00 api-08 app[30294]: INFO request_id=abc34ecadfd147ab method=GET path=/api/v2/orders status=302 duration=3887ms 2026-10-09T13:30:16.265544-07:00 worker-12 app[30512]: INFO health check ok: db 541 ms, cache 541 ms, queue depth 79 2026-10-09T13:30:16.279480-07:00 db-primary systemd[1]: Started Session 56144 of User müller. 2026-10-09T13:30:16.509365-07:00 web-02 sshd[40421]: Failed password for invalid user sørensen from 91.211.211.92 port 63374 ssh2 2026-10-09T13:30:16.609464-07:00 web-01 nginx[1210]: 172.160.192.107 - sørensen "POST /favicon.ico HTTP/1.1" 404 5950 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:16.640296-07:00 api-07 nginx[1209]: 192.91.136.171 - priya "POST /static/app.js HTTP/1.1" 200 67998 "-" "kube-probe/1.31" 2026-10-09T13:30:16.711978-07:00 edge-fr-1 postgres[24972]: LOG: duration: 2887.918 ms statement: SELECT * FROM orders WHERE customer_id = 87033 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:16.765462-07:00 web-01 nginx[1210]: 91.134.216.191 - akira "POST /wp-login.php HTTP/1.1" 200 11007 "-" "curl/8.4.0" 2026-10-09T13:30:16.832055-07:00 api-08 sshd[10767]: Connection closed by 10.237.196.26 port 53196 [preauth] 2026-10-09T13:30:16.903402-07:00 bastion postgres[17080]: LOG: duration: 8308.361 ms statement: SELECT * FROM orders WHERE customer_id = 90586 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:17.110062-07:00 web-02 nginx[1204]: 203.0.153.79 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 81985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:17.396332-07:00 web-01 app[30937]: ERROR payment declined for order 65915: card_declined (code 94), customer notified 2026-10-09T13:30:17.404205-07:00 edge-fr-1 kernel: [63488.380047] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.189.145.226 DST=10.0.472.472 LEN=93 TOS=0x00 PREC=0x00 TTL=93 ID=63488 DF PROTO=TCP SPT=39006 DPT=39006 WINDOW=63488 RES=0x00 SYN URGP=0 2026-10-09T13:30:17.940016-07:00 db-primary sshd[15117]: Invalid user zoë from 10.94.73.249 port 37553 2026-10-09T13:30:17.940666-07:00 db-primary sshd[42041]: Received disconnect from 203.195.78.102 port 26878:11: Bye Bye [preauth] 2026-10-09T13:30:18.222057-07:00 db-replica cron[44828]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:30:18.350313-07:00 web-02 app[30405]: INFO request_id=5a7c1cb5ddda14b9 method=GET path=/favicon.ico status=200 duration=4609ms 2026-10-09T13:30:18.474122-07:00 web-03 app[30314]: INFO request_id=eaf8e368f77dca9a method=GET path=/static/app.js status=500 duration=1867ms 2026-10-09T13:30:18.570311-07:00 web-02 haproxy[917]: 172.40.32.12:58979 [69070] http-in app/worker-12 6703/0/661/661/6703 500 68241 - - ---- 480/480/15/15/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:30:18.623338-07:00 db-replica systemd[1]: Started Session 49247 of User root. 2026-10-09T13:30:18.667695-07:00 db-replica app[30239]: INFO worker 30 finished job 9644d570a74bea87 in 8115 ms 2026-10-09T13:30:18.693950-07:00 cache-3 sshd[30758]: Accepted publickey for zoë from 10.14.12.4 port 55607 ssh2: ED25519 SHA256:77d64c7058cb3e51 2026-10-09T13:30:18.953321-07:00 api-08 sshd[54396]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:30:18.956631-07:00 worker-12 app[30819]: INFO worker 33 picked job 893c937eca2de9f9 from queue invoices 2026-10-09T13:30:18.988879-07:00 api-08 nginx[1207]: 45.196.51.74 - - "GET /login HTTP/1.1" 200 55736 "-" "Go-http-client/1.1" 2026-10-09T13:30:19.100282-07:00 api-08 postgres[14333]: LOG: duration: 4954.507 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:19.108528-07:00 edge-fr-1 systemd[1]: Started Session 40249 of User zoë. 2026-10-09T13:30:19.128120-07:00 worker-12 sshd[3075]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:30:19.249769-07:00 db-replica app[30346]: INFO worker 51 picked job b114c93eae931328 from queue orders 2026-10-09T13:30:19.299789-07:00 api-07 sshd[4390]: Accepted publickey for müller from 45.170.10.105 port 53016 ssh2: ED25519 SHA256:bff7442d7cf17b15 2026-10-09T13:30:19.507960-07:00 edge-fr-1 app[30325]: INFO health check ok: db 207 ms, cache 207 ms, queue depth 46 2026-10-09T13:30:19.521796-07:00 bastion sshd[2502]: Invalid user ci from 192.226.168.106 port 25037 2026-10-09T13:30:19.592652-07:00 web-03 sshd[2550]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:30:19.785435-07:00 db-replica app[30752]: INFO order 66609 confirmed for zoë in 7023 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:19.844419-07:00 bastion app[30875]: INFO worker 40 finished job 09f155039645c34a in 2016 ms 2026-10-09T13:30:19.911495-07:00 worker-12 app[30683]: INFO worker 24 picked job 68b7d05d301a128d from queue orders 2026-10-09T13:30:19.932930-07:00 db-replica sshd[17408]: Invalid user root from 10.173.216.144 port 48059 2026-10-09T13:30:19.945621-07:00 db-primary nginx[1204]: 10.182.218.71 - - "GET /login HTTP/1.1" 200 22366 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:20.146179-07:00 bastion app[30704]: INFO request_id=f09d1c3f2c0964d8 method=GET path=/admin status=200 duration=5760ms 2026-10-09T13:30:20.147254-07:00 edge-fr-1 app[30739]: INFO order 19240 confirmed for deploy in 4409 ms (region us-east-1, queue emails) 2026-10-09T13:30:20.153095-07:00 web-03 app[30301]: INFO order 57437 confirmed for françois in 3582 ms (region eu-west-1, queue emails) 2026-10-09T13:30:20.162771-07:00 db-primary haproxy[933]: 91.191.138.223:16440 [27217] http-in app/cache-3 4754/0/766/766/4754 404 28370 - - ---- 184/184/72/72/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:30:20.371581-07:00 edge-fr-1 sshd[58563]: Failed password for invalid user backup from 203.116.149.81 port 51341 ssh2 2026-10-09T13:30:20.380402-07:00 cache-3 app[30830]: INFO order 82617 confirmed for akira in 280 ms (region ap-northeast-1, queue emails) 2026-10-09T13:30:20.577454-07:00 worker-12 nginx[1205]: 172.223.173.159 - - "GET /static/main.css HTTP/1.1" 200 31739 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:20.622996-07:00 db-replica sshd[48892]: Accepted publickey for backup from 172.153.22.4 port 26534 ssh2: ED25519 SHA256:23061f0aafeaeed3 2026-10-09T13:30:20.651328-07:00 cache-3 sshd[4960]: Connection closed by 45.117.106.127 port 47111 [preauth] 2026-10-09T13:30:20.771904-07:00 web-01 systemd[1]: session-61449.scope: Deactivated successfully. 2026-10-09T13:30:20.869456-07:00 web-01 haproxy[927]: 172.249.169.50:19599 [90627] http-in app/bastion 4935/0/349/349/4935 200 50357 - - ---- 283/283/33/33/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:30:21.013670-07:00 cache-3 app[30158]: INFO request_id=7ecb5eb8da3260b1 method=GET path=/health status=200 duration=6335ms 2026-10-09T13:30:21.186096-07:00 cache-3 nginx[1200]: 91.216.255.144 - - "GET /static/app.js HTTP/1.1" 502 56259 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:21.193729-07:00 db-primary postgres[20270]: LOG: duration: 8648.702 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:21.357778-07:00 web-02 nginx[1205]: 172.61.222.151 - françois "POST /metrics HTTP/1.1" 200 17480 "-" "python-requests/2.32.3" 2026-10-09T13:30:21.540712-07:00 cache-3 postgres[29128]: LOG: duration: 9736.257 ms statement: SELECT * FROM orders WHERE customer_id = 36467 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:21.560095-07:00 worker-12 kernel: [69899.288069] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.186.237.149 DST=10.0.393.393 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=69899 DF PROTO=TCP SPT=20133 DPT=20133 WINDOW=69899 RES=0x00 SYN URGP=0 2026-10-09T13:30:21.587224-07:00 api-08 sshd[46111]: Invalid user müller from 192.218.63.210 port 28791 2026-10-09T13:30:21.606153-07:00 bastion sshd[7453]: Invalid user sørensen from 192.47.218.113 port 40994 2026-10-09T13:30:21.696399-07:00 web-03 nginx[1210]: 91.144.6.165 - françois "POST /static/main.css HTTP/1.1" 200 87882 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:21.703442-07:00 api-07 systemd[1]: session-25405.scope: Deactivated successfully. 2026-10-09T13:30:21.730648-07:00 api-08 app[30643]: WARN retrying upstream 45.78.189.236:38773 after timeout (7258 ms), attempt 1 of 3 2026-10-09T13:30:21.841163-07:00 bastion nginx[1206]: 91.46.62.211 - - "GET /static/app.js HTTP/1.1" 404 19093 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:21.987105-07:00 db-primary app[30694]: INFO request_id=bc50bc149eae9118 method=GET path=/api/v2/orders status=200 duration=7286ms 2026-10-09T13:30:22.051112-07:00 worker-12 dockerd[700]: time="2026-10-09T13:30:22.051112-07:00" level=info msg="Container 9317222aee5df59b exited with code 0" 2026-10-09T13:30:22.067927-07:00 web-01 sshd[50852]: Failed password for invalid user priya from 10.104.175.8 port 28051 ssh2 2026-10-09T13:30:22.151209-07:00 web-03 nginx[1203]: 91.206.215.192 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 37689 "-" "python-requests/2.32.3" 2026-10-09T13:30:22.259532-07:00 web-01 app[30618]: INFO worker 68 picked job 85e0c9f1c6ba9392 from queue webhooks 2026-10-09T13:30:22.323257-07:00 worker-12 haproxy[923]: 91.54.161.96:65282 [84929] http-in app/cache-3 6575/0/383/383/6575 200 35114 - - ---- 904/904/60/60/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:30:22.419696-07:00 api-08 nginx[1207]: 45.178.67.45 - - "GET /wp-login.php HTTP/1.1" 404 51971 "-" "Go-http-client/1.1" 2026-10-09T13:30:22.460432-07:00 web-02 nginx[1201]: 91.118.222.237 - sørensen "POST /login HTTP/1.1" 200 86071 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:22.593199-07:00 db-primary haproxy[932]: 45.95.234.221:15491 [84467] http-in app/web-02 7081/0/442/442/7081 500 89192 - - ---- 889/889/55/55/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:30:22.617155-07:00 edge-fr-1 app[30733]: INFO order 87747 confirmed for françois in 2883 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:30:22.626568-07:00 web-02 haproxy[908]: 10.78.35.163:10914 [33085] http-in app/worker-12 8582/0/740/740/8582 200 70840 - - ---- 331/331/74/74/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:30:22.754287-07:00 cache-3 haproxy[922]: 10.220.145.138:11281 [52308] http-in app/cache-3 9661/0/458/458/9661 200 9011 - - ---- 268/268/35/35/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:22.773472-07:00 api-08 app[30917]: INFO order 96852 confirmed for backup in 7098 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:30:22.877052-07:00 edge-fr-1 app[30788]: INFO worker 25 picked job 9e42ba713be9dddd from queue orders 2026-10-09T13:30:23.062329-07:00 db-replica app[30956]: INFO order 71286 confirmed for deploy in 4137 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:30:23.150457-07:00 db-replica app[30540]: INFO request_id=3fbbcfacb625c800 method=GET path=/favicon.ico status=200 duration=7583ms 2026-10-09T13:30:23.197011-07:00 api-08 app[30320]: INFO worker 28 finished job 522c81944ded61f7 in 6953 ms 2026-10-09T13:30:23.361826-07:00 worker-12 app[30865]: INFO health check ok: db 859 ms, cache 859 ms, queue depth 56 2026-10-09T13:30:23.369325-07:00 web-02 sshd[39442]: Failed password for invalid user françois from 172.129.180.102 port 10943 ssh2 2026-10-09T13:30:23.518820-07:00 bastion postgres[7605]: LOG: duration: 4946.126 ms statement: SELECT * FROM orders WHERE customer_id = 81461 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:23.595770-07:00 api-08 systemd[1]: Started Session 84013 of User sørensen. 2026-10-09T13:30:23.599014-07:00 api-08 kubelet[800]: E1009 13:30:23.538041 9968 pod_workers.go:9968] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-d901389e1399fbdf" 2026-10-09T13:30:23.599184-07:00 api-07 app[30229]: INFO worker 46 finished job f2eb5e744f55581b in 7920 ms 2026-10-09T13:30:23.636693-07:00 web-02 systemd[1]: Started Session 16733 of User ci. 2026-10-09T13:30:23.718819-07:00 edge-fr-1 haproxy[939]: 91.7.86.17:17106 [41303] http-in app/api-07 4458/0/70/70/4458 301 43968 - - ---- 213/213/44/44/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:23.909092-07:00 edge-fr-1 systemd[1]: Started Session 53505 of User sørensen. 2026-10-09T13:30:23.949337-07:00 edge-fr-1 app[30257]: INFO request_id=aea923e1a53da9c8 method=GET path=/favicon.ico status=302 duration=8497ms 2026-10-09T13:30:23.966701-07:00 api-07 sshd[47786]: Invalid user ci from 45.32.54.233 port 9749 2026-10-09T13:30:24.104400-07:00 api-07 systemd[1]: session-75828.scope: Deactivated successfully. 2026-10-09T13:30:24.125776-07:00 web-02 haproxy[938]: 91.236.84.147:9472 [27025] http-in app/api-08 5196/0/493/493/5196 204 25998 - - ---- 268/268/98/98/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:24.179129-07:00 db-primary app[30241]: INFO request_id=929fa03ea20c4771 method=GET path=/favicon.ico status=301 duration=1714ms 2026-10-09T13:30:24.558080-07:00 cache-3 sshd[14920]: Failed password for invalid user akira from 45.48.219.31 port 45166 ssh2 2026-10-09T13:30:24.645223-07:00 api-07 nginx[1205]: 10.105.137.206 - - "GET /login HTTP/1.1" 200 18544 "-" "python-requests/2.32.3" 2026-10-09T13:30:24.710207-07:00 api-08 app[30934]: INFO order 12510 confirmed for françois in 1746 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:30:25.049807-07:00 web-01 app[30688]: DEBUG cache hit ratio 76% over the last minute (57654 lookups) 2026-10-09T13:30:25.059123-07:00 worker-12 app[30721]: INFO request_id=35db170b1a00e890 method=GET path=/static/app.js status=404 duration=5848ms 2026-10-09T13:30:25.483384-07:00 web-01 haproxy[947]: 203.15.163.101:61009 [69882] http-in app/db-primary 9167/0/888/888/9167 401 12434 - - ---- 900/900/35/35/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:25.547033-07:00 web-02 nginx[1207]: 192.132.240.201 - - "GET /metrics HTTP/1.1" 301 14182 "-" "curl/8.4.0" 2026-10-09T13:30:25.630998-07:00 api-07 haproxy[911]: 203.194.235.184:42434 [86928] http-in app/api-08 2312/0/28/28/2312 401 3550 - - ---- 976/976/46/46/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:30:25.653362-07:00 web-03 haproxy[910]: 203.220.160.110:32800 [30994] http-in app/api-08 5266/0/787/787/5266 502 85261 - - ---- 330/330/66/66/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:25.859043-07:00 api-08 nginx[1205]: 172.141.159.61 - - "GET /metrics HTTP/1.1" 401 83151 "-" "Go-http-client/1.1" 2026-10-09T13:30:26.264388-07:00 web-02 app[30943]: INFO request_id=8fff07a7bb8148d4 method=GET path=/metrics status=301 duration=7141ms 2026-10-09T13:30:26.299317-07:00 cache-3 nginx[1207]: 91.230.125.20 - françois "POST /login HTTP/1.1" 502 55523 "-" "curl/8.4.0" 2026-10-09T13:30:26.452475-07:00 db-replica cron[54582]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:30:26.558800-07:00 api-07 systemd[1]: Started Session 85813 of User backup. 2026-10-09T13:30:26.644459-07:00 db-primary systemd[1]: session-50261.scope: Deactivated successfully. 2026-10-09T13:30:26.714841-07:00 web-03 app[30399]: INFO request_id=48e0c4958059608d method=GET path=/api/v2/orders status=200 duration=9627ms 2026-10-09T13:30:26.811582-07:00 web-01 sudo: priya : TTY=pts/0 ; PWD=/home/priya ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:30:27.009268-07:00 edge-fr-1 app[30918]: INFO worker 75 picked job 240c890d33684298 from queue webhooks 2026-10-09T13:30:27.019635-07:00 cache-3 app[30743]: INFO order 59349 confirmed for akira in 8491 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:30:27.034410-07:00 edge-fr-1 haproxy[950]: 10.165.118.130:8765 [77008] http-in app/db-primary 3186/0/462/462/3186 200 7359 - - ---- 961/961/86/86/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:27.158705-07:00 cache-3 haproxy[934]: 45.75.22.200:14421 [83190] http-in app/db-replica 4977/0/340/340/4977 204 4415 - - ---- 486/486/16/16/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:30:27.403520-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577827.441:80107): pid=80107 uid=0 auid=7498 ses=853 msg='op=login id=7498 exe="/usr/sbin/sshd" hostname=? addr=172.206.237.77 terminal=/dev/pts/0 res=success' 2026-10-09T13:30:27.478560-07:00 web-03 sshd[1524]: Received disconnect from 10.51.31.183 port 23915:11: Bye Bye [preauth] 2026-10-09T13:30:27.532872-07:00 edge-fr-1 nginx[1202]: 45.145.46.203 - - "GET /wp-login.php HTTP/1.1" 404 50595 "-" "curl/8.4.0" 2026-10-09T13:30:27.556688-07:00 cache-3 nginx[1202]: 45.120.252.239 - - "GET /metrics HTTP/1.1" 302 13667 "-" "python-requests/2.32.3" 2026-10-09T13:30:27.963378-07:00 web-02 systemd[1]: session-64174.scope: Deactivated successfully. 2026-10-09T13:30:28.227480-07:00 web-01 nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.253.94.213, server: app.example.com, request: "GET /login HTTP/1.1", upstream: "http://10.0.254.254:8080/login" 2026-10-09T13:30:28.281112-07:00 cache-3 app[30710]: WARN slow query (3875 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '14 minutes' 2026-10-09T13:30:28.460140-07:00 worker-12 app[30253]: INFO request_id=b1bd5086c2d0f35d method=GET path=/api/v2/orders/8841 status=200 duration=6468ms 2026-10-09T13:30:28.462991-07:00 web-02 haproxy[949]: 10.219.244.129:15204 [53025] http-in app/web-03 8573/0/742/742/8573 301 65319 - - ---- 683/683/56/56/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:28.485600-07:00 worker-12 sshd[41196]: Invalid user sørensen from 91.223.101.253 port 6990 2026-10-09T13:30:28.624757-07:00 db-replica nginx[1206]: 45.240.7.113 - - "GET /health HTTP/1.1" 301 27102 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:28.665764-07:00 api-07 app[30544]: INFO request_id=702f784716b83f95 method=GET path=/health status=401 duration=189ms 2026-10-09T13:30:28.840949-07:00 db-replica app[30821]: INFO request_id=76441392aa8575ff method=GET path=/api/v2/orders status=401 duration=7599ms 2026-10-09T13:30:28.910308-07:00 web-03 nginx[1209]: 45.144.154.129 - root "POST /health HTTP/1.1" 502 75706 "-" "curl/8.4.0" 2026-10-09T13:30:29.254799-07:00 cache-3 nginx[1202]: 91.239.8.225 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 60966 "-" "Go-http-client/1.1" 2026-10-09T13:30:29.419380-07:00 web-01 app[30943]: ERROR cache miss storm: 2458 misses in 3057 ms, key prefix session:priya 2026-10-09T13:30:29.524474-07:00 db-replica app[30069]: INFO worker 57 picked job 04c6e11412f3ec2c from queue webhooks 2026-10-09T13:30:29.596647-07:00 db-primary sshd[10037]: Failed password for invalid user françois from 192.37.150.116 port 49524 ssh2 2026-10-09T13:30:29.649939-07:00 web-03 nginx[1209]: 192.233.228.71 - - "GET /admin HTTP/1.1" 302 62665 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:29.658250-07:00 cache-3 haproxy[907]: 91.102.234.65:30895 [67733] http-in app/web-01 56/0/618/618/56 301 78610 - - ---- 391/391/13/13/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:30:29.924153-07:00 api-08 nginx[1204]: 192.199.79.44 - - "GET /static/main.css HTTP/1.1" 500 11884 "-" "curl/8.4.0" 2026-10-09T13:30:29.927186-07:00 bastion app[30464]: INFO request_id=b7f6abf5535d75e7 method=GET path=/login status=404 duration=4569ms 2026-10-09T13:30:30.204195-07:00 web-01 app[30614]: INFO order 52718 confirmed for müller in 4632 ms (region eu-west-1, queue orders) 2026-10-09T13:30:30.302475-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577830.308:78695): pid=78695 uid=0 auid=8748 ses=705 msg='op=login id=8748 exe="/usr/sbin/sshd" hostname=? addr=10.108.97.202 terminal=/dev/pts/0 res=success' 2026-10-09T13:30:30.425704-07:00 api-07 sshd[53855]: Failed password for invalid user zoë from 172.91.113.34 port 40918 ssh2 2026-10-09T13:30:30.439624-07:00 api-08 systemd[1]: Started Session 72714 of User akira. 2026-10-09T13:30:30.528495-07:00 db-replica app[30490]: INFO order 44582 confirmed for françois in 8311 ms (region eu-west-1, queue orders) 2026-10-09T13:30:30.638048-07:00 api-08 app[30314]: INFO health check ok: db 20 ms, cache 20 ms, queue depth 84 2026-10-09T13:30:30.776086-07:00 web-02 nginx[1207]: 10.91.91.119 - backup "POST /wp-login.php HTTP/1.1" 302 56057 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:30.832967-07:00 cache-3 sshd[23149]: Invalid user françois from 45.68.242.190 port 22080 2026-10-09T13:30:30.866687-07:00 cache-3 nginx[1205]: 203.88.126.251 - deploy "POST /health HTTP/1.1" 500 33333 "-" "Go-http-client/1.1" 2026-10-09T13:30:30.970441-07:00 db-primary postgres[22826]: LOG: duration: 6619.250 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:31.007808-07:00 edge-fr-1 haproxy[920]: 203.197.70.249:56670 [58342] http-in app/web-01 6532/0/946/946/6532 302 56586 - - ---- 637/637/65/65/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:30:31.160206-07:00 web-01 nginx[1201]: 91.109.245.113 - - "GET /health HTTP/1.1" 200 76796 "-" "curl/8.4.0" 2026-10-09T13:30:31.524035-07:00 api-08 app[30767]: INFO worker 37 finished job 252e395e60c5d0d2 in 7638 ms 2026-10-09T13:30:31.734512-07:00 edge-fr-1 app[30647]: INFO request_id=3d24b814a63a9630 method=GET path=/wp-login.php status=404 duration=6210ms 2026-10-09T13:30:31.979269-07:00 cache-3 sshd[33172]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:30:32.064390-07:00 worker-12 sshd[60910]: Failed password for invalid user priya from 10.219.225.87 port 21084 ssh2 2026-10-09T13:30:32.070448-07:00 api-08 app[30556]: INFO request_id=23c0328c5b2098d0 method=GET path=/api/v2/orders status=200 duration=8950ms 2026-10-09T13:30:32.127429-07:00 api-08 kernel: [34707.864327] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.226.66.80 DST=10.0.721.721 LEN=62 TOS=0x00 PREC=0x00 TTL=62 ID=34707 DF PROTO=TCP SPT=61573 DPT=61573 WINDOW=34707 RES=0x00 SYN URGP=0 2026-10-09T13:30:32.251032-07:00 web-01 nginx[1205]: 203.242.96.170 - - "GET /metrics HTTP/1.1" 200 55498 "-" "Go-http-client/1.1" 2026-10-09T13:30:32.280879-07:00 cache-3 sshd[60373]: Received disconnect from 45.242.154.229 port 3209:11: Bye Bye [preauth] 2026-10-09T13:30:32.602773-07:00 bastion haproxy[936]: 203.128.112.4:43355 [55385] http-in app/api-08 7102/0/33/33/7102 200 9877 - - ---- 816/816/16/16/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:30:32.631693-07:00 api-07 nginx[1205]: 45.51.207.7 - zoë "POST /.env HTTP/1.1" 200 50380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:32.653833-07:00 web-01 app[30752]: INFO health check ok: db 589 ms, cache 589 ms, queue depth 83 2026-10-09T13:30:33.027036-07:00 web-03 systemd[1]: Started Session 79336 of User zoë. 2026-10-09T13:30:33.149259-07:00 bastion app[30111]: INFO order 14615 confirmed for backup in 3024 ms (region us-east-1, queue webhooks) 2026-10-09T13:30:33.413649-07:00 bastion haproxy[935]: 203.127.68.110:6620 [15361] http-in app/web-01 4812/0/193/193/4812 404 18007 - - ---- 288/288/44/44/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:33.661902-07:00 cache-3 app[30921]: INFO health check ok: db 696 ms, cache 696 ms, queue depth 10 2026-10-09T13:30:33.743999-07:00 bastion app[30732]: INFO order 49409 confirmed for müller in 6927 ms (region us-east-1, queue webhooks) 2026-10-09T13:30:33.992646-07:00 web-03 sshd[35289]: Invalid user deploy from 10.216.52.238 port 54205 2026-10-09T13:30:34.026989-07:00 api-08 haproxy[908]: 203.82.96.117:36916 [84299] http-in app/edge-fr-1 6698/0/656/656/6698 200 78748 - - ---- 486/486/51/51/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:30:34.097810-07:00 worker-12 sshd[39002]: pam_unix(sshd:session): session opened for user deploy(uid=5249) by (uid=0) 2026-10-09T13:30:34.441913-07:00 db-primary sshd[23359]: Invalid user françois from 203.1.144.96 port 51121 2026-10-09T13:30:34.507026-07:00 web-01 nginx[1204]: 203.197.133.59 - müller "POST /static/main.css HTTP/1.1" 401 47747 "-" "kube-probe/1.31" 2026-10-09T13:30:34.604188-07:00 cache-3 sshd[22186]: Failed password for invalid user zoë from 45.80.195.37 port 17652 ssh2 2026-10-09T13:30:34.747692-07:00 web-02 kernel: [49967.062313] TCP: request_sock_TCP: Possible SYN flooding on port 8330. Sending cookies. Check SNMP counters. 2026-10-09T13:30:35.427710-07:00 web-02 app[30800]: INFO order 14037 confirmed for sørensen in 7320 ms (region ap-northeast-1, queue emails) 2026-10-09T13:30:35.539065-07:00 web-02 app[30634]: DEBUG cache hit ratio 91% over the last minute (44113 lookups) 2026-10-09T13:30:35.574728-07:00 web-02 app[30865]: INFO worker 34 picked job 0e67ffa92caa451d from queue webhooks 2026-10-09T13:30:35.891043-07:00 db-replica nginx[1200]: 172.176.249.216 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 56213 "-" "curl/8.4.0" 2026-10-09T13:30:36.332665-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577836.615:81511): pid=81511 uid=0 auid=4946 ses=216 msg='op=login id=4946 exe="/usr/sbin/sshd" hostname=? addr=172.136.6.220 terminal=/dev/pts/0 res=success' 2026-10-09T13:30:36.410751-07:00 web-01 app[30795]: INFO order 64043 confirmed for müller in 6396 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:36.511176-07:00 api-07 app[30802]: INFO request_id=59abd8d24637fcf2 method=GET path=/.env status=500 duration=9824ms 2026-10-09T13:30:36.544650-07:00 web-01 app[30036]: INFO worker 67 finished job 0e23d20770825dba in 8681 ms 2026-10-09T13:30:36.937385-07:00 api-07 nginx[1205]: 10.95.109.239 - - "GET /static/main.css HTTP/1.1" 200 970 "-" "kube-probe/1.31" 2026-10-09T13:30:37.094194-07:00 worker-12 sshd[51830]: Accepted publickey for françois from 192.92.134.60 port 6363 ssh2: ED25519 SHA256:081d5cf2ac512aaf 2026-10-09T13:30:37.256407-07:00 web-01 app[30572]: INFO health check ok: db 608 ms, cache 608 ms, queue depth 93 2026-10-09T13:30:37.482317-07:00 bastion sshd[34430]: Connection closed by 203.138.186.178 port 28355 [preauth] 2026-10-09T13:30:37.723624-07:00 edge-fr-1 haproxy[930]: 172.28.253.183:29930 [14370] http-in app/api-08 942/0/79/79/942 404 25941 - - ---- 667/667/83/83/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:30:37.759932-07:00 worker-12 haproxy[941]: 203.244.196.41:20762 [97367] http-in app/web-03 9211/0/488/488/9211 200 40754 - - ---- 343/343/26/26/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:30:37.866680-07:00 db-replica app[30121]: INFO worker 12 finished job 2d74c6a04bf20171 in 5438 ms 2026-10-09T13:30:37.986094-07:00 bastion app[30796]: INFO health check ok: db 973 ms, cache 973 ms, queue depth 81 2026-10-09T13:30:38.017525-07:00 api-08 app[30017]: INFO worker 17 picked job 7965fec54b2fdea9 from queue orders 2026-10-09T13:30:38.042292-07:00 cache-3 postgres[19316]: LOG: duration: 6684.285 ms statement: SELECT * FROM orders WHERE customer_id = 27529 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:38.053293-07:00 web-02 nginx[1206]: 172.103.112.139 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 39228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:38.113671-07:00 api-07 sshd[21449]: Received disconnect from 10.170.128.133 port 41678:11: Bye Bye [preauth] 2026-10-09T13:30:38.277389-07:00 web-03 nginx[1206]: 192.226.70.16 - - "GET /login HTTP/1.1" 404 25144 "-" "python-requests/2.32.3" 2026-10-09T13:30:38.586289-07:00 api-07 nginx[1204]: 172.113.74.205 - - "GET /wp-login.php HTTP/1.1" 302 81085 "-" "kube-probe/1.31" 2026-10-09T13:30:38.675078-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:30:38.675078-07:00" level=warning msg="Health check for container 2aa31e050cded521 error: context deadline exceeded" 2026-10-09T13:30:38.687595-07:00 cache-3 nginx[1202]: 45.98.28.84 - akira "POST /wp-login.php HTTP/1.1" 502 33624 "-" "curl/8.4.0" 2026-10-09T13:30:38.720148-07:00 edge-fr-1 kernel: [32089.231599] TCP: request_sock_TCP: Possible SYN flooding on port 64274. Sending cookies. Check SNMP counters. 2026-10-09T13:30:38.772927-07:00 cache-3 nginx[1203]: 203.3.70.125 - root "POST /api/v2/users HTTP/1.1" 500 10111 "-" "python-requests/2.32.3" 2026-10-09T13:30:38.825352-07:00 api-07 postgres[8321]: LOG: duration: 8755.262 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:38.972095-07:00 edge-fr-1 nginx[1201]: 203.222.51.178 - - "GET /api/v2/orders HTTP/1.1" 404 55704 "-" "Go-http-client/1.1" 2026-10-09T13:30:39.399198-07:00 bastion app[30331]: INFO request_id=61ba727582ff46c3 method=GET path=/api/v2/users status=404 duration=2161ms 2026-10-09T13:30:39.565399-07:00 web-03 sshd[38907]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:30:39.615969-07:00 web-02 app[30921]: INFO worker 72 picked job d8636726b1452c43 from queue orders 2026-10-09T13:30:39.875625-07:00 api-07 app[30211]: INFO worker 75 picked job c5e07e42e78baa70 from queue invoices 2026-10-09T13:30:39.899552-07:00 web-01 haproxy[909]: 203.131.77.124:62281 [92811] http-in app/cache-3 5137/0/872/872/5137 301 7106 - - ---- 588/588/60/60/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:30:39.918745-07:00 web-02 app[30380]: INFO request_id=52cc45e8fcddeab3 method=GET path=/api/v2/orders status=401 duration=2187ms 2026-10-09T13:30:40.125945-07:00 cache-3 nginx[1209]: 10.68.172.160 - - "GET /static/app.js HTTP/1.1" 200 41082 "-" "kube-probe/1.31" 2026-10-09T13:30:40.177343-07:00 api-07 app[30151]: INFO request_id=f22c9f7389c956b3 method=GET path=/api/v2/orders/8841 status=200 duration=9160ms 2026-10-09T13:30:40.180315-07:00 web-03 nginx[1203]: 91.158.64.188 - backup "POST /static/app.js HTTP/1.1" 200 24670 "-" "curl/8.4.0" 2026-10-09T13:30:40.186978-07:00 db-primary nginx[1205]: 10.193.224.59 - - "GET /api/v2/orders HTTP/1.1" 302 42344 "-" "Go-http-client/1.1" 2026-10-09T13:30:40.264152-07:00 cache-3 postgres[3239]: LOG: duration: 5824.210 ms statement: SELECT * FROM orders WHERE customer_id = 13358 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:40.437900-07:00 bastion nginx[1207]: 172.152.255.52 - - "GET /.env HTTP/1.1" 200 6255 "-" "python-requests/2.32.3" 2026-10-09T13:30:40.439647-07:00 cache-3 sshd[63283]: Received disconnect from 203.254.32.125 port 48300:11: Bye Bye [preauth] 2026-10-09T13:30:40.511495-07:00 cache-3 kernel: [68034.922868] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.109.223.171 DST=10.0.350.350 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=68034 DF PROTO=TCP SPT=44358 DPT=44358 WINDOW=68034 RES=0x00 SYN URGP=0 2026-10-09T13:30:40.743967-07:00 db-replica sshd[42797]: Received disconnect from 45.181.232.8 port 45625:11: Bye Bye [preauth] 2026-10-09T13:30:40.746634-07:00 api-07 nginx[1210]: 203.92.248.143 - - "GET /metrics HTTP/1.1" 301 89583 "-" "Go-http-client/1.1" 2026-10-09T13:30:40.872402-07:00 db-primary app[30770]: INFO request_id=214577b86702c6c8 method=GET path=/api/v2/orders/8841 status=200 duration=5429ms 2026-10-09T13:30:40.922650-07:00 web-01 haproxy[906]: 45.248.233.195:49719 [99534] http-in app/web-03 1099/0/51/51/1099 302 79273 - - ---- 552/552/68/68/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:30:40.962225-07:00 cache-3 kubelet[800]: I1009 13:30:40.877231 1089 kubelet.go:1089] "Pod is terminating, skipping pod status update" pod="default/api-1be8b44ea7eb0ba2" 2026-10-09T13:30:41.065226-07:00 bastion sshd[55989]: Connection closed by 91.156.208.46 port 60354 [preauth] 2026-10-09T13:30:41.138788-07:00 db-replica cron[46191]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:30:41.290899-07:00 worker-12 app[30198]: WARN slow query (1494 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '62 minutes' 2026-10-09T13:30:41.306279-07:00 api-07 postgres[4719]: LOG: duration: 5497.202 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:41.414634-07:00 db-replica kernel: [56814.517055] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.0.58.193 DST=10.0.270.270 LEN=76 TOS=0x00 PREC=0x00 TTL=76 ID=56814 DF PROTO=TCP SPT=65498 DPT=65498 WINDOW=56814 RES=0x00 SYN URGP=0 2026-10-09T13:30:41.486542-07:00 edge-fr-1 app[30633]: INFO worker 43 finished job 97828e4569555afc in 6945 ms 2026-10-09T13:30:41.651565-07:00 api-08 sshd[43350]: pam_unix(sshd:session): session opened for user deploy(uid=2926) by (uid=0) 2026-10-09T13:30:41.773275-07:00 db-replica nginx[1207]: 192.162.122.113 - - "GET /.env HTTP/1.1" 200 2323 "-" "curl/8.4.0" 2026-10-09T13:30:41.880965-07:00 edge-fr-1 sshd[46921]: Invalid user root from 203.27.78.159 port 15393 2026-10-09T13:30:42.076672-07:00 api-07 app[30962]: INFO request_id=40cf39eb10696c7d method=GET path=/metrics status=200 duration=8878ms 2026-10-09T13:30:42.290606-07:00 worker-12 app[30582]: INFO request_id=225b2ce894391cfb method=GET path=/metrics status=200 duration=4446ms 2026-10-09T13:30:42.338722-07:00 web-02 cron[30966]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:30:42.398358-07:00 db-replica nginx[1204]: 91.110.96.229 - müller "POST /api/v2/users HTTP/1.1" 404 88138 "-" "curl/8.4.0" 2026-10-09T13:30:42.433758-07:00 api-08 app[30405]: INFO worker 45 finished job f6ec2755ad44f12d in 5497 ms 2026-10-09T13:30:42.478599-07:00 api-08 app[30249]: INFO worker 38 finished job 04780f3bca95e71d in 4673 ms 2026-10-09T13:30:42.574146-07:00 api-08 app[30106]: INFO request_id=71433ba389b41107 method=GET path=/favicon.ico status=401 duration=8312ms 2026-10-09T13:30:42.622980-07:00 bastion postgres[22789]: LOG: duration: 8518.512 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:42.633702-07:00 web-03 haproxy[929]: 10.64.253.160:18641 [33951] http-in app/db-primary 4171/0/287/287/4171 404 72862 - - ---- 670/670/71/71/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:30:42.639950-07:00 edge-fr-1 app[30516]: INFO worker 11 picked job 88d43a17588f1b91 from queue webhooks 2026-10-09T13:30:42.689177-07:00 db-replica nginx[1208]: 203.18.8.135 - françois "POST /metrics HTTP/1.1" 301 17036 "-" "python-requests/2.32.3" 2026-10-09T13:30:42.836373-07:00 api-08 app[30668]: INFO request_id=97f83a6b255122d4 method=GET path=/api/v2/orders/8841 status=200 duration=2095ms 2026-10-09T13:30:42.938413-07:00 worker-12 nginx[1206]: 192.141.55.238 - - "GET /static/main.css HTTP/1.1" 204 83447 "-" "python-requests/2.32.3" 2026-10-09T13:30:42.938725-07:00 db-replica app[30403]: INFO health check ok: db 567 ms, cache 567 ms, queue depth 15 2026-10-09T13:30:43.485697-07:00 db-primary app[30462]: INFO request_id=1eba19313bb2f939 method=GET path=/favicon.ico status=200 duration=1014ms 2026-10-09T13:30:43.595740-07:00 db-replica app[30353]: INFO worker 91 finished job 58559919aee2a03b in 7364 ms 2026-10-09T13:30:43.627677-07:00 db-replica nginx[1203]: 45.236.181.1 - - "GET /health HTTP/1.1" 200 69452 "-" "Go-http-client/1.1" 2026-10-09T13:30:43.629836-07:00 web-01 app[30155]: DEBUG cache hit ratio 94% over the last minute (89732 lookups) 2026-10-09T13:30:43.745584-07:00 web-01 app[30782]: INFO request_id=e5dac38aaa0e46f0 method=GET path=/static/app.js status=502 duration=8543ms 2026-10-09T13:30:43.872511-07:00 db-replica postgres[20160]: LOG: duration: 2518.801 ms statement: SELECT * FROM orders WHERE customer_id = 39482 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:43.988819-07:00 cache-3 nginx[1205]: 91.35.189.237 - - "GET /wp-login.php HTTP/1.1" 302 24759 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:44.173777-07:00 cache-3 app[30050]: INFO health check ok: db 959 ms, cache 959 ms, queue depth 82 2026-10-09T13:30:44.344431-07:00 api-07 nginx[1210]: 172.70.41.169 - - "GET /.env HTTP/1.1" 500 42838 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:44.388246-07:00 api-08 nginx[1208]: 203.169.215.202 - - "GET /static/main.css HTTP/1.1" 200 9900 "-" "python-requests/2.32.3" 2026-10-09T13:30:44.434193-07:00 web-02 app[30908]: INFO request_id=0d9713edc3e7fa15 method=GET path=/static/app.js status=404 duration=7127ms 2026-10-09T13:30:44.464486-07:00 api-07 app[30725]: INFO request_id=b5d7e667f410fd59 method=GET path=/static/app.js status=200 duration=3434ms 2026-10-09T13:30:44.703217-07:00 web-01 postgres[21707]: LOG: checkpoint complete: wrote 2119 buffers (54%); 0 WAL file(s) added, 0 removed, 23 recycled; write=5349.197 s, sync=0.197 s, total=5349.197 s 2026-10-09T13:30:44.958602-07:00 cache-3 app[30757]: INFO worker 65 picked job c10b8f9a1858a321 from queue emails 2026-10-09T13:30:45.344412-07:00 web-03 app[30026]: INFO worker 34 picked job a4951b55fe015abb from queue invoices 2026-10-09T13:30:45.396072-07:00 db-replica systemd[1]: Started Session 26533 of User ci. 2026-10-09T13:30:45.470051-07:00 web-01 app[30486]: INFO worker 94 picked job 5935e6b7cfa043bb from queue invoices 2026-10-09T13:30:45.476634-07:00 bastion sshd[27415]: Failed password for invalid user deploy from 91.41.119.85 port 28663 ssh2 2026-10-09T13:30:45.478762-07:00 db-primary sshd[51904]: Connection closed by 10.162.185.183 port 62460 [preauth] 2026-10-09T13:30:45.492461-07:00 db-replica sshd[8364]: Connection closed by 203.15.24.94 port 17332 [preauth] 2026-10-09T13:30:45.720498-07:00 edge-fr-1 app[30506]: INFO order 97007 confirmed for zoë in 6139 ms (region us-east-1, queue invoices) 2026-10-09T13:30:45.750431-07:00 web-01 nginx[1202]: 172.197.83.85 - - "GET /admin HTTP/1.1" 200 55769 "-" "curl/8.4.0" 2026-10-09T13:30:45.762845-07:00 edge-fr-1 sshd[31928]: Failed password for invalid user françois from 10.6.100.168 port 34221 ssh2 2026-10-09T13:30:45.813086-07:00 web-01 app[30058]: INFO worker 51 finished job 6aecf217e9af9e00 in 6848 ms 2026-10-09T13:30:45.835918-07:00 api-07 app[30751]: INFO order 87364 confirmed for zoë in 3336 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:46.211589-07:00 api-08 haproxy[925]: 172.31.177.2:6125 [33239] http-in app/api-08 9372/0/722/722/9372 502 3705 - - ---- 962/962/98/98/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:46.400043-07:00 db-replica sshd[60509]: Accepted publickey for françois from 172.90.6.109 port 61842 ssh2: ED25519 SHA256:a0f8f7d085a8822c 2026-10-09T13:30:46.545237-07:00 api-08 nginx[1204]: 203.238.91.69 - françois "POST /login HTTP/1.1" 204 38969 "-" "Go-http-client/1.1" 2026-10-09T13:30:46.570868-07:00 api-08 sshd[48956]: pam_unix(sshd:session): session opened for user müller(uid=1580) by (uid=0) 2026-10-09T13:30:46.570959-07:00 db-primary app[30402]: INFO request_id=6ffcade9338ee518 method=GET path=/metrics status=502 duration=6895ms 2026-10-09T13:30:46.694842-07:00 worker-12 sshd[13881]: pam_unix(sshd:session): session opened for user root(uid=3739) by (uid=0) 2026-10-09T13:30:46.718855-07:00 edge-fr-1 app[30068]: INFO worker 65 finished job 1f09b7b6436dd533 in 1295 ms 2026-10-09T13:30:46.907212-07:00 bastion nginx[1202]: 172.98.183.54 - root "POST /admin HTTP/1.1" 200 53181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:30:46.986112-07:00 api-08 app[30517]: INFO worker 84 finished job 5f6ad2578ee683fb in 9339 ms 2026-10-09T13:30:47.222985-07:00 cache-3 app[30484]: INFO worker 89 finished job 7c0d34a31a616e6e in 5691 ms 2026-10-09T13:30:47.223803-07:00 web-01 postgres[9914]: LOG: duration: 4660.801 ms statement: SELECT * FROM orders WHERE customer_id = 14605 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:47.402254-07:00 worker-12 nginx[1209]: 203.185.190.179 - akira "POST /static/main.css HTTP/1.1" 200 11044 "-" "python-requests/2.32.3" 2026-10-09T13:30:47.508586-07:00 edge-fr-1 nginx[1210]: 203.141.63.206 - - "GET /static/app.js HTTP/1.1" 200 15695 "-" "python-requests/2.32.3" 2026-10-09T13:30:47.583575-07:00 cache-3 app[30509]: INFO order 30616 confirmed for müller in 3454 ms (region us-east-1, queue emails) 2026-10-09T13:30:47.677192-07:00 bastion app[30815]: INFO order 48276 confirmed for françois in 5656 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:47.700588-07:00 db-replica haproxy[938]: 172.146.176.149:58011 [37078] http-in app/bastion 28/0/901/901/28 200 77925 - - ---- 446/446/85/85/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:47.744721-07:00 web-01 haproxy[922]: 10.98.2.93:25425 [18854] http-in app/web-01 7931/0/353/353/7931 200 35018 - - ---- 290/290/81/81/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:47.871174-07:00 web-03 sshd[29827]: Connection closed by 192.167.7.118 port 55447 [preauth] 2026-10-09T13:30:47.891315-07:00 worker-12 haproxy[908]: 192.161.164.220:13964 [51458] http-in app/cache-3 9312/0/344/344/9312 200 47809 - - ---- 555/555/68/68/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:48.070554-07:00 edge-fr-1 app[30965]: INFO request_id=f40980da572c5b32 method=GET path=/health status=404 duration=8617ms 2026-10-09T13:30:48.093762-07:00 db-primary postgres[14417]: LOG: duration: 577.434 ms statement: SELECT * FROM orders WHERE customer_id = 22207 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:48.107153-07:00 db-primary app[30040]: WARN retrying upstream 91.172.188.252:19743 after timeout (190 ms), attempt 1 of 3 2026-10-09T13:30:48.115291-07:00 db-primary app[30807]: DEBUG cache hit ratio 76% over the last minute (22915 lookups) 2026-10-09T13:30:48.141029-07:00 api-08 nginx[1201]: 203.35.92.144 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 64943 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:48.142591-07:00 worker-12 postgres[17198]: LOG: duration: 817.984 ms statement: SELECT * FROM orders WHERE customer_id = 40696 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:48.251895-07:00 api-07 sshd[46725]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:30:48.301760-07:00 worker-12 dockerd[700]: time="2026-10-09T13:30:48.301760-07:00" level=info msg="Container 46b69c638149a911 exited with code 0" 2026-10-09T13:30:48.348336-07:00 worker-12 sshd[8297]: Connection closed by 91.5.230.54 port 59009 [preauth] 2026-10-09T13:30:48.412982-07:00 db-primary app[30377]: INFO worker 14 picked job b8124f2e51ae29e6 from queue webhooks 2026-10-09T13:30:48.502400-07:00 bastion app[30566]: INFO order 10746 confirmed for sørensen in 8787 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:48.502523-07:00 cache-3 app[30306]: INFO request_id=72fabf65ab7cf1ae method=GET path=/api/v2/users status=200 duration=6248ms 2026-10-09T13:30:48.551674-07:00 db-primary nginx[1210]: 203.214.43.184 - root "POST /api/v2/orders HTTP/1.1" 200 72201 "-" "python-requests/2.32.3" 2026-10-09T13:30:49.091484-07:00 cache-3 nginx[1210]: 203.228.135.160 - - "GET /static/app.js HTTP/1.1" 200 53189 "-" "curl/8.4.0" 2026-10-09T13:30:49.223471-07:00 cache-3 app[30817]: INFO worker 97 picked job 7c81e0874706b29e from queue emails 2026-10-09T13:30:49.527171-07:00 edge-fr-1 sshd[47616]: Accepted publickey for priya from 45.218.113.52 port 47859 ssh2: ED25519 SHA256:0fce08e411ec18d5 2026-10-09T13:30:49.584851-07:00 web-02 nginx[1200]: 10.160.214.37 - deploy "POST /static/main.css HTTP/1.1" 401 81933 "-" "curl/8.4.0" 2026-10-09T13:30:49.765033-07:00 edge-fr-1 app[30425]: INFO health check ok: db 928 ms, cache 928 ms, queue depth 78 2026-10-09T13:30:49.880155-07:00 db-replica sshd[27174]: Connection closed by 192.153.3.187 port 46707 [preauth] 2026-10-09T13:30:50.429821-07:00 cache-3 nginx[1207]: 192.8.246.40 - - "GET /health HTTP/1.1" 200 20359 "-" "kube-probe/1.31" 2026-10-09T13:30:50.589642-07:00 bastion postgres[25388]: LOG: duration: 9735.457 ms statement: SELECT * FROM orders WHERE customer_id = 51486 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:50.852172-07:00 cache-3 nginx[1205]: 203.134.81.178 - sørensen "POST /static/app.js HTTP/1.1" 200 53250 "-" "python-requests/2.32.3" 2026-10-09T13:30:51.126278-07:00 web-01 postgres[4856]: LOG: duration: 911.537 ms statement: SELECT * FROM orders WHERE customer_id = 84167 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:51.192907-07:00 cache-3 app[30139]: INFO worker 75 picked job ab60def526157174 from queue webhooks 2026-10-09T13:30:51.305724-07:00 api-07 app[30839]: INFO health check ok: db 54 ms, cache 54 ms, queue depth 64 2026-10-09T13:30:51.508762-07:00 api-07 nginx[1207]: 192.214.18.131 - - "GET /admin HTTP/1.1" 200 17548 "-" "curl/8.4.0" 2026-10-09T13:30:51.806164-07:00 cache-3 app[30023]: INFO order 64508 confirmed for müller in 4532 ms (region ap-northeast-1, queue orders) 2026-10-09T13:30:51.998397-07:00 edge-fr-1 systemd[1]: session-94614.scope: Deactivated successfully. 2026-10-09T13:30:52.192811-07:00 web-03 kernel: [54029.371468] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.206.23.138 DST=10.0.811.811 LEN=42 TOS=0x00 PREC=0x00 TTL=42 ID=54029 DF PROTO=TCP SPT=22070 DPT=22070 WINDOW=54029 RES=0x00 SYN URGP=0 2026-10-09T13:30:52.209231-07:00 web-03 app[30961]: INFO worker 30 finished job 7e755a44d0845cfa in 3489 ms 2026-10-09T13:30:52.676131-07:00 api-08 sshd[59844]: Failed password for invalid user akira from 192.192.113.139 port 55177 ssh2 2026-10-09T13:30:52.815859-07:00 worker-12 haproxy[943]: 172.136.220.71:17829 [21164] http-in app/api-07 9495/0/151/151/9495 200 44659 - - ---- 700/700/83/83/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:30:52.895932-07:00 api-07 sshd[43300]: Accepted publickey for root from 203.247.178.101 port 57126 ssh2: ED25519 SHA256:dc25e1f6d859fc13 2026-10-09T13:30:52.970430-07:00 web-01 nginx[1206]: 10.210.248.39 - priya "POST /api/v2/search?q=invoice HTTP/1.1" 301 73016 "-" "Go-http-client/1.1" 2026-10-09T13:30:53.065668-07:00 worker-12 nginx[1209]: 10.211.179.36 - - "GET /wp-login.php HTTP/1.1" 200 41783 "-" "python-requests/2.32.3" 2026-10-09T13:30:53.217079-07:00 api-07 sshd[50750]: Received disconnect from 45.28.85.92 port 57654:11: Bye Bye [preauth] 2026-10-09T13:30:53.349240-07:00 cache-3 postgres[27351]: LOG: duration: 76.722 ms statement: SELECT * FROM orders WHERE customer_id = 41055 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:53.599580-07:00 worker-12 systemd[1]: session-19713.scope: Deactivated successfully. 2026-10-09T13:30:53.723703-07:00 db-replica nginx[1210]: 45.87.78.137 - - "GET /health HTTP/1.1" 200 33791 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:30:53.955123-07:00 web-02 systemd[1]: session-68431.scope: Deactivated successfully. 2026-10-09T13:30:53.984741-07:00 bastion sshd[56602]: Received disconnect from 10.156.19.107 port 13664:11: Bye Bye [preauth] 2026-10-09T13:30:54.045574-07:00 bastion nginx[1210]: 91.39.0.29 - - "GET /static/app.js HTTP/1.1" 401 88545 "-" "Go-http-client/1.1" 2026-10-09T13:30:54.056972-07:00 api-08 app[30088]: INFO worker 35 picked job e03d424e18fea77b from queue emails 2026-10-09T13:30:54.158718-07:00 edge-fr-1 nginx[1200]: 10.92.255.69 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 58447 "-" "python-requests/2.32.3" 2026-10-09T13:30:54.209472-07:00 edge-fr-1 app[30344]: INFO request_id=0b7c203c50632ff0 method=GET path=/static/main.css status=500 duration=8612ms 2026-10-09T13:30:54.245248-07:00 edge-fr-1 haproxy[940]: 192.86.170.153:51258 [92596] http-in app/web-03 9396/0/641/641/9396 302 34681 - - ---- 488/488/93/93/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:30:54.359061-07:00 web-03 app[30756]: INFO worker 26 picked job 83e2b9ebf4a964c8 from queue webhooks 2026-10-09T13:30:54.361167-07:00 api-08 sshd[41799]: Accepted publickey for ci from 10.5.2.172 port 16710 ssh2: ED25519 SHA256:f18d56c0d7c61a85 2026-10-09T13:30:54.484726-07:00 db-primary sshd[39623]: Failed password for invalid user deploy from 91.71.23.84 port 2729 ssh2 2026-10-09T13:30:54.544884-07:00 db-replica sshd[39874]: Connection closed by 91.20.168.80 port 8015 [preauth] 2026-10-09T13:30:54.594329-07:00 api-07 dockerd[700]: time="2026-10-09T13:30:54.594329-07:00" level=info msg="Container 15d2043983e8afd0 exited with code 0" 2026-10-09T13:30:54.755162-07:00 web-02 app[30533]: INFO request_id=66e5946f2da228b7 method=GET path=/login status=502 duration=2647ms 2026-10-09T13:30:54.950533-07:00 db-primary app[30402]: DEBUG cache hit ratio 79% over the last minute (80595 lookups) 2026-10-09T13:30:55.336678-07:00 web-02 nginx[1201]: 10.251.165.109 - backup "POST /static/app.js HTTP/1.1" 200 17135 "-" "python-requests/2.32.3" 2026-10-09T13:30:55.340759-07:00 edge-fr-1 nginx[1201]: 172.137.147.156 - - "GET /health HTTP/1.1" 404 46803 "-" "python-requests/2.32.3" 2026-10-09T13:30:55.603142-07:00 worker-12 haproxy[906]: 172.29.250.51:57658 [12272] http-in app/web-03 9617/0/286/286/9617 404 8233 - - ---- 538/538/52/52/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:55.737148-07:00 api-08 haproxy[909]: 172.212.145.206:16382 [16025] http-in app/api-08 6201/0/688/688/6201 200 67638 - - ---- 544/544/77/77/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:30:55.779552-07:00 bastion nginx[1204]: 45.71.70.144 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 59363 "-" "Go-http-client/1.1" 2026-10-09T13:30:55.838450-07:00 api-08 app[30755]: INFO worker 89 finished job 7e6b8b9aee4098c0 in 4749 ms 2026-10-09T13:30:55.849238-07:00 edge-fr-1 sshd[43639]: Invalid user backup from 172.182.126.96 port 34631 2026-10-09T13:30:55.949309-07:00 bastion kernel: [11899.477022] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.34.184.201 DST=10.0.914.914 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=11899 DF PROTO=TCP SPT=25051 DPT=25051 WINDOW=11899 RES=0x00 SYN URGP=0 2026-10-09T13:30:56.044756-07:00 web-03 app[30642]: INFO request_id=173c59e202fa7ec7 method=GET path=/api/v2/users status=200 duration=315ms 2026-10-09T13:30:56.071503-07:00 web-02 sshd[59264]: Connection closed by 203.250.42.171 port 21259 [preauth] 2026-10-09T13:30:56.167181-07:00 web-01 nginx[1210]: 203.86.79.191 - - "GET /admin HTTP/1.1" 200 51169 "-" "curl/8.4.0" 2026-10-09T13:30:56.176844-07:00 web-02 haproxy[900]: 172.137.15.223:59716 [97785] http-in app/web-02 6479/0/102/102/6479 302 88119 - - ---- 466/466/19/19/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:30:56.207171-07:00 web-02 sshd[4109]: Failed password for invalid user müller from 203.75.201.67 port 25756 ssh2 2026-10-09T13:30:56.255562-07:00 web-01 app[30648]: INFO worker 74 finished job 6972cd1858845be7 in 9233 ms 2026-10-09T13:30:56.269693-07:00 web-03 sshd[2235]: pam_unix(sshd:session): session opened for user ci(uid=8755) by (uid=0) 2026-10-09T13:30:56.832760-07:00 web-02 sshd[41048]: pam_unix(sshd:session): session opened for user akira(uid=3797) by (uid=0) 2026-10-09T13:30:56.931016-07:00 cache-3 haproxy[915]: 45.217.128.40:7736 [13183] http-in app/db-replica 9657/0/78/78/9657 302 81526 - - ---- 492/492/24/24/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:30:56.936964-07:00 api-08 haproxy[939]: 10.86.172.84:64028 [68344] http-in app/worker-12 6745/0/530/530/6745 404 64457 - - ---- 129/129/87/87/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:30:57.417582-07:00 web-02 sshd[19012]: Invalid user sørensen from 203.5.34.123 port 49556 2026-10-09T13:30:58.010106-07:00 worker-12 nginx[1210]: 192.98.0.13 - - "GET /static/main.css HTTP/1.1" 502 58155 "-" "python-requests/2.32.3" 2026-10-09T13:30:58.015329-07:00 web-02 nginx[1207]: 172.181.10.193 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 20756 "-" "curl/8.4.0" 2026-10-09T13:30:58.073588-07:00 web-02 haproxy[936]: 192.151.190.101:33204 [89133] http-in app/db-replica 5315/0/591/591/5315 500 32447 - - ---- 314/314/66/66/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:30:58.174272-07:00 db-primary app[30593]: INFO worker 35 picked job 76ab176efe82cfd0 from queue invoices 2026-10-09T13:30:58.296422-07:00 web-03 postgres[28385]: LOG: duration: 9235.226 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:30:58.343332-07:00 db-primary systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:30:58.362905-07:00 edge-fr-1 sshd[15177]: Received disconnect from 172.55.253.243 port 11573:11: Bye Bye [preauth] 2026-10-09T13:30:58.443244-07:00 bastion haproxy[902]: 45.127.84.198:21990 [25001] http-in app/db-primary 2958/0/468/468/2958 401 52936 - - ---- 540/540/74/74/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:30:58.590364-07:00 db-replica haproxy[931]: 192.18.74.3:6728 [68699] http-in app/db-replica 3387/0/245/245/3387 200 76946 - - ---- 115/115/22/22/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:30:58.752917-07:00 cache-3 sudo: root : TTY=pts/0 ; PWD=/home/root ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:30:58.943841-07:00 web-03 sshd[2481]: Received disconnect from 192.144.208.73 port 36802:11: Bye Bye [preauth] 2026-10-09T13:30:59.097741-07:00 web-02 sshd[22929]: Failed password for invalid user root from 172.88.104.26 port 1501 ssh2 2026-10-09T13:30:59.109341-07:00 bastion nginx[1207]: 192.158.206.172 - - "GET /metrics HTTP/1.1" 200 10225 "-" "python-requests/2.32.3" 2026-10-09T13:30:59.142148-07:00 api-07 systemd[1]: session-57548.scope: Deactivated successfully. 2026-10-09T13:30:59.169566-07:00 web-01 nginx[1201]: 172.92.218.203 - ci "POST /api/v2/orders/8841 HTTP/1.1" 404 2156 "-" "python-requests/2.32.3" 2026-10-09T13:30:59.607542-07:00 bastion postgres[25467]: LOG: duration: 6453.35 ms statement: SELECT * FROM orders WHERE customer_id = 58697 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:59.777662-07:00 worker-12 kernel: [44405.817029] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.116.108.182 DST=10.0.302.302 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=44405 DF PROTO=TCP SPT=58744 DPT=58744 WINDOW=44405 RES=0x00 SYN URGP=0 2026-10-09T13:30:59.789575-07:00 web-03 postgres[14425]: LOG: duration: 621.562 ms statement: SELECT * FROM orders WHERE customer_id = 65818 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:30:59.863155-07:00 api-08 nginx[1204]: 91.90.177.210 - - "GET /metrics HTTP/1.1" 200 51514 "-" "Go-http-client/1.1" 2026-10-09T13:30:59.898966-07:00 api-07 app[30180]: INFO request_id=e0547189f65e4070 method=GET path=/api/v2/users status=301 duration=6853ms 2026-10-09T13:30:59.960151-07:00 api-08 app[30884]: INFO order 85474 confirmed for françois in 6615 ms (region eu-west-1, queue orders) 2026-10-09T13:31:00.233356-07:00 worker-12 app[30315]: INFO request_id=e31616a2edc4c307 method=GET path=/metrics status=301 duration=7832ms 2026-10-09T13:31:00.346364-07:00 db-replica app[30987]: INFO worker 95 picked job ebf41009e4e0e92b from queue invoices 2026-10-09T13:31:00.396998-07:00 web-03 nginx[1207]: 91.157.218.103 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 49212 "-" "kube-probe/1.31" 2026-10-09T13:31:00.585798-07:00 bastion nginx[1205]: 10.161.46.202 - - "GET /metrics HTTP/1.1" 204 78410 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:00.644540-07:00 web-01 sshd[63599]: Invalid user backup from 91.120.44.28 port 33346 2026-10-09T13:31:00.659453-07:00 api-07 cron[36182]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:31:00.715040-07:00 web-01 app[30120]: INFO worker 99 finished job 58c67a07437e9243 in 5610 ms 2026-10-09T13:31:00.817990-07:00 worker-12 sshd[30701]: Connection closed by 91.197.16.17 port 45956 [preauth] 2026-10-09T13:31:01.070721-07:00 bastion app[30339]: INFO worker 48 finished job f7280d69f602fc1e in 5875 ms 2026-10-09T13:31:01.416056-07:00 worker-12 haproxy[928]: 10.158.179.156:20454 [20269] http-in app/edge-fr-1 9505/0/145/145/9505 404 2695 - - ---- 158/158/79/79/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:31:01.643805-07:00 edge-fr-1 nginx[1205]: 192.128.82.43 - - "GET /api/v2/orders HTTP/1.1" 200 5521 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:01.678347-07:00 web-03 app[30346]: INFO request_id=f217643cb5329f85 method=GET path=/api/v2/orders status=200 duration=8149ms 2026-10-09T13:31:01.701358-07:00 web-01 haproxy[919]: 91.99.238.13:19973 [36600] http-in app/db-replica 1706/0/346/346/1706 204 35045 - - ---- 954/954/85/85/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:01.723667-07:00 api-07 nginx[1210]: 10.145.77.166 - root "POST /wp-login.php HTTP/1.1" 301 79405 "-" "curl/8.4.0" 2026-10-09T13:31:01.886555-07:00 worker-12 sshd[51337]: Connection closed by 45.141.89.148 port 33555 [preauth] 2026-10-09T13:31:02.307840-07:00 worker-12 systemd[1]: session-89465.scope: Deactivated successfully. 2026-10-09T13:31:02.404432-07:00 db-primary app[30862]: INFO request_id=b3622d61000fa60d method=GET path=/wp-login.php status=502 duration=2791ms 2026-10-09T13:31:02.446319-07:00 worker-12 haproxy[943]: 192.217.122.151:6178 [95835] http-in app/db-primary 8001/0/467/467/8001 500 35794 - - ---- 348/348/73/73/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:31:02.476504-07:00 db-primary app[30268]: ERROR payment declined for order 33838: card_declined (code 42), customer notified 2026-10-09T13:31:03.040026-07:00 cache-3 nginx[1205]: 10.110.163.191 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 36107 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:03.458177-07:00 api-08 app[30267]: INFO health check ok: db 496 ms, cache 496 ms, queue depth 77 2026-10-09T13:31:03.535362-07:00 web-02 app[30742]: WARN slow query (7029 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '22 minutes' 2026-10-09T13:31:03.640133-07:00 db-replica nginx[1202]: 192.139.26.144 - deploy "POST /api/v2/search?q=invoice HTTP/1.1" 301 64733 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:03.680490-07:00 bastion sshd[47238]: Invalid user root from 10.52.162.46 port 53742 2026-10-09T13:31:03.693397-07:00 web-02 nginx[1210]: 45.148.6.118 - priya "POST /metrics HTTP/1.1" 200 74898 "-" "curl/8.4.0" 2026-10-09T13:31:03.941859-07:00 db-replica nginx[1201]: 91.102.11.146 - - "GET /wp-login.php HTTP/1.1" 204 81288 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:04.074783-07:00 bastion app[30294]: INFO request_id=6989aa1ae4d24793 method=GET path=/static/main.css status=200 duration=453ms 2026-10-09T13:31:04.460148-07:00 web-03 sshd[5673]: Invalid user priya from 45.107.212.153 port 21336 2026-10-09T13:31:04.498024-07:00 api-07 haproxy[950]: 91.196.221.126:48741 [77548] http-in app/edge-fr-1 2897/0/597/597/2897 204 76421 - - ---- 581/581/10/10/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:31:04.585984-07:00 bastion haproxy[938]: 45.245.198.180:31697 [11358] http-in app/web-01 2695/0/731/731/2695 200 35252 - - ---- 360/360/34/34/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:31:04.684233-07:00 edge-fr-1 systemd[1]: Started Session 57658 of User müller. 2026-10-09T13:31:04.727391-07:00 cache-3 app[30277]: INFO order 90808 confirmed for françois in 2961 ms (region us-east-1, queue emails) 2026-10-09T13:31:04.902649-07:00 worker-12 sshd[38520]: Accepted publickey for zoë from 91.71.115.177 port 23574 ssh2: ED25519 SHA256:cd13a4450885e4ba 2026-10-09T13:31:05.079277-07:00 db-replica nginx[1202]: 10.252.66.135 - ci "POST /api/v2/search?q=invoice HTTP/1.1" 200 3424 "-" "kube-probe/1.31" 2026-10-09T13:31:05.506995-07:00 worker-12 postgres[10010]: LOG: checkpoint complete: wrote 7029 buffers (44%); 0 WAL file(s) added, 0 removed, 28 recycled; write=1809.194 s, sync=0.194 s, total=1809.194 s 2026-10-09T13:31:05.564224-07:00 bastion nginx[1202]: 91.31.170.171 - - "GET /static/app.js HTTP/1.1" 200 62469 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:05.592940-07:00 db-primary app[30570]: INFO worker 63 finished job b44df3ec8b2c07ee in 4687 ms 2026-10-09T13:31:06.113921-07:00 web-03 systemd[1]: Started Session 43101 of User sørensen. 2026-10-09T13:31:06.133424-07:00 api-07 nginx[1200]: 91.244.194.49 - müller "POST /login HTTP/1.1" 301 75069 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:06.298282-07:00 api-07 app[30818]: WARN slow query (8367 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '62 minutes' 2026-10-09T13:31:06.364285-07:00 web-02 app[30778]: INFO request_id=b22b2b5fe1d0910b method=GET path=/static/main.css status=200 duration=8150ms 2026-10-09T13:31:06.374895-07:00 web-02 postgres[2714]: LOG: duration: 9941.206 ms statement: SELECT * FROM orders WHERE customer_id = 79104 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:06.409107-07:00 bastion cron[35583]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:31:06.459960-07:00 edge-fr-1 sshd[32269]: Accepted publickey for root from 172.229.155.77 port 15517 ssh2: ED25519 SHA256:c9e4ca8984b29c79 2026-10-09T13:31:06.480963-07:00 db-replica app[30950]: INFO request_id=8950dbd7afa16fe3 method=GET path=/api/v2/orders status=204 duration=9072ms 2026-10-09T13:31:06.646237-07:00 api-08 app[30947]: INFO request_id=0e8b68cb798ed1a5 method=GET path=/api/v2/users status=401 duration=4082ms 2026-10-09T13:31:06.763290-07:00 api-08 nginx[1206]: 203.184.179.170 - - "GET /static/app.js HTTP/1.1" 200 69314 "-" "kube-probe/1.31" 2026-10-09T13:31:06.842337-07:00 web-03 nginx[1209]: 172.184.84.128 - ci "POST /health HTTP/1.1" 404 34009 "-" "python-requests/2.32.3" 2026-10-09T13:31:07.108012-07:00 web-01 nginx[1210]: 203.124.139.22 - - "GET /static/main.css HTTP/1.1" 200 59548 "-" "kube-probe/1.31" 2026-10-09T13:31:07.211733-07:00 api-08 sshd[46972]: Failed password for invalid user backup from 10.141.40.76 port 60686 ssh2 2026-10-09T13:31:07.230125-07:00 api-08 sshd[3805]: Received disconnect from 192.152.186.211 port 5224:11: Bye Bye [preauth] 2026-10-09T13:31:07.339884-07:00 web-02 cron[51639]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:31:07.362431-07:00 db-primary app[30282]: WARN slow query (8429 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '30 minutes' 2026-10-09T13:31:07.514984-07:00 api-08 postgres[30031]: LOG: duration: 4132.603 ms statement: SELECT * FROM orders WHERE customer_id = 98363 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:07.521637-07:00 db-primary nginx[1206]: 192.6.19.45 - - "GET /wp-login.php HTTP/1.1" 401 22873 "-" "kube-probe/1.31" 2026-10-09T13:31:07.793589-07:00 worker-12 postgres[27471]: LOG: duration: 1878.640 ms statement: SELECT * FROM orders WHERE customer_id = 87711 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:07.811761-07:00 web-03 app[30833]: INFO request_id=e18a4a360c563dca method=GET path=/admin status=204 duration=9851ms 2026-10-09T13:31:07.832639-07:00 db-replica nginx[1208]: 45.120.183.107 - - "GET /login HTTP/1.1" 301 76333 "-" "python-requests/2.32.3" 2026-10-09T13:31:07.989296-07:00 db-replica haproxy[937]: 203.162.37.130:27454 [97363] http-in app/edge-fr-1 6215/0/288/288/6215 502 33762 - - ---- 634/634/84/84/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:31:08.039934-07:00 api-08 app[30297]: INFO worker 33 picked job 0b91365792572d5a from queue webhooks 2026-10-09T13:31:08.182411-07:00 web-02 app[30280]: INFO request_id=2d76386e2dfae45a method=GET path=/.env status=302 duration=5864ms 2026-10-09T13:31:08.242421-07:00 cache-3 sshd[52755]: Accepted publickey for akira from 91.79.141.85 port 21935 ssh2: ED25519 SHA256:a2a0ee71bd529aec 2026-10-09T13:31:08.299361-07:00 edge-fr-1 sshd[5328]: Accepted publickey for root from 172.66.113.235 port 17885 ssh2: ED25519 SHA256:8f3073d40839eb2a 2026-10-09T13:31:08.334181-07:00 web-02 sshd[37904]: Received disconnect from 172.174.214.195 port 20802:11: Bye Bye [preauth] 2026-10-09T13:31:08.431562-07:00 api-08 postgres[8458]: LOG: duration: 1365.778 ms statement: SELECT * FROM orders WHERE customer_id = 45071 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:08.444111-07:00 api-08 nginx[1200]: 10.19.217.14 - - "GET /.env HTTP/1.1" 404 20523 "-" "Go-http-client/1.1" 2026-10-09T13:31:08.727527-07:00 web-01 dockerd[700]: time="2026-10-09T13:31:08.727527-07:00" level=info msg="Container c6ff96afa70f4203 exited with code 0" 2026-10-09T13:31:08.778110-07:00 bastion sshd[32328]: pam_unix(sshd:session): session opened for user ci(uid=2708) by (uid=0) 2026-10-09T13:31:08.846471-07:00 bastion app[30769]: INFO worker 54 picked job 5380742d4f18719c from queue webhooks 2026-10-09T13:31:09.032639-07:00 db-primary systemd[1]: Started Session 44742 of User priya. 2026-10-09T13:31:09.472127-07:00 api-08 kernel: [51781.572216] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.20.143.109 DST=10.0.543.543 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=51781 DF PROTO=TCP SPT=34614 DPT=34614 WINDOW=51781 RES=0x00 SYN URGP=0 2026-10-09T13:31:09.626101-07:00 worker-12 nginx[1210]: 91.165.136.43 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 37627 "-" "python-requests/2.32.3" 2026-10-09T13:31:09.667296-07:00 api-08 sshd[30408]: pam_unix(sshd:session): session opened for user backup(uid=6805) by (uid=0) 2026-10-09T13:31:09.889161-07:00 db-primary app[30772]: INFO health check ok: db 586 ms, cache 586 ms, queue depth 99 2026-10-09T13:31:09.927512-07:00 cache-3 app[30957]: INFO request_id=ddbde08902f6f7c2 method=GET path=/static/main.css status=404 duration=3431ms 2026-10-09T13:31:09.953481-07:00 db-primary postgres[14466]: LOG: duration: 7552.819 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:09.977421-07:00 api-07 sshd[17672]: Invalid user akira from 45.144.37.15 port 32323 2026-10-09T13:31:10.129247-07:00 db-primary postgres[19039]: LOG: duration: 5231.348 ms statement: SELECT * FROM orders WHERE customer_id = 96781 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:10.130953-07:00 web-01 app[30969]: DEBUG cache hit ratio 98% over the last minute (57171 lookups) 2026-10-09T13:31:10.134394-07:00 web-03 postgres[21602]: LOG: duration: 3618.292 ms statement: SELECT * FROM orders WHERE customer_id = 73593 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:10.165946-07:00 worker-12 app[30924]: INFO request_id=7677b50e11061be7 method=GET path=/wp-login.php status=500 duration=1738ms 2026-10-09T13:31:10.193652-07:00 worker-12 postgres[4869]: LOG: duration: 9906.761 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:10.469426-07:00 db-replica app[30242]: INFO worker 18 picked job 675efe5c534cc630 from queue invoices 2026-10-09T13:31:10.487368-07:00 edge-fr-1 nginx[1210]: 45.60.41.63 - backup "POST /api/v2/users HTTP/1.1" 200 58007 "-" "python-requests/2.32.3" 2026-10-09T13:31:10.889315-07:00 edge-fr-1 nginx[1203]: 172.226.193.206 - - "GET /health HTTP/1.1" 200 82621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:11.011769-07:00 db-primary nginx[1207]: 45.211.183.218 - - "GET /favicon.ico HTTP/1.1" 502 30282 "-" "curl/8.4.0" 2026-10-09T13:31:11.158742-07:00 web-03 nginx[1201]: 10.193.143.201 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 12038 "-" "kube-probe/1.31" 2026-10-09T13:31:11.287167-07:00 edge-fr-1 app[30292]: INFO health check ok: db 18 ms, cache 18 ms, queue depth 79 2026-10-09T13:31:11.457880-07:00 cache-3 nginx[1200]: 45.220.112.99 - - "GET /.env HTTP/1.1" 200 29661 "-" "kube-probe/1.31" 2026-10-09T13:31:11.461277-07:00 api-07 app[30916]: INFO order 44267 confirmed for ci in 2845 ms (region us-east-1, queue orders) 2026-10-09T13:31:11.667788-07:00 api-08 nginx[1207]: 192.183.34.242 - - "GET /static/main.css HTTP/1.1" 404 79191 "-" "kube-probe/1.31" 2026-10-09T13:31:11.724027-07:00 api-07 app[30621]: INFO worker 97 finished job 7a6fe18e810f8e34 in 660 ms 2026-10-09T13:31:11.769771-07:00 cache-3 nginx[1200]: 91.160.221.43 - - "GET /wp-login.php HTTP/1.1" 301 62382 "-" "python-requests/2.32.3" 2026-10-09T13:31:11.801043-07:00 edge-fr-1 app[30411]: INFO request_id=cee29ebf3bf04d1e method=GET path=/static/app.js status=301 duration=302ms 2026-10-09T13:31:11.897900-07:00 edge-fr-1 app[30196]: INFO health check ok: db 237 ms, cache 237 ms, queue depth 50 2026-10-09T13:31:12.137961-07:00 web-01 nginx[1208]: 10.199.48.95 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 85568 "-" "Go-http-client/1.1" 2026-10-09T13:31:12.220867-07:00 cache-3 sshd[23825]: Invalid user sørensen from 203.67.248.199 port 14977 2026-10-09T13:31:12.257144-07:00 web-02 postgres[20666]: LOG: duration: 3443.754 ms statement: SELECT * FROM orders WHERE customer_id = 85515 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:12.257544-07:00 web-03 app[30719]: INFO order 23379 confirmed for ci in 7598 ms (region us-east-1, queue webhooks) 2026-10-09T13:31:12.279204-07:00 db-replica nginx[1207]: 10.241.72.196 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 15181 "-" "kube-probe/1.31" 2026-10-09T13:31:12.331420-07:00 db-replica systemd[1]: Started Session 72285 of User backup. 2026-10-09T13:31:12.456994-07:00 web-01 sshd[57190]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:31:12.494660-07:00 db-replica app[30051]: INFO request_id=969a5246b03c209e method=GET path=/admin status=200 duration=4258ms 2026-10-09T13:31:12.552480-07:00 edge-fr-1 app[30625]: INFO request_id=8fe699169a8bca30 method=GET path=/admin status=401 duration=5538ms 2026-10-09T13:31:12.559739-07:00 web-01 nginx[1209]: 203.220.152.44 - ci "POST /static/main.css HTTP/1.1" 401 59782 "-" "Go-http-client/1.1" 2026-10-09T13:31:12.597738-07:00 web-02 sshd[37338]: Received disconnect from 45.139.245.215 port 28139:11: Bye Bye [preauth] 2026-10-09T13:31:12.660569-07:00 bastion app[30217]: INFO order 63745 confirmed for root in 1998 ms (region us-east-1, queue orders) 2026-10-09T13:31:12.985242-07:00 web-02 app[30056]: INFO request_id=28d110a12c4a9498 method=GET path=/health status=200 duration=9327ms 2026-10-09T13:31:13.145802-07:00 cache-3 sshd[19466]: Failed password for invalid user root from 192.201.110.104 port 2733 ssh2 2026-10-09T13:31:13.339024-07:00 web-02 app[30140]: INFO health check ok: db 328 ms, cache 328 ms, queue depth 61 2026-10-09T13:31:13.374970-07:00 cache-3 app[30603]: INFO worker 13 picked job 6f4851089d68dc0f from queue orders 2026-10-09T13:31:13.385122-07:00 cache-3 nginx[1207]: 203.189.112.54 - - "GET /static/main.css HTTP/1.1" 200 68090 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:13.478577-07:00 worker-12 systemd[1]: Started Session 97815 of User zoë. 2026-10-09T13:31:13.766086-07:00 db-primary app[30468]: INFO worker 24 finished job 317b1901af65ff34 in 6005 ms 2026-10-09T13:31:13.794326-07:00 api-07 haproxy[934]: 45.169.50.152:10055 [60421] http-in app/api-07 2629/0/36/36/2629 200 7463 - - ---- 643/643/99/99/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:31:13.883801-07:00 cache-3 nginx[1209]: 91.204.19.51 - - "GET /.env HTTP/1.1" 200 17569 "-" "Go-http-client/1.1" 2026-10-09T13:31:14.031702-07:00 worker-12 postgres[17233]: LOG: duration: 1483.716 ms statement: SELECT * FROM orders WHERE customer_id = 49034 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:14.327277-07:00 edge-fr-1 haproxy[916]: 91.139.172.97:34937 [15960] http-in app/api-08 1635/0/601/601/1635 404 65558 - - ---- 473/473/73/73/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:31:14.355057-07:00 api-07 app[30224]: INFO order 24194 confirmed for ci in 1494 ms (region us-east-1, queue emails) 2026-10-09T13:31:14.456961-07:00 db-primary nginx[1210]: 45.108.242.235 - - "GET /static/app.js HTTP/1.1" 500 7958 "-" "kube-probe/1.31" 2026-10-09T13:31:14.615459-07:00 edge-fr-1 app[30286]: INFO request_id=b58d6c5b703cbbf3 method=GET path=/.env status=204 duration=4364ms 2026-10-09T13:31:14.670398-07:00 api-07 sshd[51709]: Accepted publickey for backup from 192.165.33.137 port 30085 ssh2: ED25519 SHA256:7c5b75b2d7ed24ec 2026-10-09T13:31:14.718771-07:00 api-08 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.59.58.31, server: app.example.com, request: "GET /wp-login.php HTTP/1.1", upstream: "http://10.0.287.287:8080/wp-login.php" 2026-10-09T13:31:14.858967-07:00 edge-fr-1 app[30436]: INFO health check ok: db 560 ms, cache 560 ms, queue depth 16 2026-10-09T13:31:14.969129-07:00 web-03 sshd[45943]: Received disconnect from 45.218.189.36 port 18839:11: Bye Bye [preauth] 2026-10-09T13:31:15.188296-07:00 web-01 sshd[25817]: Failed password for invalid user ci from 172.77.20.61 port 20512 ssh2 2026-10-09T13:31:15.246092-07:00 web-03 sshd[56010]: Failed password for invalid user ci from 45.145.121.249 port 25544 ssh2 2026-10-09T13:31:15.269527-07:00 web-02 nginx[1208]: 91.252.138.248 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 46188 "-" "curl/8.4.0" 2026-10-09T13:31:15.902825-07:00 db-primary app[30133]: INFO request_id=46e199199a209cb5 method=GET path=/metrics status=204 duration=4375ms 2026-10-09T13:31:15.991613-07:00 web-03 app[30970]: DEBUG cache hit ratio 38% over the last minute (56548 lookups) 2026-10-09T13:31:16.004022-07:00 edge-fr-1 app[30729]: INFO request_id=a81a114b04d29816 method=GET path=/api/v2/orders/8841 status=502 duration=5150ms 2026-10-09T13:31:16.146961-07:00 worker-12 sshd[4137]: Connection closed by 192.238.105.42 port 46068 [preauth] 2026-10-09T13:31:16.214356-07:00 db-replica sshd[37762]: Failed password for invalid user root from 91.152.239.111 port 33102 ssh2 2026-10-09T13:31:16.276645-07:00 edge-fr-1 app[30647]: INFO health check ok: db 226 ms, cache 226 ms, queue depth 86 2026-10-09T13:31:16.310580-07:00 worker-12 sshd[29520]: Received disconnect from 10.88.228.177 port 41759:11: Bye Bye [preauth] 2026-10-09T13:31:16.684998-07:00 edge-fr-1 haproxy[938]: 91.179.66.88:37631 [59920] http-in app/bastion 4156/0/159/159/4156 302 6033 - - ---- 435/435/66/66/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:31:16.697055-07:00 web-03 sshd[2659]: Connection closed by 172.34.14.72 port 33848 [preauth] 2026-10-09T13:31:16.838183-07:00 cache-3 nginx[1206]: 203.34.213.166 - - "GET /api/v2/users HTTP/1.1" 302 18786 "-" "curl/8.4.0" 2026-10-09T13:31:16.899832-07:00 web-03 postgres[10317]: LOG: duration: 4138.842 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:17.065987-07:00 web-02 app[30435]: INFO worker 68 picked job e92b135f6320d34d from queue webhooks 2026-10-09T13:31:17.209597-07:00 edge-fr-1 nginx[1209]: 203.53.178.29 - - "GET /favicon.ico HTTP/1.1" 200 82132 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:17.250556-07:00 bastion haproxy[917]: 192.61.11.121:39956 [76954] http-in app/edge-fr-1 8223/0/222/222/8223 404 37262 - - ---- 700/700/97/97/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:31:17.390917-07:00 edge-fr-1 haproxy[949]: 203.203.192.148:14025 [30138] http-in app/cache-3 5830/0/446/446/5830 200 88877 - - ---- 815/815/73/73/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:31:17.492940-07:00 db-replica postgres[31584]: LOG: duration: 1729.365 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:17.552716-07:00 web-02 kernel: [21600.201986] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.222.91.23 DST=10.0.142.142 LEN=19 TOS=0x00 PREC=0x00 TTL=19 ID=21600 DF PROTO=TCP SPT=55662 DPT=55662 WINDOW=21600 RES=0x00 SYN URGP=0 2026-10-09T13:31:17.683102-07:00 cache-3 nginx[1209]: 172.78.168.132 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 77282 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:17.770484-07:00 db-replica nginx[1210]: 45.104.62.11 - - "GET /health HTTP/1.1" 200 40734 "-" "curl/8.4.0" 2026-10-09T13:31:18.000658-07:00 db-replica postgres[6269]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 96037 remain, 6030 scanned (28% of total) 2026-10-09T13:31:18.008386-07:00 api-07 app[30109]: INFO order 99555 confirmed for sørensen in 2547 ms (region eu-west-1, queue webhooks) 2026-10-09T13:31:18.036644-07:00 cache-3 nginx[1208]: 172.137.213.229 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 40744 "-" "curl/8.4.0" 2026-10-09T13:31:18.072689-07:00 web-02 postgres[19597]: LOG: duration: 706.80 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:18.232826-07:00 worker-12 nginx[1208]: 203.111.208.111 - - "GET /api/v2/users HTTP/1.1" 301 34323 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:18.378946-07:00 bastion app[30007]: INFO worker 26 picked job eec46bb7365410be from queue emails 2026-10-09T13:31:18.449778-07:00 edge-fr-1 nginx[1205]: 91.196.218.152 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 50911 "-" "kube-probe/1.31" 2026-10-09T13:31:18.497035-07:00 bastion app[30987]: INFO request_id=c4885ab48ea03281 method=GET path=/wp-login.php status=200 duration=6587ms 2026-10-09T13:31:18.597655-07:00 db-replica nginx[1207]: 45.99.201.202 - - "GET /api/v2/users HTTP/1.1" 200 37573 "-" "python-requests/2.32.3" 2026-10-09T13:31:18.770432-07:00 api-08 app[30328]: DEBUG cache hit ratio 53% over the last minute (90945 lookups) 2026-10-09T13:31:19.091470-07:00 db-replica sshd[17095]: Accepted publickey for ci from 203.131.78.109 port 11798 ssh2: ED25519 SHA256:a5a6e482f69aa83f 2026-10-09T13:31:19.093593-07:00 cache-3 app[30938]: INFO request_id=eca257b19a341eaa method=GET path=/api/v2/orders/8841 status=404 duration=6234ms 2026-10-09T13:31:19.103507-07:00 api-08 app[30653]: INFO health check ok: db 930 ms, cache 930 ms, queue depth 55 2026-10-09T13:31:19.129285-07:00 web-03 nginx[1210]: 203.212.141.227 - sørensen "POST /api/v2/orders HTTP/1.1" 500 50877 "-" "Go-http-client/1.1" 2026-10-09T13:31:19.138406-07:00 api-07 app[30098]: INFO worker 50 finished job 211dcd472bbdbd4a in 8339 ms 2026-10-09T13:31:19.363189-07:00 api-08 sshd[11412]: Failed password for invalid user priya from 192.252.225.146 port 39696 ssh2 2026-10-09T13:31:19.449427-07:00 api-08 sshd[44939]: Accepted publickey for müller from 91.149.52.108 port 6630 ssh2: ED25519 SHA256:d1e9cb75526ce509 2026-10-09T13:31:19.725258-07:00 worker-12 kernel: [54272.070989] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.178.101.227 DST=10.0.438.438 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=54272 DF PROTO=TCP SPT=8394 DPT=8394 WINDOW=54272 RES=0x00 SYN URGP=0 2026-10-09T13:31:19.737076-07:00 web-01 sshd[62787]: Received disconnect from 192.107.10.60 port 51863:11: Bye Bye [preauth] 2026-10-09T13:31:20.092957-07:00 bastion app[30896]: INFO worker 36 picked job 2fd0e7a1e44a51cd from queue emails 2026-10-09T13:31:20.501379-07:00 db-primary app[30572]: INFO request_id=f3bfc572edc0b2f9 method=GET path=/api/v2/users status=200 duration=7748ms 2026-10-09T13:31:20.503402-07:00 cache-3 postgres[27425]: LOG: duration: 9486.876 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:20.729646-07:00 bastion audit: type=USER_LOGIN msg=audit(1791577880.976:50881): pid=50881 uid=0 auid=2463 ses=279 msg='op=login id=2463 exe="/usr/sbin/sshd" hostname=? addr=91.228.61.149 terminal=/dev/pts/0 res=success' 2026-10-09T13:31:20.744513-07:00 bastion nginx[1206]: 172.90.245.233 - - "GET /api/v2/users HTTP/1.1" 301 30960 "-" "python-requests/2.32.3" 2026-10-09T13:31:20.750497-07:00 db-primary app[30377]: INFO order 75413 confirmed for françois in 7945 ms (region us-east-1, queue orders) 2026-10-09T13:31:20.824835-07:00 bastion nginx[1205]: 192.23.121.106 - - "GET /static/app.js HTTP/1.1" 500 37366 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:21.028204-07:00 web-03 app[30370]: INFO worker 90 finished job a7d745ad3fbd23b6 in 2247 ms 2026-10-09T13:31:21.086363-07:00 db-replica app[30652]: INFO order 31441 confirmed for müller in 5789 ms (region eu-west-1, queue invoices) 2026-10-09T13:31:21.116399-07:00 cache-3 app[30841]: DEBUG cache hit ratio 18% over the last minute (10259 lookups) 2026-10-09T13:31:21.235111-07:00 web-01 app[30841]: INFO health check ok: db 54 ms, cache 54 ms, queue depth 53 2026-10-09T13:31:21.254171-07:00 web-01 nginx[1202]: 45.24.133.139 - - "GET /favicon.ico HTTP/1.1" 200 35848 "-" "kube-probe/1.31" 2026-10-09T13:31:21.449108-07:00 db-primary sshd[56039]: Invalid user backup from 192.219.216.112 port 33754 2026-10-09T13:31:21.867590-07:00 bastion systemd[1]: Started Session 60733 of User priya. 2026-10-09T13:31:22.054145-07:00 edge-fr-1 nginx[1202]: 192.75.23.229 - deploy "POST /wp-login.php HTTP/1.1" 204 86241 "-" "Go-http-client/1.1" 2026-10-09T13:31:22.264075-07:00 api-07 nginx[1203]: 203.153.155.97 - - "GET /health HTTP/1.1" 302 20213 "-" "python-requests/2.32.3" 2026-10-09T13:31:22.284471-07:00 db-primary app[30555]: INFO worker 56 picked job 19ae39995bc09a4a from queue emails 2026-10-09T13:31:22.502948-07:00 worker-12 nginx[1201]: 192.198.79.9 - zoë "POST /static/app.js HTTP/1.1" 200 11569 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:22.852159-07:00 edge-fr-1 cron[978]: (ci) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:31:22.900179-07:00 db-replica app[30626]: INFO worker 28 finished job b199b2f6123dfc06 in 4543 ms 2026-10-09T13:31:23.106109-07:00 worker-12 app[30149]: INFO order 16645 confirmed for root in 554 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:31:23.216406-07:00 cache-3 postgres[12958]: LOG: duration: 1444.820 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:23.320100-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791577883.712:74564): pid=74564 uid=0 auid=7459 ses=281 msg='op=login id=7459 exe="/usr/sbin/sshd" hostname=? addr=45.190.90.6 terminal=/dev/pts/0 res=success' 2026-10-09T13:31:23.382008-07:00 web-02 systemd[1]: Started Session 86236 of User deploy. 2026-10-09T13:31:23.589191-07:00 bastion systemd[1]: session-16907.scope: Deactivated successfully. 2026-10-09T13:31:23.623355-07:00 edge-fr-1 app[30496]: INFO request_id=cce1ab8a115cfe06 method=GET path=/static/app.js status=204 duration=2963ms 2026-10-09T13:31:23.790660-07:00 bastion nginx[1207]: 203.230.190.108 - - "GET /health HTTP/1.1" 502 17898 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:23.949083-07:00 web-03 app[30302]: INFO worker 87 picked job 9a6fc2028d984277 from queue orders 2026-10-09T13:31:24.020558-07:00 edge-fr-1 haproxy[934]: 10.200.253.54:15089 [47001] http-in app/web-02 8686/0/458/458/8686 404 62757 - - ---- 792/792/80/80/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:24.122509-07:00 bastion app[30964]: INFO worker 85 picked job f06fde9468d3a0a5 from queue emails 2026-10-09T13:31:24.160673-07:00 web-02 sshd[23151]: pam_unix(sshd:session): session opened for user ci(uid=4542) by (uid=0) 2026-10-09T13:31:24.287207-07:00 web-01 nginx[1209]: 172.198.35.89 - - "GET /metrics HTTP/1.1" 404 80963 "-" "curl/8.4.0" 2026-10-09T13:31:24.296280-07:00 api-07 sshd[1794]: Received disconnect from 203.4.185.154 port 44655:11: Bye Bye [preauth] 2026-10-09T13:31:24.324214-07:00 web-03 systemd[1]: Started Session 32170 of User sørensen. 2026-10-09T13:31:24.356905-07:00 api-08 nginx[1200]: 172.128.58.158 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 35010 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:24.464497-07:00 db-replica app[30967]: INFO request_id=a0645c48d8dd5ff8 method=GET path=/api/v2/users status=502 duration=5748ms 2026-10-09T13:31:24.670928-07:00 api-08 haproxy[936]: 172.17.96.229:46027 [18458] http-in app/web-02 3581/0/887/887/3581 200 74994 - - ---- 847/847/30/30/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:25.294624-07:00 web-01 postgres[22914]: LOG: duration: 3190.905 ms statement: SELECT * FROM orders WHERE customer_id = 79502 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:25.349661-07:00 web-01 sshd[47022]: Connection closed by 10.217.228.246 port 31261 [preauth] 2026-10-09T13:31:25.423481-07:00 db-replica app[30761]: INFO worker 16 picked job d6edf119145ed6e7 from queue orders 2026-10-09T13:31:25.588510-07:00 cache-3 app[30944]: INFO request_id=2aa132ff158a597c method=GET path=/api/v2/orders/8841 status=502 duration=7249ms 2026-10-09T13:31:25.844110-07:00 web-02 kernel: [83097.272352] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.250.94.228 DST=10.0.316.316 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=83097 DF PROTO=TCP SPT=51333 DPT=51333 WINDOW=83097 RES=0x00 SYN URGP=0 2026-10-09T13:31:25.933494-07:00 edge-fr-1 nginx[1209]: 203.19.59.172 - - "GET /favicon.ico HTTP/1.1" 301 57804 "-" "curl/8.4.0" 2026-10-09T13:31:26.206968-07:00 db-replica haproxy[902]: 45.147.172.156:54951 [22660] http-in app/api-08 6418/0/554/554/6418 302 6471 - - ---- 243/243/76/76/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:31:26.264995-07:00 web-01 nginx[1208]: 203.107.21.210 - - "GET /static/app.js HTTP/1.1" 200 15540 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:26.301702-07:00 db-primary app[30506]: INFO request_id=65b21339e726dd37 method=GET path=/static/app.js status=401 duration=4889ms 2026-10-09T13:31:26.321607-07:00 api-07 sshd[13722]: Connection closed by 91.57.39.36 port 6747 [preauth] 2026-10-09T13:31:26.497878-07:00 worker-12 sshd[45963]: Connection closed by 91.156.179.147 port 46995 [preauth] 2026-10-09T13:31:26.506317-07:00 edge-fr-1 haproxy[900]: 192.107.127.135:9780 [64805] http-in app/web-02 8657/0/182/182/8657 200 18375 - - ---- 208/208/66/66/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:31:26.511345-07:00 web-01 app[30261]: INFO worker 87 finished job 09c63c15a3f1a29c in 1342 ms 2026-10-09T13:31:26.879855-07:00 db-replica kubelet[800]: I1009 13:31:26.418131 4930 kubelet.go:4930] "Pod is terminating, skipping pod status update" pod="default/api-d99fe65bab5ebade" 2026-10-09T13:31:26.919825-07:00 api-07 nginx[1200]: 172.79.171.91 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 82790 "-" "Go-http-client/1.1" 2026-10-09T13:31:27.162040-07:00 worker-12 sshd[42089]: Accepted publickey for root from 45.26.39.144 port 47292 ssh2: ED25519 SHA256:eb81b9819577f8ec 2026-10-09T13:31:27.227099-07:00 db-replica nginx[1200]: 172.127.111.214 - priya "POST /admin HTTP/1.1" 200 59801 "-" "curl/8.4.0" 2026-10-09T13:31:27.302691-07:00 api-08 app[30798]: INFO request_id=21a5c7a8e7d9014d method=GET path=/favicon.ico status=500 duration=3867ms 2026-10-09T13:31:27.448764-07:00 db-replica nginx[1203]: 192.250.131.136 - - "GET /api/v2/orders HTTP/1.1" 404 48130 "-" "curl/8.4.0" 2026-10-09T13:31:27.491646-07:00 web-01 postgres[23009]: LOG: duration: 9327.606 ms statement: SELECT * FROM orders WHERE customer_id = 48226 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:27.492645-07:00 edge-fr-1 kernel: [87117.566387] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.159.96.21 DST=10.0.826.826 LEN=90 TOS=0x00 PREC=0x00 TTL=90 ID=87117 DF PROTO=TCP SPT=28741 DPT=28741 WINDOW=87117 RES=0x00 SYN URGP=0 2026-10-09T13:31:27.521014-07:00 worker-12 haproxy[916]: 91.251.62.124:41272 [70550] http-in app/db-primary 6843/0/545/545/6843 500 82950 - - ---- 704/704/58/58/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:31:27.547425-07:00 edge-fr-1 systemd[1]: session-91680.scope: Deactivated successfully. 2026-10-09T13:31:27.596382-07:00 db-primary app[30821]: INFO health check ok: db 223 ms, cache 223 ms, queue depth 53 2026-10-09T13:31:27.671602-07:00 cache-3 sshd[15005]: Accepted publickey for zoë from 192.82.97.99 port 15828 ssh2: ED25519 SHA256:9dc5379d5f43fcef 2026-10-09T13:31:27.889302-07:00 worker-12 nginx[1204]: 91.40.233.3 - - "GET /health HTTP/1.1" 204 31703 "-" "curl/8.4.0" 2026-10-09T13:31:27.953818-07:00 web-01 postgres[13061]: LOG: duration: 4071.945 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:27.954995-07:00 edge-fr-1 haproxy[944]: 91.138.58.109:53432 [19757] http-in app/edge-fr-1 5259/0/795/795/5259 204 75347 - - ---- 857/857/39/39/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:31:28.034682-07:00 web-03 app[30639]: INFO worker 21 picked job d0e5c97e2c977ee5 from queue invoices 2026-10-09T13:31:28.035523-07:00 web-02 kubelet[800]: E1009 13:31:28.450570 6696 pod_workers.go:6696] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-0d59f2abde18bc2f" 2026-10-09T13:31:28.096438-07:00 web-01 sshd[53849]: Accepted publickey for françois from 10.82.121.226 port 31038 ssh2: ED25519 SHA256:2bf17e63a3e7f28a 2026-10-09T13:31:28.125492-07:00 web-02 app[30183]: INFO health check ok: db 296 ms, cache 296 ms, queue depth 66 2026-10-09T13:31:28.471174-07:00 db-primary app[30490]: INFO health check ok: db 972 ms, cache 972 ms, queue depth 30 2026-10-09T13:31:28.558587-07:00 worker-12 postgres[29132]: LOG: duration: 741.811 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:28.807028-07:00 cache-3 postgres[2000]: LOG: duration: 3873.433 ms statement: SELECT * FROM orders WHERE customer_id = 59313 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:28.885936-07:00 worker-12 sshd[3990]: Invalid user akira from 10.44.1.78 port 23862 2026-10-09T13:31:29.019656-07:00 web-03 systemd[1]: session-23572.scope: Deactivated successfully. 2026-10-09T13:31:29.119604-07:00 web-02 sshd[55727]: Accepted publickey for zoë from 45.120.239.189 port 25030 ssh2: ED25519 SHA256:1d6ef73963928bc5 2026-10-09T13:31:29.327562-07:00 db-replica dockerd[700]: time="2026-10-09T13:31:29.327562-07:00" level=info msg="Container 6c65dbf65471a393 exited with code 0" 2026-10-09T13:31:29.437564-07:00 bastion haproxy[928]: 172.114.185.206:3536 [59415] http-in app/api-07 3543/0/573/573/3543 200 36087 - - ---- 986/986/83/83/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:31:29.443518-07:00 api-07 kernel: [55222.173821] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.109.172.70 DST=10.0.767.767 LEN=66 TOS=0x00 PREC=0x00 TTL=66 ID=55222 DF PROTO=TCP SPT=62364 DPT=62364 WINDOW=55222 RES=0x00 SYN URGP=0 2026-10-09T13:31:29.482028-07:00 web-01 sshd[53966]: Received disconnect from 192.180.114.204 port 55325:11: Bye Bye [preauth] 2026-10-09T13:31:29.892290-07:00 api-08 sshd[50712]: Connection closed by 91.105.231.127 port 13613 [preauth] 2026-10-09T13:31:30.005007-07:00 web-02 app[30317]: INFO worker 75 finished job b195b77fe2b5177f in 5579 ms 2026-10-09T13:31:30.029978-07:00 edge-fr-1 app[30040]: INFO request_id=7aca6989b2ac8989 method=GET path=/admin status=200 duration=8727ms 2026-10-09T13:31:30.053848-07:00 api-08 app[30688]: INFO worker 11 finished job d3fce8dc7c4f5e3b in 6863 ms 2026-10-09T13:31:30.196162-07:00 web-03 nginx[1206]: 10.20.36.199 - priya "POST /api/v2/orders HTTP/1.1" 200 79077 "-" "kube-probe/1.31" 2026-10-09T13:31:30.270456-07:00 api-08 app[30589]: INFO worker 82 finished job 934657f27b4acadf in 279 ms 2026-10-09T13:31:30.345850-07:00 db-replica app[30285]: INFO worker 22 finished job 9a6f4c0d742348ed in 546 ms 2026-10-09T13:31:30.381717-07:00 worker-12 haproxy[950]: 45.163.215.207:32295 [81268] http-in app/web-01 463/0/621/621/463 301 8139 - - ---- 953/953/74/74/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:31:30.516884-07:00 bastion nginx[1200]: 45.237.204.218 - - "GET /wp-login.php HTTP/1.1" 200 19399 "-" "kube-probe/1.31" 2026-10-09T13:31:30.533472-07:00 bastion app[30488]: INFO worker 28 picked job 33f89bce298d7986 from queue orders 2026-10-09T13:31:30.556805-07:00 db-primary postgres[5040]: LOG: duration: 1054.924 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:30.909345-07:00 cache-3 nginx[1201]: 203.84.4.59 - - "GET /static/app.js HTTP/1.1" 301 63375 "-" "kube-probe/1.31" 2026-10-09T13:31:30.934636-07:00 api-08 nginx[1207]: 91.250.217.120 - - "GET /static/main.css HTTP/1.1" 502 69172 "-" "curl/8.4.0" 2026-10-09T13:31:30.945554-07:00 web-01 app[30951]: INFO request_id=223b0d7dff6a29c3 method=GET path=/login status=500 duration=9052ms 2026-10-09T13:31:30.951662-07:00 bastion app[30495]: INFO request_id=9fa7b95186063fd9 method=GET path=/api/v2/orders status=204 duration=3016ms 2026-10-09T13:31:31.100673-07:00 api-08 app[30660]: DEBUG cache hit ratio 75% over the last minute (77307 lookups) 2026-10-09T13:31:31.144383-07:00 web-01 app[30345]: INFO worker 96 picked job f4f70c8e5625d38d from queue webhooks 2026-10-09T13:31:31.193606-07:00 cache-3 app[30311]: WARN retrying upstream 10.61.92.113:43653 after timeout (610 ms), attempt 1 of 3 2026-10-09T13:31:31.316845-07:00 web-03 nginx[1201]: 45.151.191.37 - - "GET /metrics HTTP/1.1" 200 14139 "-" "curl/8.4.0" 2026-10-09T13:31:31.551748-07:00 db-replica postgres[25127]: LOG: duration: 798.789 ms statement: SELECT * FROM orders WHERE customer_id = 78981 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:31.561706-07:00 db-replica app[30645]: INFO request_id=8fc1208fde834ee5 method=GET path=/api/v2/orders/8841 status=204 duration=7860ms 2026-10-09T13:31:31.569573-07:00 bastion haproxy[927]: 45.250.210.206:45489 [37667] http-in app/db-replica 3053/0/953/953/3053 200 70699 - - ---- 838/838/77/77/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:31:31.679074-07:00 bastion sshd[23619]: Failed password for invalid user backup from 91.208.33.192 port 63271 ssh2 2026-10-09T13:31:31.720116-07:00 web-02 app[30026]: INFO order 53146 confirmed for françois in 6092 ms (region eu-west-1, queue invoices) 2026-10-09T13:31:31.802663-07:00 web-02 postgres[28316]: LOG: duration: 7164.386 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:31.869790-07:00 edge-fr-1 app[30073]: DEBUG cache hit ratio 83% over the last minute (37106 lookups) 2026-10-09T13:31:31.878910-07:00 api-07 nginx[1203]: 192.175.34.94 - - "GET /static/main.css HTTP/1.1" 404 4185 "-" "Go-http-client/1.1" 2026-10-09T13:31:31.908001-07:00 edge-fr-1 app[30200]: INFO worker 33 picked job 8ad6e2c900916747 from queue invoices 2026-10-09T13:31:31.979978-07:00 api-07 app[30011]: INFO worker 67 finished job 910181a7f1768026 in 2999 ms 2026-10-09T13:31:32.253752-07:00 edge-fr-1 app[30777]: INFO health check ok: db 764 ms, cache 764 ms, queue depth 79 2026-10-09T13:31:32.270940-07:00 bastion kernel: [43979.085238] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.41.5.56 DST=10.0.923.923 LEN=20 TOS=0x00 PREC=0x00 TTL=20 ID=43979 DF PROTO=TCP SPT=16359 DPT=16359 WINDOW=43979 RES=0x00 SYN URGP=0 2026-10-09T13:31:32.345076-07:00 web-03 cron[16800]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:31:32.353199-07:00 worker-12 cron[24433]: (zoë) CMD (/usr/bin/backup --quiet --target /srv/zoë) 2026-10-09T13:31:32.389250-07:00 cache-3 nginx[1200]: 45.12.3.252 - - "GET /static/main.css HTTP/1.1" 401 63584 "-" "kube-probe/1.31" 2026-10-09T13:31:32.429342-07:00 db-replica app[30723]: INFO request_id=7cab588d6d301130 method=GET path=/health status=200 duration=7940ms 2026-10-09T13:31:32.468150-07:00 api-08 systemd[1]: session-85681.scope: Deactivated successfully. 2026-10-09T13:31:32.625853-07:00 api-08 nginx[1210]: 45.79.213.58 - akira "POST /.env HTTP/1.1" 200 6201 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:32.810233-07:00 bastion nginx[1202]: 172.48.74.229 - - "GET /.env HTTP/1.1" 200 39949 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:33.196180-07:00 web-01 sshd[15862]: Accepted publickey for backup from 192.43.250.84 port 46016 ssh2: ED25519 SHA256:5bcfae1febd94cae 2026-10-09T13:31:33.279490-07:00 edge-fr-1 sshd[44311]: Accepted publickey for akira from 203.248.62.238 port 23665 ssh2: ED25519 SHA256:d7875eca35d9f578 2026-10-09T13:31:33.481978-07:00 db-replica app[30820]: INFO worker 34 picked job 544434c44674cedd from queue orders 2026-10-09T13:31:33.485419-07:00 db-replica app[30544]: INFO order 16976 confirmed for ci in 1879 ms (region us-east-1, queue invoices) 2026-10-09T13:31:33.633421-07:00 api-07 postgres[26679]: LOG: duration: 2171.69 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:33.804351-07:00 api-08 app[30870]: INFO health check ok: db 578 ms, cache 578 ms, queue depth 95 2026-10-09T13:31:33.996698-07:00 db-primary app[30721]: INFO request_id=1e06b7e6f4f6b451 method=GET path=/api/v2/search?q=invoice status=200 duration=5271ms 2026-10-09T13:31:34.061414-07:00 edge-fr-1 app[30944]: INFO request_id=9c82700b1e8c2ff4 method=GET path=/wp-login.php status=200 duration=2097ms 2026-10-09T13:31:34.121789-07:00 api-08 app[30314]: INFO worker 64 finished job a6874c0b7884a96d in 6095 ms 2026-10-09T13:31:34.560140-07:00 worker-12 systemd[1]: session-75240.scope: Deactivated successfully. 2026-10-09T13:31:34.596103-07:00 web-03 sshd[23260]: Failed password for invalid user priya from 192.199.50.241 port 36661 ssh2 2026-10-09T13:31:34.973642-07:00 api-08 sshd[34538]: Received disconnect from 91.237.143.36 port 60485:11: Bye Bye [preauth] 2026-10-09T13:31:35.077004-07:00 web-03 sshd[5450]: Connection closed by 172.181.123.6 port 12673 [preauth] 2026-10-09T13:31:35.290962-07:00 edge-fr-1 app[30051]: INFO request_id=35f3be01c6fff0ca method=GET path=/api/v2/search?q=invoice status=502 duration=4128ms 2026-10-09T13:31:35.570812-07:00 edge-fr-1 app[30861]: DEBUG cache hit ratio 34% over the last minute (56005 lookups) 2026-10-09T13:31:35.827732-07:00 web-03 app[30756]: INFO worker 50 finished job 2f941e9289b51b21 in 1626 ms 2026-10-09T13:31:35.905948-07:00 api-07 nginx[1204]: 172.232.60.77 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 76020 "-" "python-requests/2.32.3" 2026-10-09T13:31:35.935767-07:00 bastion app[30362]: INFO worker 35 finished job 76ef325bba07b79d in 3071 ms 2026-10-09T13:31:36.004268-07:00 db-replica sshd[64491]: pam_unix(sshd:session): session opened for user zoë(uid=1184) by (uid=0) 2026-10-09T13:31:36.089005-07:00 cache-3 app[30017]: INFO order 41044 confirmed for müller in 987 ms (region us-east-1, queue invoices) 2026-10-09T13:31:36.166810-07:00 api-07 nginx[1202]: 91.5.173.123 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 57923 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:36.216627-07:00 worker-12 postgres[4905]: LOG: duration: 2226.618 ms statement: SELECT * FROM orders WHERE customer_id = 64878 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:36.260493-07:00 web-01 app[30189]: INFO order 75558 confirmed for akira in 6458 ms (region us-east-1, queue invoices) 2026-10-09T13:31:36.260549-07:00 bastion postgres[9418]: LOG: duration: 9122.54 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:36.273404-07:00 web-03 sshd[39193]: Received disconnect from 192.91.63.38 port 4748:11: Bye Bye [preauth] 2026-10-09T13:31:36.356169-07:00 db-primary nginx[1208]: 91.10.9.102 - - "GET /metrics HTTP/1.1" 302 72414 "-" "curl/8.4.0" 2026-10-09T13:31:36.377460-07:00 db-primary app[30239]: INFO worker 11 picked job 6559089d70cd81bf from queue webhooks 2026-10-09T13:31:36.426203-07:00 api-08 app[30632]: INFO health check ok: db 462 ms, cache 462 ms, queue depth 20 2026-10-09T13:31:36.458713-07:00 web-02 nginx[1209]: 45.120.224.221 - - "GET /metrics HTTP/1.1" 502 25751 "-" "curl/8.4.0" 2026-10-09T13:31:36.460734-07:00 db-primary app[30095]: INFO worker 76 picked job 5b7f524e0a5ae1e6 from queue emails 2026-10-09T13:31:36.462720-07:00 bastion haproxy[922]: 192.42.10.75:47142 [37041] http-in app/bastion 1218/0/61/61/1218 200 78502 - - ---- 754/754/89/89/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:31:36.542525-07:00 web-03 nginx[1206]: 45.180.186.107 - - "GET /metrics HTTP/1.1" 302 25041 "-" "Go-http-client/1.1" 2026-10-09T13:31:36.550671-07:00 web-03 sshd[23063]: Received disconnect from 91.123.81.129 port 40944:11: Bye Bye [preauth] 2026-10-09T13:31:36.632906-07:00 web-02 app[30025]: INFO worker 57 picked job edae433389719e79 from queue orders 2026-10-09T13:31:36.832491-07:00 db-primary app[30076]: INFO worker 26 finished job 885eb7dc275c914c in 3814 ms 2026-10-09T13:31:36.894612-07:00 db-primary app[30361]: ERROR payment declined for order 66559: card_declined (code 46), customer notified 2026-10-09T13:31:36.931514-07:00 web-01 nginx[1206]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 91.84.231.113, server: app.example.com, request: "GET /admin HTTP/1.1", upstream: "http://10.0.908.908:8080/admin" 2026-10-09T13:31:37.135175-07:00 web-01 app[30446]: WARN slow query (4595 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '73 minutes' 2026-10-09T13:31:37.159285-07:00 bastion postgres[3932]: LOG: checkpoint complete: wrote 2575 buffers (36%); 0 WAL file(s) added, 0 removed, 47 recycled; write=3652.4 s, sync=0.4 s, total=3652.4 s 2026-10-09T13:31:37.213922-07:00 db-replica nginx[1204]: 91.37.25.212 - sørensen "POST /api/v2/orders HTTP/1.1" 200 22762 "-" "Go-http-client/1.1" 2026-10-09T13:31:37.300474-07:00 web-02 nginx[1203]: 192.215.82.217 - deploy "POST /api/v2/search?q=invoice HTTP/1.1" 200 25358 "-" "python-requests/2.32.3" 2026-10-09T13:31:37.426525-07:00 web-03 nginx[1200]: 45.29.105.33 - - "GET /api/v2/users HTTP/1.1" 200 87681 "-" "Go-http-client/1.1" 2026-10-09T13:31:37.468692-07:00 db-replica app[30139]: INFO order 21891 confirmed for françois in 1085 ms (region us-east-1, queue emails) 2026-10-09T13:31:37.580247-07:00 db-replica systemd[1]: Started Session 69327 of User backup. 2026-10-09T13:31:37.867220-07:00 web-01 kubelet[800]: I1009 13:31:37.556063 9917 kubelet.go:9917] "Pod is terminating, skipping pod status update" pod="default/api-dc20f2e9c18a62cb" 2026-10-09T13:31:37.960962-07:00 db-primary nginx[1202]: 203.178.156.173 - - "GET /api/v2/orders HTTP/1.1" 200 3307 "-" "kube-probe/1.31" 2026-10-09T13:31:37.982639-07:00 db-replica app[30697]: INFO worker 64 picked job 39f210d9ae02ed50 from queue invoices 2026-10-09T13:31:38.040521-07:00 api-07 postgres[19833]: LOG: duration: 8259.336 ms statement: SELECT * FROM orders WHERE customer_id = 90801 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:38.047391-07:00 api-08 app[30975]: INFO worker 77 picked job d6ee5efe9d00b9a0 from queue orders 2026-10-09T13:31:38.114452-07:00 web-01 nginx[1202]: 172.60.24.82 - - "GET /admin HTTP/1.1" 500 75615 "-" "curl/8.4.0" 2026-10-09T13:31:38.130110-07:00 worker-12 haproxy[929]: 203.176.180.144:31838 [83863] http-in app/db-primary 4767/0/881/881/4767 200 16246 - - ---- 145/145/83/83/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:31:38.159134-07:00 worker-12 nginx[1204]: 10.56.241.153 - - "GET /static/app.js HTTP/1.1" 404 79378 "-" "kube-probe/1.31" 2026-10-09T13:31:38.451595-07:00 bastion sshd[28383]: Invalid user backup from 45.219.157.230 port 17080 2026-10-09T13:31:38.484379-07:00 api-07 sshd[46155]: Invalid user backup from 203.25.95.28 port 9379 2026-10-09T13:31:38.508382-07:00 worker-12 app[30494]: INFO order 69382 confirmed for sørensen in 7396 ms (region eu-west-1, queue emails) 2026-10-09T13:31:38.624737-07:00 api-07 sshd[53919]: Invalid user akira from 172.224.72.95 port 41474 2026-10-09T13:31:38.676023-07:00 api-08 kubelet[800]: E1009 13:31:38.169242 4348 pod_workers.go:4348] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-b0e6eb9d38da0165" 2026-10-09T13:31:38.694497-07:00 web-03 app[30492]: INFO request_id=3ceee3eb0be86f72 method=GET path=/api/v2/orders/8841 status=204 duration=9032ms 2026-10-09T13:31:38.889976-07:00 web-01 nginx[1209]: 192.29.100.31 - - "GET /.env HTTP/1.1" 401 37510 "-" "Go-http-client/1.1" 2026-10-09T13:31:38.895025-07:00 worker-12 kernel: [18287.734952] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.166.132.13 DST=10.0.691.691 LEN=96 TOS=0x00 PREC=0x00 TTL=96 ID=18287 DF PROTO=TCP SPT=42516 DPT=42516 WINDOW=18287 RES=0x00 SYN URGP=0 2026-10-09T13:31:39.062160-07:00 api-08 nginx[1210]: 203.123.21.152 - - "GET /api/v2/orders HTTP/1.1" 200 19563 "-" "Go-http-client/1.1" 2026-10-09T13:31:39.206646-07:00 web-03 kernel: [61601.318096] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.196.75.242 DST=10.0.152.152 LEN=33 TOS=0x00 PREC=0x00 TTL=33 ID=61601 DF PROTO=TCP SPT=48724 DPT=48724 WINDOW=61601 RES=0x00 SYN URGP=0 2026-10-09T13:31:39.244744-07:00 web-02 app[30174]: INFO request_id=6810365e49ecc97b method=GET path=/.env status=200 duration=5999ms 2026-10-09T13:31:39.321626-07:00 worker-12 haproxy[900]: 172.158.179.148:13917 [31945] http-in app/db-primary 9405/0/756/756/9405 200 47567 - - ---- 767/767/78/78/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:31:39.367632-07:00 api-08 nginx[1209]: 91.246.137.155 - - "GET /static/main.css HTTP/1.1" 302 19283 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:39.551077-07:00 bastion sshd[31950]: Received disconnect from 203.3.168.58 port 38279:11: Bye Bye [preauth] 2026-10-09T13:31:39.775930-07:00 cache-3 app[30464]: INFO worker 16 finished job a78251ccd1d1616e in 3016 ms 2026-10-09T13:31:39.900678-07:00 edge-fr-1 systemd[1]: Started Session 32638 of User müller. 2026-10-09T13:31:39.915717-07:00 web-01 sshd[56920]: pam_unix(sshd:session): session opened for user akira(uid=2118) by (uid=0) 2026-10-09T13:31:40.007508-07:00 bastion app[30262]: INFO request_id=3b1b39c79cd3da4e method=GET path=/api/v2/orders/8841 status=301 duration=2193ms 2026-10-09T13:31:40.076209-07:00 db-replica nginx[1204]: 203.221.36.45 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 35490 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:40.167195-07:00 api-08 app[30077]: INFO request_id=eba15fc85070a0ff method=GET path=/api/v2/orders status=200 duration=1559ms 2026-10-09T13:31:40.183663-07:00 db-replica app[30003]: INFO order 13997 confirmed for root in 653 ms (region us-east-1, queue webhooks) 2026-10-09T13:31:40.209935-07:00 db-replica kernel: [30006.130538] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.67.217.134 DST=10.0.813.813 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=30006 DF PROTO=TCP SPT=42893 DPT=42893 WINDOW=30006 RES=0x00 SYN URGP=0 2026-10-09T13:31:40.369605-07:00 web-01 haproxy[900]: 192.148.243.252:26863 [19838] http-in app/cache-3 2784/0/364/364/2784 401 70205 - - ---- 884/884/10/10/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:31:40.391761-07:00 edge-fr-1 nginx[1208]: 203.165.29.215 - - "GET /admin HTTP/1.1" 302 18066 "-" "Go-http-client/1.1" 2026-10-09T13:31:40.725934-07:00 cache-3 nginx[1203]: 192.44.103.181 - ci "POST /static/app.js HTTP/1.1" 200 57875 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:40.728947-07:00 api-08 app[30645]: INFO request_id=aedaa0c09939b346 method=GET path=/static/app.js status=200 duration=659ms 2026-10-09T13:31:40.757757-07:00 db-primary haproxy[927]: 172.141.31.51:36529 [69940] http-in app/edge-fr-1 5691/0/171/171/5691 401 62610 - - ---- 496/496/18/18/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:31:40.780853-07:00 web-03 app[30465]: ERROR payment declined for order 50444: card_declined (code 28), customer notified 2026-10-09T13:31:40.957648-07:00 api-07 cron[19437]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:31:41.019052-07:00 api-08 app[30631]: WARN slow query (7618 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '20 minutes' 2026-10-09T13:31:41.063827-07:00 web-01 systemd[1]: session-30315.scope: Deactivated successfully. 2026-10-09T13:31:41.083126-07:00 bastion app[30397]: INFO worker 40 picked job e7f2366abcb88c43 from queue invoices 2026-10-09T13:31:41.214953-07:00 worker-12 postgres[14884]: LOG: duration: 7695.784 ms statement: SELECT * FROM orders WHERE customer_id = 42778 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:41.294426-07:00 db-primary nginx[1204]: 172.155.209.135 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 13687 "-" "curl/8.4.0" 2026-10-09T13:31:41.317039-07:00 web-02 kernel: [46197.203059] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.89.120.210 DST=10.0.506.506 LEN=45 TOS=0x00 PREC=0x00 TTL=45 ID=46197 DF PROTO=TCP SPT=19846 DPT=19846 WINDOW=46197 RES=0x00 SYN URGP=0 2026-10-09T13:31:41.630878-07:00 db-primary nginx[1204]: 10.116.230.149 - - "GET /wp-login.php HTTP/1.1" 500 72075 "-" "python-requests/2.32.3" 2026-10-09T13:31:41.767680-07:00 edge-fr-1 haproxy[943]: 172.251.8.108:32894 [22338] http-in app/worker-12 6552/0/678/678/6552 302 24777 - - ---- 502/502/50/50/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:31:41.869198-07:00 api-07 haproxy[915]: Server app/db-replica is DOWN, reason: Layer4 timeout, check duration: 7624ms. 72 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:31:42.142445-07:00 cache-3 app[30070]: INFO worker 94 picked job 16fb7881360fdba4 from queue webhooks 2026-10-09T13:31:42.377830-07:00 bastion sshd[7606]: Accepted publickey for françois from 172.109.191.202 port 51862 ssh2: ED25519 SHA256:9e7803769756680a 2026-10-09T13:31:42.459746-07:00 worker-12 haproxy[944]: 203.16.70.186:11356 [95857] http-in app/bastion 3395/0/469/469/3395 404 72317 - - ---- 912/912/24/24/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:31:42.583430-07:00 bastion sshd[48612]: Invalid user müller from 192.249.216.25 port 45135 2026-10-09T13:31:42.721148-07:00 db-replica nginx[1207]: 192.176.103.229 - backup "POST /api/v2/search?q=invoice HTTP/1.1" 200 45826 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:42.843752-07:00 bastion nginx[1206]: 91.84.254.150 - françois "POST /wp-login.php HTTP/1.1" 200 22889 "-" "curl/8.4.0" 2026-10-09T13:31:42.941249-07:00 web-01 sshd[35176]: Invalid user deploy from 203.251.147.82 port 41862 2026-10-09T13:31:42.970853-07:00 edge-fr-1 app[30265]: INFO worker 86 finished job 57d057b1e0e2b326 in 9804 ms 2026-10-09T13:31:43.093202-07:00 worker-12 systemd[1]: session-86177.scope: Deactivated successfully. 2026-10-09T13:31:43.136588-07:00 db-replica app[30723]: WARN retrying upstream 10.28.100.100:44281 after timeout (9689 ms), attempt 1 of 3 2026-10-09T13:31:43.307116-07:00 cache-3 nginx[1203]: 45.54.184.69 - - "GET /metrics HTTP/1.1" 404 36804 "-" "python-requests/2.32.3" 2026-10-09T13:31:43.377125-07:00 bastion app[30493]: INFO request_id=e0a0bcd0b4b609ab method=GET path=/admin status=200 duration=1981ms 2026-10-09T13:31:43.486927-07:00 worker-12 kubelet[800]: E1009 13:31:43.052059 4303 pod_workers.go:4303] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-44afcd5b874274a8" 2026-10-09T13:31:43.623753-07:00 worker-12 nginx[1209]: 172.118.19.111 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 500 34643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:43.778332-07:00 web-03 postgres[17988]: LOG: duration: 4228.20 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:43.797063-07:00 worker-12 nginx[1209]: 10.140.246.160 - - "GET /favicon.ico HTTP/1.1" 200 66796 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:43.821101-07:00 api-07 nginx[1210]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.162.184.199, server: app.example.com, request: "GET /.env HTTP/1.1", upstream: "http://10.0.665.665:8080/.env" 2026-10-09T13:31:43.850724-07:00 web-02 sshd[28590]: Accepted publickey for müller from 192.163.45.193 port 30299 ssh2: ED25519 SHA256:4a9821e9e15a769a 2026-10-09T13:31:44.042855-07:00 cache-3 nginx[1207]: 192.133.226.109 - - "GET /api/v2/orders HTTP/1.1" 302 34424 "-" "kube-probe/1.31" 2026-10-09T13:31:44.159084-07:00 worker-12 nginx[1201]: 45.37.183.171 - - "GET /static/app.js HTTP/1.1" 500 85016 "-" "Go-http-client/1.1" 2026-10-09T13:31:44.203242-07:00 api-08 haproxy[905]: 45.56.119.174:24140 [78026] http-in app/cache-3 7177/0/544/544/7177 200 75781 - - ---- 822/822/72/72/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:31:44.204408-07:00 worker-12 nginx[1205]: 203.171.207.152 - - "GET /.env HTTP/1.1" 200 41000 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:44.413684-07:00 web-02 cron[31921]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:31:44.430760-07:00 web-01 sshd[18187]: Failed password for invalid user sørensen from 172.251.210.235 port 62009 ssh2 2026-10-09T13:31:44.713761-07:00 worker-12 nginx[1201]: 10.246.64.241 - - "GET /metrics HTTP/1.1" 302 86906 "-" "curl/8.4.0" 2026-10-09T13:31:44.805306-07:00 db-replica app[30369]: INFO request_id=681a09c63b0399f1 method=GET path=/.env status=200 duration=2335ms 2026-10-09T13:31:44.911169-07:00 worker-12 haproxy[947]: 192.168.97.190:37591 [99113] http-in app/web-01 2452/0/352/352/2452 404 5326 - - ---- 250/250/88/88/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:45.052439-07:00 web-01 app[30339]: INFO order 60253 confirmed for backup in 5443 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:31:45.204001-07:00 db-primary sshd[4696]: Accepted publickey for priya from 10.199.111.23 port 44869 ssh2: ED25519 SHA256:7d2d126742b82296 2026-10-09T13:31:45.235714-07:00 db-replica nginx[1208]: 192.214.120.65 - - "GET /api/v2/search?q=invoice HTTP/1.1" 502 85687 "-" "curl/8.4.0" 2026-10-09T13:31:45.319480-07:00 api-07 kernel: [42973.165299] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.173.86.229 DST=10.0.567.567 LEN=16 TOS=0x00 PREC=0x00 TTL=16 ID=42973 DF PROTO=TCP SPT=40239 DPT=40239 WINDOW=42973 RES=0x00 SYN URGP=0 2026-10-09T13:31:45.346723-07:00 web-01 app[30860]: INFO request_id=1ef1f3487f5c9bd6 method=GET path=/static/main.css status=500 duration=5885ms 2026-10-09T13:31:45.489357-07:00 worker-12 haproxy[927]: 192.157.39.181:1163 [85410] http-in app/cache-3 6231/0/878/878/6231 200 52302 - - ---- 902/902/52/52/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:31:45.494421-07:00 bastion app[30931]: INFO worker 35 finished job 95e12a424fbd23d3 in 8339 ms 2026-10-09T13:31:45.548754-07:00 web-03 sshd[31906]: Accepted publickey for sørensen from 192.145.188.19 port 4171 ssh2: ED25519 SHA256:09755acf026646f4 2026-10-09T13:31:45.654852-07:00 edge-fr-1 nginx[1200]: 10.209.58.194 - - "GET /.env HTTP/1.1" 502 34547 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:45.670546-07:00 worker-12 nginx[1208]: 10.116.231.22 - - "GET /favicon.ico HTTP/1.1" 302 71698 "-" "curl/8.4.0" 2026-10-09T13:31:45.820279-07:00 edge-fr-1 app[30233]: INFO request_id=7a00a41ee865f38b method=GET path=/api/v2/orders/8841 status=502 duration=8374ms 2026-10-09T13:31:46.060155-07:00 edge-fr-1 haproxy[910]: Server app/web-01 is UP, reason: Layer7 check passed, code: 200, check duration: 174ms. 31 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:31:46.063783-07:00 db-replica app[30108]: INFO order 40493 confirmed for sørensen in 2910 ms (region eu-west-1, queue invoices) 2026-10-09T13:31:46.489951-07:00 edge-fr-1 app[30187]: INFO worker 11 finished job 481693eee2600a15 in 3599 ms 2026-10-09T13:31:46.538590-07:00 db-primary app[30350]: INFO worker 22 picked job cd217aaee32608c5 from queue orders 2026-10-09T13:31:46.556102-07:00 api-08 sshd[33332]: Invalid user priya from 203.56.80.217 port 9564 2026-10-09T13:31:46.667729-07:00 web-03 app[30700]: DEBUG cache hit ratio 56% over the last minute (29922 lookups) 2026-10-09T13:31:46.803161-07:00 api-08 nginx[1200]: 45.202.144.237 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 55270 "-" "Go-http-client/1.1" 2026-10-09T13:31:47.017952-07:00 worker-12 postgres[22995]: LOG: duration: 3123.924 ms statement: SELECT * FROM orders WHERE customer_id = 94539 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:47.192654-07:00 worker-12 postgres[6582]: LOG: duration: 3235.611 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:47.506837-07:00 worker-12 app[30020]: INFO request_id=3f3eecd8381f8a83 method=GET path=/login status=404 duration=1776ms 2026-10-09T13:31:47.610637-07:00 api-07 app[30360]: INFO worker 89 finished job d2dae6a30e7acb70 in 800 ms 2026-10-09T13:31:47.616079-07:00 web-01 sshd[4434]: Accepted publickey for backup from 172.223.236.72 port 42879 ssh2: ED25519 SHA256:f6ad89e9f7180bf9 2026-10-09T13:31:47.729397-07:00 web-02 app[30892]: INFO request_id=9a49b491ddc3b827 method=GET path=/health status=301 duration=6680ms 2026-10-09T13:31:47.789699-07:00 edge-fr-1 sshd[35234]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:31:48.081234-07:00 web-02 kubelet[800]: I1009 13:31:48.334427 4563 kubelet.go:4563] "Pod is terminating, skipping pod status update" pod="default/api-1027dbe440419729" 2026-10-09T13:31:48.228280-07:00 api-08 app[30755]: INFO request_id=be8a056dbd12d612 method=GET path=/admin status=200 duration=1464ms 2026-10-09T13:31:48.357752-07:00 edge-fr-1 app[30036]: INFO request_id=742e62d87c8395e4 method=GET path=/api/v2/users status=200 duration=9541ms 2026-10-09T13:31:48.368227-07:00 db-primary postgres[31893]: LOG: duration: 354.137 ms statement: SELECT * FROM orders WHERE customer_id = 94964 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:48.878632-07:00 db-primary nginx[1202]: 91.63.189.45 - - "GET /wp-login.php HTTP/1.1" 404 63842 "-" "python-requests/2.32.3" 2026-10-09T13:31:48.979821-07:00 edge-fr-1 app[30998]: INFO request_id=c877626f0eac04c9 method=GET path=/favicon.ico status=200 duration=3587ms 2026-10-09T13:31:49.197517-07:00 api-07 sshd[47855]: Accepted publickey for zoë from 10.68.37.24 port 47064 ssh2: ED25519 SHA256:212fdafc0f90ca32 2026-10-09T13:31:49.246152-07:00 web-02 nginx[1207]: 172.104.72.42 - - "GET /admin HTTP/1.1" 302 31204 "-" "kube-probe/1.31" 2026-10-09T13:31:49.333866-07:00 db-primary app[30665]: INFO order 41895 confirmed for priya in 3783 ms (region us-east-1, queue invoices) 2026-10-09T13:31:49.381007-07:00 web-03 app[30828]: INFO worker 72 finished job 8faeca2506608822 in 3599 ms 2026-10-09T13:31:49.386975-07:00 api-07 app[30153]: INFO request_id=aa8b89888b921584 method=GET path=/login status=401 duration=7078ms 2026-10-09T13:31:49.432429-07:00 worker-12 haproxy[947]: 172.113.205.61:55526 [25130] http-in app/api-08 2419/0/396/396/2419 200 42977 - - ---- 144/144/48/48/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:49.607989-07:00 api-08 app[30565]: INFO request_id=17a0e182bb680680 method=GET path=/favicon.ico status=404 duration=3057ms 2026-10-09T13:31:49.662591-07:00 db-primary nginx[1210]: 192.229.250.226 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 41405 "-" "Go-http-client/1.1" 2026-10-09T13:31:49.826453-07:00 worker-12 nginx[1202]: 192.142.208.17 - - "GET /metrics HTTP/1.1" 404 2354 "-" "curl/8.4.0" 2026-10-09T13:31:49.914864-07:00 web-02 app[30641]: WARN slow query (9420 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '42 minutes' 2026-10-09T13:31:49.925556-07:00 web-02 kernel: [86781.543313] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.115.117.120 DST=10.0.511.511 LEN=40 TOS=0x00 PREC=0x00 TTL=40 ID=86781 DF PROTO=TCP SPT=9244 DPT=9244 WINDOW=86781 RES=0x00 SYN URGP=0 2026-10-09T13:31:50.199107-07:00 db-replica haproxy[900]: 172.209.140.105:47936 [90249] http-in app/cache-3 7834/0/40/40/7834 302 54939 - - ---- 282/282/67/67/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:31:50.292004-07:00 bastion haproxy[918]: 45.45.76.9:15143 [22901] http-in app/edge-fr-1 1479/0/559/559/1479 302 52097 - - ---- 413/413/38/38/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:31:50.424348-07:00 db-primary sshd[14383]: Received disconnect from 45.212.243.59 port 29921:11: Bye Bye [preauth] 2026-10-09T13:31:50.437734-07:00 web-03 postgres[23340]: LOG: duration: 1012.948 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:50.542963-07:00 cache-3 sshd[20080]: Invalid user backup from 91.23.211.77 port 18481 2026-10-09T13:31:50.735449-07:00 worker-12 app[30190]: INFO request_id=296b2c372521b2fe method=GET path=/metrics status=404 duration=8878ms 2026-10-09T13:31:50.775518-07:00 cache-3 app[30562]: INFO request_id=d60e55d643c1171d method=GET path=/login status=502 duration=8290ms 2026-10-09T13:31:50.789220-07:00 db-primary nginx[1207]: 45.183.149.212 - backup "POST /login HTTP/1.1" 200 29134 "-" "kube-probe/1.31" 2026-10-09T13:31:50.949581-07:00 bastion sshd[42620]: Connection closed by 203.49.191.6 port 4216 [preauth] 2026-10-09T13:31:51.048276-07:00 worker-12 sshd[3873]: Connection closed by 91.103.101.127 port 15850 [preauth] 2026-10-09T13:31:51.181933-07:00 edge-fr-1 cron[8829]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:31:51.220296-07:00 web-01 sshd[26907]: Received disconnect from 91.241.150.9 port 22850:11: Bye Bye [preauth] 2026-10-09T13:31:51.311688-07:00 api-07 app[30330]: INFO worker 76 finished job 7237890af66a490a in 147 ms 2026-10-09T13:31:51.354124-07:00 api-08 nginx[1203]: 192.86.253.233 - - "GET /api/v2/users HTTP/1.1" 502 71333 "-" "python-requests/2.32.3" 2026-10-09T13:31:51.528155-07:00 web-02 app[30215]: INFO health check ok: db 549 ms, cache 549 ms, queue depth 93 2026-10-09T13:31:51.838866-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791577911.115:99746): pid=99746 uid=0 auid=8634 ses=328 msg='op=login id=8634 exe="/usr/sbin/sshd" hostname=? addr=192.59.96.158 terminal=/dev/pts/0 res=success' 2026-10-09T13:31:51.870328-07:00 web-01 nginx[1202]: 172.197.108.84 - - "GET /api/v2/orders HTTP/1.1" 302 24509 "-" "curl/8.4.0" 2026-10-09T13:31:52.161892-07:00 api-07 postgres[22138]: LOG: duration: 2105.796 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:31:52.425310-07:00 web-02 app[30948]: INFO health check ok: db 398 ms, cache 398 ms, queue depth 13 2026-10-09T13:31:52.516093-07:00 db-replica haproxy[931]: 192.41.230.216:11849 [80795] http-in app/web-03 5904/0/169/169/5904 200 61876 - - ---- 792/792/22/22/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:52.578090-07:00 edge-fr-1 app[30174]: INFO request_id=0427dd60f8eba42f method=GET path=/metrics status=200 duration=8712ms 2026-10-09T13:31:52.664678-07:00 db-primary haproxy[927]: 203.148.85.210:45733 [73183] http-in app/bastion 2213/0/324/324/2213 500 88761 - - ---- 111/111/11/11/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:31:52.728060-07:00 edge-fr-1 sshd[37829]: Invalid user françois from 172.187.164.4 port 9883 2026-10-09T13:31:52.934897-07:00 bastion app[30324]: INFO order 16643 confirmed for root in 5979 ms (region eu-west-1, queue emails) 2026-10-09T13:31:52.997375-07:00 web-03 sshd[52706]: Failed password for invalid user zoë from 172.217.88.178 port 57435 ssh2 2026-10-09T13:31:53.078625-07:00 db-primary app[30812]: WARN slow query (8749 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '82 minutes' 2026-10-09T13:31:53.234159-07:00 api-07 app[30817]: INFO request_id=29090a83c0ec0eb2 method=GET path=/.env status=500 duration=6508ms 2026-10-09T13:31:53.281185-07:00 worker-12 nginx[1209]: 91.251.17.67 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 82427 "-" "kube-probe/1.31" 2026-10-09T13:31:53.677555-07:00 edge-fr-1 app[30022]: INFO request_id=a33b4e4b81b4bea5 method=GET path=/favicon.ico status=401 duration=2695ms 2026-10-09T13:31:53.855840-07:00 api-07 haproxy[926]: 203.107.159.71:7465 [91073] http-in app/cache-3 42/0/138/138/42 200 8813 - - ---- 392/392/54/54/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:31:53.975959-07:00 db-replica nginx[1203]: 192.52.248.179 - ci "POST /wp-login.php HTTP/1.1" 200 42362 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:53.980654-07:00 bastion app[30470]: INFO order 34023 confirmed for müller in 9859 ms (region eu-west-1, queue webhooks) 2026-10-09T13:31:54.025497-07:00 api-08 app[30419]: DEBUG cache hit ratio 91% over the last minute (35544 lookups) 2026-10-09T13:31:54.103959-07:00 worker-12 app[30551]: DEBUG cache hit ratio 78% over the last minute (49204 lookups) 2026-10-09T13:31:54.270092-07:00 api-08 app[30697]: INFO worker 39 finished job ac796c108571f2af in 6006 ms 2026-10-09T13:31:54.395924-07:00 web-03 nginx[1202]: 203.229.5.158 - - "GET /admin HTTP/1.1" 200 71110 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:31:54.481810-07:00 edge-fr-1 systemd[1]: session-47154.scope: Deactivated successfully. 2026-10-09T13:31:54.771974-07:00 web-01 nginx[1200]: 10.254.18.117 - - "GET /api/v2/users HTTP/1.1" 301 54097 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:31:55.200678-07:00 db-primary app[30045]: INFO worker 75 finished job c61b59df2024d3a9 in 3022 ms 2026-10-09T13:31:55.257310-07:00 edge-fr-1 sshd[31452]: pam_unix(sshd:session): session opened for user akira(uid=9788) by (uid=0) 2026-10-09T13:31:55.392432-07:00 cache-3 app[30417]: INFO request_id=e9ebb5d3ace0dcc2 method=GET path=/api/v2/orders/8841 status=204 duration=9853ms 2026-10-09T13:31:55.403083-07:00 cache-3 app[30725]: INFO worker 97 picked job e55fea50bd55aebb from queue invoices 2026-10-09T13:31:55.608840-07:00 api-07 systemd[1]: Started Session 33043 of User deploy. 2026-10-09T13:31:55.720650-07:00 web-03 nginx[1207]: 10.181.148.253 - - "GET /static/main.css HTTP/1.1" 200 52197 "-" "Go-http-client/1.1" 2026-10-09T13:31:55.881365-07:00 worker-12 app[30873]: INFO worker 11 picked job fe07aebcde799859 from queue orders 2026-10-09T13:31:56.190410-07:00 cache-3 haproxy[944]: 91.234.102.117:64745 [84386] http-in app/web-01 2587/0/46/46/2587 200 84391 - - ---- 930/930/17/17/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:31:56.226225-07:00 web-01 app[30247]: INFO health check ok: db 933 ms, cache 933 ms, queue depth 24 2026-10-09T13:31:56.568357-07:00 db-primary app[30336]: INFO order 17037 confirmed for deploy in 6493 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:31:56.609467-07:00 web-02 sshd[58262]: Accepted publickey for ci from 45.133.104.10 port 28703 ssh2: ED25519 SHA256:2f94fabcf8ba01c3 2026-10-09T13:31:56.676839-07:00 cache-3 app[30309]: INFO order 28623 confirmed for zoë in 7779 ms (region eu-west-1, queue orders) 2026-10-09T13:31:56.793993-07:00 api-08 app[30153]: INFO request_id=94d93f44b4773aec method=GET path=/health status=500 duration=6360ms 2026-10-09T13:31:56.807381-07:00 worker-12 sshd[54430]: pam_unix(sshd:session): session opened for user backup(uid=5152) by (uid=0) 2026-10-09T13:31:56.885054-07:00 api-08 sshd[29785]: Connection closed by 45.230.63.158 port 36054 [preauth] 2026-10-09T13:31:56.928134-07:00 api-07 app[30341]: INFO request_id=5257c7032fefa7b8 method=GET path=/health status=301 duration=4837ms 2026-10-09T13:31:57.045109-07:00 api-08 app[30205]: INFO request_id=f66e4edf9703e5af method=GET path=/static/app.js status=401 duration=3979ms 2026-10-09T13:31:57.289368-07:00 worker-12 sshd[63789]: Failed password for invalid user ci from 10.149.197.104 port 45990 ssh2 2026-10-09T13:31:57.424244-07:00 db-primary app[30072]: INFO order 73355 confirmed for müller in 2593 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:31:57.732188-07:00 cache-3 postgres[8960]: LOG: duration: 4274.270 ms statement: SELECT * FROM orders WHERE customer_id = 63358 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:31:57.752319-07:00 web-02 sshd[31197]: Accepted publickey for müller from 172.33.151.223 port 16096 ssh2: ED25519 SHA256:cae09e158a36e2ba 2026-10-09T13:31:57.880564-07:00 api-08 app[30484]: INFO order 82972 confirmed for deploy in 9325 ms (region eu-west-1, queue emails) 2026-10-09T13:31:57.924999-07:00 edge-fr-1 app[30488]: INFO order 18706 confirmed for ci in 9079 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:31:58.510108-07:00 cache-3 app[30018]: INFO request_id=7ca891004dcff620 method=GET path=/health status=502 duration=3086ms 2026-10-09T13:31:58.565400-07:00 api-08 sshd[50718]: Accepted publickey for root from 203.245.65.165 port 28422 ssh2: ED25519 SHA256:10f7b433400a1123 2026-10-09T13:31:58.684626-07:00 web-01 haproxy[913]: 10.178.48.220:13603 [49806] http-in app/worker-12 251/0/370/370/251 200 32520 - - ---- 225/225/66/66/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:31:58.694949-07:00 edge-fr-1 sshd[25303]: Connection closed by 91.86.41.34 port 2517 [preauth] 2026-10-09T13:31:58.838114-07:00 web-03 app[30960]: INFO request_id=d3caf33c2696329f method=GET path=/static/app.js status=404 duration=905ms 2026-10-09T13:31:58.863346-07:00 web-02 sshd[5151]: Received disconnect from 10.90.78.247 port 21266:11: Bye Bye [preauth] 2026-10-09T13:31:59.162275-07:00 worker-12 haproxy[918]: 203.134.108.43:64793 [47264] http-in app/web-03 830/0/644/644/830 302 88683 - - ---- 939/939/55/55/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:31:59.346530-07:00 web-02 haproxy[911]: Server app/web-02 is DOWN, reason: Layer4 timeout, check duration: 2791ms. 65 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:31:59.519803-07:00 api-08 app[30354]: INFO worker 47 picked job b91140ee1f295331 from queue emails 2026-10-09T13:31:59.530880-07:00 bastion app[30204]: INFO worker 35 picked job 75e573c216170197 from queue webhooks 2026-10-09T13:31:59.679472-07:00 web-03 app[30416]: INFO order 28615 confirmed for priya in 4052 ms (region us-east-1, queue webhooks) 2026-10-09T13:31:59.694777-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791577919.488:28235): pid=28235 uid=0 auid=2482 ses=288 msg='op=login id=2482 exe="/usr/sbin/sshd" hostname=? addr=172.25.132.179 terminal=/dev/pts/0 res=success' 2026-10-09T13:31:59.806085-07:00 edge-fr-1 nginx[1203]: 10.148.199.206 - - "GET /favicon.ico HTTP/1.1" 502 48619 "-" "python-requests/2.32.3" 2026-10-09T13:31:59.860163-07:00 cache-3 nginx[1207]: 203.117.39.32 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 50569 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:00.056743-07:00 bastion app[30849]: INFO worker 34 finished job 60f6ed7e5b7b4d4f in 6751 ms 2026-10-09T13:32:00.175200-07:00 bastion nginx[1206]: 45.110.63.215 - - "GET /admin HTTP/1.1" 204 87386 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:00.392258-07:00 web-01 nginx[1208]: 91.253.41.70 - - "GET /api/v2/users HTTP/1.1" 200 20312 "-" "curl/8.4.0" 2026-10-09T13:32:00.418136-07:00 web-01 haproxy[947]: 192.116.249.248:41170 [64682] http-in app/web-01 6765/0/331/331/6765 301 74925 - - ---- 765/765/12/12/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:00.953081-07:00 web-02 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:32:01.036802-07:00 api-08 app[30388]: ERROR payment declined for order 98620: card_declined (code 12), customer notified 2026-10-09T13:32:01.043654-07:00 api-07 haproxy[927]: 192.28.106.191:33827 [54969] http-in app/web-03 4631/0/610/610/4631 200 22861 - - ---- 422/422/71/71/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:32:01.106979-07:00 web-01 app[30621]: INFO request_id=be81dc67592520f7 method=GET path=/favicon.ico status=200 duration=779ms 2026-10-09T13:32:01.130834-07:00 api-07 sshd[52034]: Accepted publickey for françois from 91.184.156.10 port 11625 ssh2: ED25519 SHA256:9d6fed54fa860b1b 2026-10-09T13:32:01.199804-07:00 web-01 haproxy[931]: 45.195.195.146:56542 [20363] http-in app/api-08 919/0/841/841/919 200 25571 - - ---- 657/657/59/59/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:01.258346-07:00 edge-fr-1 app[30600]: INFO health check ok: db 399 ms, cache 399 ms, queue depth 89 2026-10-09T13:32:01.409388-07:00 web-02 sshd[57562]: Failed password for invalid user ci from 45.106.62.116 port 61386 ssh2 2026-10-09T13:32:01.429313-07:00 web-01 app[30853]: INFO request_id=51afba9c533bae73 method=GET path=/api/v2/orders status=500 duration=7388ms 2026-10-09T13:32:01.462415-07:00 cache-3 haproxy[909]: Server app/db-replica is UP, reason: Layer7 check passed, code: 200, check duration: 205ms. 63 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:32:01.485420-07:00 bastion postgres[30224]: LOG: duration: 4406.308 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:01.522515-07:00 web-02 app[30756]: INFO order 44480 confirmed for zoë in 6039 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:32:01.980270-07:00 bastion app[30251]: INFO worker 98 picked job c7ab7e229a163b8d from queue emails 2026-10-09T13:32:02.203547-07:00 cache-3 haproxy[919]: 45.149.211.164:36277 [38206] http-in app/web-02 3083/0/699/699/3083 301 16913 - - ---- 329/329/12/12/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:32:02.257175-07:00 api-08 postgres[22031]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 95890 remain, 9521 scanned (45% of total) 2026-10-09T13:32:02.414261-07:00 web-01 postgres[12144]: LOG: duration: 7571.340 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:02.552915-07:00 api-07 app[30630]: WARN retrying upstream 203.150.50.148:54748 after timeout (9185 ms), attempt 2 of 3 2026-10-09T13:32:02.764633-07:00 cache-3 nginx[1207]: 45.0.8.181 - - "GET /static/main.css HTTP/1.1" 404 10798 "-" "Go-http-client/1.1" 2026-10-09T13:32:02.860005-07:00 cache-3 app[30800]: WARN slow query (6022 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '18 minutes' 2026-10-09T13:32:02.861699-07:00 api-08 sshd[7102]: Received disconnect from 91.121.97.73 port 51473:11: Bye Bye [preauth] 2026-10-09T13:32:02.868099-07:00 api-07 nginx[1201]: 192.240.168.195 - - "GET /static/app.js HTTP/1.1" 500 6488 "-" "curl/8.4.0" 2026-10-09T13:32:02.912443-07:00 db-primary nginx[1209]: 10.182.231.199 - - "GET /login HTTP/1.1" 302 33055 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:03.066428-07:00 api-08 sshd[44470]: Invalid user backup from 91.62.56.48 port 15868 2026-10-09T13:32:03.128573-07:00 web-03 kernel: [96509.693595] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/app.service,task=java,pid=96509,uid=2920 2026-10-09T13:32:03.131009-07:00 api-08 nginx[1200]: 203.112.117.56 - - "GET /metrics HTTP/1.1" 500 80037 "-" "kube-probe/1.31" 2026-10-09T13:32:03.311411-07:00 db-replica app[30672]: INFO worker 84 finished job 7ce8e9d72131d682 in 7569 ms 2026-10-09T13:32:03.946121-07:00 web-03 kernel: [45127.039149] TCP: request_sock_TCP: Possible SYN flooding on port 31284. Sending cookies. Check SNMP counters. 2026-10-09T13:32:04.367870-07:00 edge-fr-1 app[30284]: INFO order 16728 confirmed for akira in 2304 ms (region ap-northeast-1, queue emails) 2026-10-09T13:32:04.404899-07:00 bastion kernel: [86489.147757] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.171.222.78 DST=10.0.210.210 LEN=66 TOS=0x00 PREC=0x00 TTL=66 ID=86489 DF PROTO=TCP SPT=32256 DPT=32256 WINDOW=86489 RES=0x00 SYN URGP=0 2026-10-09T13:32:04.678619-07:00 web-01 app[30758]: INFO request_id=cc59226b7204e008 method=GET path=/wp-login.php status=301 duration=9239ms 2026-10-09T13:32:04.800371-07:00 db-replica app[30064]: INFO request_id=766be2fec61338a6 method=GET path=/static/main.css status=404 duration=1160ms 2026-10-09T13:32:04.977448-07:00 worker-12 nginx[1202]: 91.206.167.243 - deploy "POST /wp-login.php HTTP/1.1" 500 43648 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:05.000074-07:00 bastion app[30620]: INFO request_id=c819e5b1663b7a83 method=GET path=/favicon.ico status=302 duration=8210ms 2026-10-09T13:32:05.117981-07:00 bastion sshd[1222]: Accepted publickey for priya from 45.232.132.41 port 54733 ssh2: ED25519 SHA256:0d1b886b867e93e1 2026-10-09T13:32:05.120321-07:00 worker-12 sshd[58202]: Connection closed by 172.169.227.100 port 20477 [preauth] 2026-10-09T13:32:05.141095-07:00 db-primary app[30962]: INFO request_id=81ce678b1f857b0f method=GET path=/api/v2/search?q=invoice status=301 duration=7308ms 2026-10-09T13:32:05.172195-07:00 web-02 app[30348]: INFO worker 98 picked job c9dff14613749aed from queue invoices 2026-10-09T13:32:05.247910-07:00 api-08 app[30490]: INFO worker 53 picked job bcbf41e950e663a3 from queue invoices 2026-10-09T13:32:05.369103-07:00 web-02 nginx[1204]: 91.10.66.173 - - "GET /static/main.css HTTP/1.1" 502 39320 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:05.376598-07:00 cache-3 app[30796]: INFO order 95668 confirmed for sørensen in 2871 ms (region us-east-1, queue webhooks) 2026-10-09T13:32:05.450386-07:00 bastion app[30204]: INFO order 89537 confirmed for deploy in 5275 ms (region us-east-1, queue webhooks) 2026-10-09T13:32:05.493038-07:00 worker-12 nginx[1201]: 91.39.69.50 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 58744 "-" "curl/8.4.0" 2026-10-09T13:32:05.595138-07:00 web-02 app[30508]: INFO order 10665 confirmed for priya in 1247 ms (region eu-west-1, queue orders) 2026-10-09T13:32:05.644130-07:00 web-03 systemd[1]: session-39651.scope: Deactivated successfully. 2026-10-09T13:32:05.740779-07:00 web-01 app[30571]: INFO health check ok: db 570 ms, cache 570 ms, queue depth 83 2026-10-09T13:32:05.806071-07:00 db-replica sshd[23839]: Failed password for invalid user deploy from 45.104.168.207 port 63587 ssh2 2026-10-09T13:32:05.818952-07:00 web-03 nginx[1208]: 45.134.63.141 - - "GET /login HTTP/1.1" 301 2477 "-" "Go-http-client/1.1" 2026-10-09T13:32:05.824450-07:00 bastion sshd[11923]: Connection closed by 91.139.11.44 port 8478 [preauth] 2026-10-09T13:32:05.928026-07:00 edge-fr-1 nginx[1207]: 91.212.248.146 - - "GET /api/v2/orders HTTP/1.1" 301 61864 "-" "kube-probe/1.31" 2026-10-09T13:32:05.936114-07:00 api-08 nginx[1209]: 10.245.10.240 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 87642 "-" "Go-http-client/1.1" 2026-10-09T13:32:05.997517-07:00 db-primary app[30726]: INFO request_id=de2c2dd16a81ce53 method=GET path=/static/app.js status=404 duration=7029ms 2026-10-09T13:32:06.246440-07:00 worker-12 app[30027]: INFO order 43943 confirmed for backup in 2226 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:32:06.278216-07:00 web-03 nginx[1207]: 172.32.60.137 - - "GET /metrics HTTP/1.1" 302 15137 "-" "kube-probe/1.31" 2026-10-09T13:32:06.457129-07:00 db-primary app[30055]: INFO order 39692 confirmed for akira in 6110 ms (region ap-northeast-1, queue emails) 2026-10-09T13:32:06.724516-07:00 web-02 app[30084]: INFO request_id=92220f7794d693c7 method=GET path=/metrics status=500 duration=5455ms 2026-10-09T13:32:06.725146-07:00 bastion haproxy[947]: 91.66.141.169:34337 [54773] http-in app/api-08 9151/0/384/384/9151 500 70389 - - ---- 836/836/33/33/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:06.933304-07:00 web-03 sshd[907]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:32:07.029055-07:00 edge-fr-1 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:32:07.060526-07:00 web-02 app[30977]: INFO request_id=ab3850b547a2dc0b method=GET path=/static/app.js status=302 duration=4786ms 2026-10-09T13:32:07.110061-07:00 web-03 nginx[1210]: 172.170.204.179 - - "GET /admin HTTP/1.1" 302 5855 "-" "python-requests/2.32.3" 2026-10-09T13:32:07.128043-07:00 db-replica sshd[31041]: Failed password for invalid user ci from 192.93.145.190 port 29126 ssh2 2026-10-09T13:32:07.238691-07:00 edge-fr-1 sshd[20349]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:32:07.271870-07:00 cache-3 sshd[62728]: Invalid user sørensen from 91.80.104.207 port 23173 2026-10-09T13:32:07.653255-07:00 cache-3 haproxy[936]: 10.58.7.194:52575 [34153] http-in app/db-replica 1063/0/86/86/1063 200 83648 - - ---- 771/771/32/32/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:32:07.679815-07:00 api-08 nginx[1205]: 45.216.114.112 - - "GET /.env HTTP/1.1" 302 76167 "-" "python-requests/2.32.3" 2026-10-09T13:32:07.813288-07:00 web-02 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:32:07.943115-07:00 cache-3 app[30654]: INFO worker 12 picked job e5289a0b7e17d65b from queue invoices 2026-10-09T13:32:08.021036-07:00 api-07 app[30167]: INFO request_id=c462aec253c5eb4a method=GET path=/metrics status=200 duration=1129ms 2026-10-09T13:32:08.064036-07:00 worker-12 nginx[1207]: 10.48.251.142 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 46737 "-" "Go-http-client/1.1" 2026-10-09T13:32:08.156200-07:00 web-02 app[30068]: INFO request_id=14aa2ff4746acc73 method=GET path=/metrics status=204 duration=2602ms 2026-10-09T13:32:08.225466-07:00 api-07 haproxy[917]: 10.185.233.218:44708 [54060] http-in app/bastion 5332/0/811/811/5332 200 77305 - - ---- 206/206/74/74/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:32:08.234509-07:00 web-02 haproxy[910]: 10.30.29.80:61218 [86135] http-in app/api-08 2028/0/285/285/2028 204 23986 - - ---- 975/975/26/26/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:08.290350-07:00 bastion app[30324]: INFO request_id=095d86349dafd46b method=GET path=/admin status=302 duration=143ms 2026-10-09T13:32:08.326522-07:00 db-primary app[30723]: INFO worker 97 finished job 4eb08002bb10d591 in 9336 ms 2026-10-09T13:32:08.539713-07:00 cache-3 haproxy[927]: 172.206.58.33:58563 [26631] http-in app/edge-fr-1 5982/0/635/635/5982 301 21560 - - ---- 532/532/85/85/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:32:08.663373-07:00 edge-fr-1 app[30406]: INFO worker 10 finished job c0659ecca508e0a3 in 1837 ms 2026-10-09T13:32:08.751664-07:00 db-replica app[30751]: INFO request_id=8f3a897c009ae820 method=GET path=/api/v2/users status=404 duration=2891ms 2026-10-09T13:32:08.813321-07:00 api-07 sshd[8506]: Accepted publickey for root from 10.184.34.47 port 6940 ssh2: ED25519 SHA256:67e0f94e01fdbb8c 2026-10-09T13:32:08.825089-07:00 cache-3 app[30918]: INFO request_id=e2d827810e9308bc method=GET path=/static/app.js status=200 duration=2601ms 2026-10-09T13:32:08.868226-07:00 cache-3 nginx[1202]: 203.28.135.41 - - "GET /wp-login.php HTTP/1.1" 200 35956 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:08.917524-07:00 db-replica postgres[21317]: LOG: duration: 3680.837 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:08.937489-07:00 worker-12 app[30432]: INFO order 94602 confirmed for françois in 2921 ms (region us-east-1, queue emails) 2026-10-09T13:32:09.007920-07:00 worker-12 sshd[60357]: Received disconnect from 45.135.184.169 port 31170:11: Bye Bye [preauth] 2026-10-09T13:32:09.085512-07:00 web-03 nginx[1204]: 91.82.142.110 - - "GET /api/v2/users HTTP/1.1" 500 27158 "-" "curl/8.4.0" 2026-10-09T13:32:09.089151-07:00 web-02 sshd[54730]: Received disconnect from 172.88.195.229 port 32040:11: Bye Bye [preauth] 2026-10-09T13:32:09.146426-07:00 cache-3 app[30683]: INFO worker 37 picked job ce9bc5aa3965d939 from queue invoices 2026-10-09T13:32:09.239302-07:00 web-01 haproxy[913]: 45.217.100.43:63605 [28265] http-in app/bastion 3697/0/440/440/3697 200 11976 - - ---- 316/316/65/65/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:32:09.316867-07:00 web-01 nginx[1206]: 172.115.217.153 - backup "POST /wp-login.php HTTP/1.1" 200 82558 "-" "kube-probe/1.31" 2026-10-09T13:32:09.325169-07:00 web-03 app[30715]: INFO worker 43 picked job 1ef227a9c338adf3 from queue webhooks 2026-10-09T13:32:10.383271-07:00 edge-fr-1 app[30454]: INFO worker 36 picked job f4c13731229b35ed from queue invoices 2026-10-09T13:32:10.404061-07:00 web-02 sshd[63200]: Failed password for invalid user müller from 10.182.195.65 port 23778 ssh2 2026-10-09T13:32:10.553426-07:00 db-replica app[30290]: DEBUG cache hit ratio 15% over the last minute (41622 lookups) 2026-10-09T13:32:10.615528-07:00 edge-fr-1 postgres[8031]: LOG: checkpoint complete: wrote 2761 buffers (93%); 0 WAL file(s) added, 0 removed, 74 recycled; write=8152.388 s, sync=0.388 s, total=8152.388 s 2026-10-09T13:32:10.702370-07:00 web-01 nginx[1203]: 91.9.189.231 - - "GET /.env HTTP/1.1" 200 5531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:10.911592-07:00 edge-fr-1 app[30223]: INFO worker 30 picked job 4c1043444bab32b7 from queue orders 2026-10-09T13:32:10.928505-07:00 db-primary sshd[40052]: Failed password for invalid user müller from 45.145.81.223 port 50881 ssh2 2026-10-09T13:32:10.976233-07:00 api-08 postgres[14690]: LOG: checkpoint complete: wrote 9981 buffers (27%); 0 WAL file(s) added, 0 removed, 59 recycled; write=6977.451 s, sync=0.451 s, total=6977.451 s 2026-10-09T13:32:11.038627-07:00 db-replica sshd[5161]: pam_unix(sshd:session): session opened for user akira(uid=4952) by (uid=0) 2026-10-09T13:32:11.046414-07:00 bastion haproxy[929]: Server app/api-08 is DOWN, reason: Layer4 timeout, check duration: 9596ms. 62 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:32:11.156771-07:00 cache-3 systemd[1]: session-22992.scope: Deactivated successfully. 2026-10-09T13:32:11.184042-07:00 web-02 sshd[5522]: pam_unix(sshd:session): session opened for user françois(uid=9663) by (uid=0) 2026-10-09T13:32:11.190062-07:00 api-07 app[30253]: INFO request_id=36315a8783243b96 method=GET path=/.env status=200 duration=2086ms 2026-10-09T13:32:11.508803-07:00 web-01 app[30445]: INFO order 39880 confirmed for priya in 134 ms (region eu-west-1, queue invoices) 2026-10-09T13:32:11.603135-07:00 worker-12 nginx[1201]: 10.163.132.56 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 37321 "-" "kube-probe/1.31" 2026-10-09T13:32:11.928165-07:00 cache-3 app[30118]: INFO worker 81 picked job 58c05c2587b0f8ad from queue invoices 2026-10-09T13:32:11.995093-07:00 web-03 app[30384]: INFO worker 65 finished job d68d78ae5a0d213a in 2840 ms 2026-10-09T13:32:12.502310-07:00 db-primary haproxy[943]: 91.24.191.60:37681 [27187] http-in app/web-03 9534/0/307/307/9534 200 78085 - - ---- 184/184/92/92/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:32:12.513496-07:00 api-08 app[30372]: INFO request_id=a7ebcdf76e442c49 method=GET path=/static/main.css status=404 duration=9666ms 2026-10-09T13:32:12.634820-07:00 db-replica postgres[19343]: LOG: duration: 4200.450 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:12.837799-07:00 web-02 nginx[1204]: 10.50.157.135 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 62904 "-" "curl/8.4.0" 2026-10-09T13:32:13.157349-07:00 worker-12 sshd[2097]: Received disconnect from 91.78.142.98 port 5388:11: Bye Bye [preauth] 2026-10-09T13:32:13.266734-07:00 bastion app[30512]: DEBUG cache hit ratio 87% over the last minute (79126 lookups) 2026-10-09T13:32:13.305001-07:00 web-01 postgres[11133]: LOG: duration: 9409.526 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:13.369156-07:00 api-08 nginx[1203]: 203.99.235.247 - - "GET /health HTTP/1.1" 404 68440 "-" "kube-probe/1.31" 2026-10-09T13:32:13.441428-07:00 db-replica app[30772]: INFO order 24505 confirmed for akira in 9514 ms (region us-east-1, queue webhooks) 2026-10-09T13:32:13.486134-07:00 web-03 app[30995]: WARN retrying upstream 192.115.22.123:5554 after timeout (2424 ms), attempt 3 of 3 2026-10-09T13:32:13.526968-07:00 api-07 app[30713]: INFO order 81475 confirmed for priya in 47 ms (region us-east-1, queue emails) 2026-10-09T13:32:13.602997-07:00 bastion postgres[9692]: LOG: duration: 1165.354 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:13.635509-07:00 edge-fr-1 app[30356]: INFO request_id=1392615e0e44451c method=GET path=/login status=404 duration=4145ms 2026-10-09T13:32:13.690213-07:00 db-replica postgres[29616]: LOG: duration: 6862.983 ms statement: SELECT * FROM orders WHERE customer_id = 83558 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:13.706806-07:00 web-02 app[30702]: INFO worker 31 picked job 2cb77c3288eb853a from queue invoices 2026-10-09T13:32:13.732700-07:00 web-02 postgres[13114]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 90182 remain, 9870 scanned (46% of total) 2026-10-09T13:32:13.939742-07:00 edge-fr-1 app[30281]: INFO order 21926 confirmed for backup in 9768 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:32:13.965854-07:00 api-07 nginx[1207]: 192.241.113.50 - - "GET /static/main.css HTTP/1.1" 200 20224 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:13.978354-07:00 worker-12 nginx[1205]: 192.25.113.160 - - "GET /favicon.ico HTTP/1.1" 404 59355 "-" "Go-http-client/1.1" 2026-10-09T13:32:14.077746-07:00 bastion app[30653]: INFO request_id=3f00cc7cc7bfbf24 method=GET path=/login status=404 duration=4937ms 2026-10-09T13:32:14.387239-07:00 api-08 nginx[1205]: 192.165.225.152 - - "GET /static/main.css HTTP/1.1" 200 43594 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:14.415205-07:00 api-08 haproxy[941]: 10.120.150.196:34512 [68130] http-in app/db-primary 7648/0/132/132/7648 302 8356 - - ---- 235/235/68/68/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:32:14.453094-07:00 db-primary app[30112]: INFO worker 13 finished job d2ccffbd16380329 in 5042 ms 2026-10-09T13:32:14.787199-07:00 cache-3 app[30024]: INFO order 78485 confirmed for zoë in 8548 ms (region us-east-1, queue webhooks) 2026-10-09T13:32:14.878827-07:00 bastion app[30258]: INFO request_id=1f29d781e535bc09 method=GET path=/favicon.ico status=200 duration=8389ms 2026-10-09T13:32:15.133482-07:00 web-01 app[30879]: DEBUG cache hit ratio 28% over the last minute (93662 lookups) 2026-10-09T13:32:15.204019-07:00 edge-fr-1 app[30909]: INFO request_id=fedb102b6c52b773 method=GET path=/wp-login.php status=200 duration=9570ms 2026-10-09T13:32:15.328028-07:00 web-02 nginx[1205]: 203.48.137.150 - - "GET /admin HTTP/1.1" 200 5130 "-" "python-requests/2.32.3" 2026-10-09T13:32:15.331672-07:00 api-08 haproxy[900]: 203.216.232.238:54722 [22046] http-in app/web-02 913/0/423/423/913 500 20487 - - ---- 102/102/22/22/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:15.399523-07:00 api-07 kernel: [62614.773225] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/app.service,task=java,pid=62614,uid=9939 2026-10-09T13:32:15.502044-07:00 api-07 cron[10250]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:15.560158-07:00 worker-12 sshd[14180]: Received disconnect from 172.157.151.110 port 53210:11: Bye Bye [preauth] 2026-10-09T13:32:15.641838-07:00 api-07 app[30340]: INFO worker 90 finished job 2593cad126831fe3 in 9646 ms 2026-10-09T13:32:15.739094-07:00 bastion systemd[1]: session-22719.scope: Deactivated successfully. 2026-10-09T13:32:15.760106-07:00 db-replica nginx[1200]: 45.5.198.59 - - "GET /favicon.ico HTTP/1.1" 200 75495 "-" "curl/8.4.0" 2026-10-09T13:32:15.774462-07:00 worker-12 cron[42504]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:15.890164-07:00 db-replica sshd[26268]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:32:16.066458-07:00 bastion app[30684]: INFO request_id=6d36bb9a0b8ac500 method=GET path=/api/v2/orders/8841 status=200 duration=3839ms 2026-10-09T13:32:16.221694-07:00 worker-12 postgres[29900]: LOG: duration: 4382.440 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:16.289478-07:00 api-08 nginx[1207]: 172.81.190.173 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 38737 "-" "curl/8.4.0" 2026-10-09T13:32:16.375350-07:00 api-07 nginx[1207]: 203.227.84.20 - - "GET /static/app.js HTTP/1.1" 200 27669 "-" "python-requests/2.32.3" 2026-10-09T13:32:16.495450-07:00 web-02 app[30730]: INFO worker 62 finished job 10b51d6f36276559 in 3631 ms 2026-10-09T13:32:16.508741-07:00 cache-3 haproxy[934]: 172.3.137.123:11583 [24641] http-in app/worker-12 2991/0/378/378/2991 502 5108 - - ---- 614/614/47/47/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:32:16.668268-07:00 api-08 nginx[1208]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.128.78.29, server: app.example.com, request: "GET /api/v2/orders/8841 HTTP/1.1", upstream: "http://10.0.155.155:8080/api/v2/orders/8841" 2026-10-09T13:32:16.803782-07:00 worker-12 nginx[1200]: 172.186.43.87 - sørensen "POST /.env HTTP/1.1" 301 60602 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:16.836564-07:00 cache-3 systemd[1]: logrotate.service: Deactivated successfully. 2026-10-09T13:32:16.864442-07:00 db-primary app[30017]: INFO order 78578 confirmed for akira in 5040 ms (region us-east-1, queue orders) 2026-10-09T13:32:17.001490-07:00 api-08 app[30567]: INFO order 48946 confirmed for sørensen in 1836 ms (region ap-northeast-1, queue emails) 2026-10-09T13:32:17.007842-07:00 web-01 app[30035]: INFO request_id=a0b5cc07f53f4683 method=GET path=/api/v2/search?q=invoice status=302 duration=1206ms 2026-10-09T13:32:17.031930-07:00 bastion nginx[1200]: 192.149.153.62 - zoë "POST /login HTTP/1.1" 301 46572 "-" "curl/8.4.0" 2026-10-09T13:32:17.168677-07:00 web-03 nginx[1201]: 192.90.219.194 - müller "POST /api/v2/users HTTP/1.1" 204 78805 "-" "curl/8.4.0" 2026-10-09T13:32:17.178839-07:00 db-primary app[30755]: INFO worker 17 picked job 7c6b99469149964c from queue emails 2026-10-09T13:32:17.237388-07:00 worker-12 kernel: [47271.099352] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.137.58.154 DST=10.0.965.965 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=47271 DF PROTO=TCP SPT=10986 DPT=10986 WINDOW=47271 RES=0x00 SYN URGP=0 2026-10-09T13:32:17.261869-07:00 web-01 app[30497]: INFO order 41605 confirmed for deploy in 5003 ms (region eu-west-1, queue webhooks) 2026-10-09T13:32:17.309111-07:00 web-01 sshd[39195]: Connection closed by 172.53.77.26 port 16426 [preauth] 2026-10-09T13:32:17.360948-07:00 cache-3 nginx[1200]: 192.121.136.179 - - "GET /api/v2/orders HTTP/1.1" 500 46753 "-" "Go-http-client/1.1" 2026-10-09T13:32:17.580284-07:00 bastion nginx[1202]: 45.162.49.214 - - "GET /api/v2/users HTTP/1.1" 200 65793 "-" "Go-http-client/1.1" 2026-10-09T13:32:17.628700-07:00 web-01 app[30908]: DEBUG cache hit ratio 87% over the last minute (93792 lookups) 2026-10-09T13:32:17.649242-07:00 api-08 nginx[1207]: 192.28.211.158 - - "GET /health HTTP/1.1" 200 23495 "-" "python-requests/2.32.3" 2026-10-09T13:32:17.769623-07:00 web-03 app[30563]: INFO request_id=414c0b65c4d241ca method=GET path=/metrics status=404 duration=2775ms 2026-10-09T13:32:17.799447-07:00 web-01 sshd[56094]: Accepted publickey for zoë from 203.219.152.117 port 53705 ssh2: ED25519 SHA256:fe0fbe04821aa560 2026-10-09T13:32:18.195206-07:00 worker-12 kernel: [12918.756957] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.237.237.32 DST=10.0.968.968 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=12918 DF PROTO=TCP SPT=52889 DPT=52889 WINDOW=12918 RES=0x00 SYN URGP=0 2026-10-09T13:32:18.293430-07:00 web-02 haproxy[933]: 192.114.190.216:59828 [80250] http-in app/api-08 693/0/341/341/693 302 27262 - - ---- 300/300/89/89/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:18.493196-07:00 worker-12 sshd[57903]: Connection closed by 91.74.219.219 port 52218 [preauth] 2026-10-09T13:32:18.546757-07:00 worker-12 haproxy[916]: 172.167.185.35:41823 [70289] http-in app/worker-12 5602/0/576/576/5602 404 64636 - - ---- 382/382/32/32/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:18.644255-07:00 bastion app[30755]: ERROR cache miss storm: 8223 misses in 4817 ms, key prefix session:priya 2026-10-09T13:32:18.833737-07:00 cache-3 nginx[1209]: 192.245.196.11 - ci "POST /admin HTTP/1.1" 200 44239 "-" "curl/8.4.0" 2026-10-09T13:32:18.919043-07:00 db-replica kernel: [96441.834219] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.107.10.73 DST=10.0.863.863 LEN=14 TOS=0x00 PREC=0x00 TTL=14 ID=96441 DF PROTO=TCP SPT=62675 DPT=62675 WINDOW=96441 RES=0x00 SYN URGP=0 2026-10-09T13:32:18.984865-07:00 web-03 sshd[59600]: Connection closed by 45.38.215.125 port 58900 [preauth] 2026-10-09T13:32:19.283052-07:00 db-replica app[30031]: INFO request_id=b8ab5a32f35079d6 method=GET path=/api/v2/search?q=invoice status=200 duration=2650ms 2026-10-09T13:32:19.315614-07:00 web-02 app[30542]: INFO worker 41 finished job c209857c377f911f in 5426 ms 2026-10-09T13:32:19.331352-07:00 api-07 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:32:19.415177-07:00 api-07 app[30002]: INFO worker 81 finished job cf2ca0c2bf388522 in 472 ms 2026-10-09T13:32:19.433073-07:00 api-07 app[30959]: INFO worker 33 finished job c6bf4b2fb930e06a in 1529 ms 2026-10-09T13:32:19.617778-07:00 worker-12 nginx[1210]: 192.182.133.227 - - "GET /.env HTTP/1.1" 200 77365 "-" "python-requests/2.32.3" 2026-10-09T13:32:19.678419-07:00 edge-fr-1 systemd[1]: Started Session 77644 of User ci. 2026-10-09T13:32:20.215164-07:00 db-primary haproxy[928]: Server app/bastion is DOWN, reason: Layer4 timeout, check duration: 8556ms. 89 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue. 2026-10-09T13:32:20.402859-07:00 edge-fr-1 app[30350]: DEBUG cache hit ratio 6% over the last minute (66608 lookups) 2026-10-09T13:32:20.478404-07:00 api-08 app[30072]: INFO order 68665 confirmed for ci in 1255 ms (region eu-west-1, queue webhooks) 2026-10-09T13:32:20.793472-07:00 worker-12 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:32:20.918095-07:00 db-primary kernel: [11992.629407] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.20.124.144 DST=10.0.470.470 LEN=86 TOS=0x00 PREC=0x00 TTL=86 ID=11992 DF PROTO=TCP SPT=54806 DPT=54806 WINDOW=11992 RES=0x00 SYN URGP=0 2026-10-09T13:32:20.949699-07:00 api-07 nginx[1210]: 10.161.232.102 - zoë "POST /login HTTP/1.1" 301 69998 "-" "python-requests/2.32.3" 2026-10-09T13:32:21.006146-07:00 cache-3 app[30188]: INFO request_id=188c719fc3be0a5d method=GET path=/api/v2/search?q=invoice status=404 duration=1042ms 2026-10-09T13:32:21.634996-07:00 web-02 app[30954]: INFO order 26718 confirmed for deploy in 4526 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:32:21.758171-07:00 cache-3 sshd[57461]: Received disconnect from 192.138.36.112 port 33656:11: Bye Bye [preauth] 2026-10-09T13:32:21.853093-07:00 db-primary nginx[1206]: 172.114.0.202 - deploy "POST /login HTTP/1.1" 200 48620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:21.868802-07:00 web-01 app[30124]: INFO request_id=e9296ec9424dadd7 method=GET path=/static/main.css status=200 duration=3703ms 2026-10-09T13:32:21.885325-07:00 web-03 nginx[1204]: 45.244.207.165 - müller "POST /api/v2/search?q=invoice HTTP/1.1" 502 395 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:21.951466-07:00 cache-3 sshd[39868]: Accepted publickey for root from 172.138.225.31 port 22253 ssh2: ED25519 SHA256:0b9cf210829a4e73 2026-10-09T13:32:21.951891-07:00 web-03 sshd[6629]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:32:22.146139-07:00 api-07 app[30100]: INFO health check ok: db 491 ms, cache 491 ms, queue depth 70 2026-10-09T13:32:22.231511-07:00 web-01 kernel: [97581.893182] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.68.127.62 DST=10.0.200.200 LEN=96 TOS=0x00 PREC=0x00 TTL=96 ID=97581 DF PROTO=TCP SPT=63265 DPT=63265 WINDOW=97581 RES=0x00 SYN URGP=0 2026-10-09T13:32:22.409522-07:00 bastion nginx[1202]: 10.71.249.67 - - "GET /health HTTP/1.1" 301 80122 "-" "curl/8.4.0" 2026-10-09T13:32:22.434078-07:00 web-01 systemd[1]: Started Session 74121 of User müller. 2026-10-09T13:32:22.701346-07:00 bastion sshd[43962]: Connection closed by 10.128.50.73 port 37933 [preauth] 2026-10-09T13:32:22.724503-07:00 bastion app[30882]: INFO worker 47 finished job 4ceb937b0398cef9 in 360 ms 2026-10-09T13:32:23.074716-07:00 api-07 nginx[1207]: 203.20.250.42 - - "GET /login HTTP/1.1" 200 26613 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:23.113943-07:00 db-primary haproxy[901]: 192.127.128.171:62696 [51862] http-in app/api-08 5150/0/726/726/5150 200 50340 - - ---- 178/178/57/57/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:23.183421-07:00 api-07 kernel: [98562.829825] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.110.84.153 DST=10.0.742.742 LEN=32 TOS=0x00 PREC=0x00 TTL=32 ID=98562 DF PROTO=TCP SPT=5590 DPT=5590 WINDOW=98562 RES=0x00 SYN URGP=0 2026-10-09T13:32:23.221797-07:00 db-replica app[30632]: DEBUG cache hit ratio 77% over the last minute (36607 lookups) 2026-10-09T13:32:23.341606-07:00 db-replica haproxy[944]: 172.240.151.24:21366 [35624] http-in app/edge-fr-1 4973/0/700/700/4973 401 53190 - - ---- 151/151/20/20/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:32:23.379296-07:00 edge-fr-1 app[30663]: INFO worker 79 finished job a43af1bbc7371690 in 6315 ms 2026-10-09T13:32:23.525857-07:00 web-01 kernel: [35541.363216] TCP: request_sock_TCP: Possible SYN flooding on port 47618. Sending cookies. Check SNMP counters. 2026-10-09T13:32:23.578956-07:00 db-replica app[30293]: INFO request_id=eec22ef11e120973 method=GET path=/api/v2/users status=200 duration=1746ms 2026-10-09T13:32:23.798621-07:00 cache-3 app[30691]: INFO request_id=0af9c92fcb651c28 method=GET path=/metrics status=200 duration=1385ms 2026-10-09T13:32:23.844078-07:00 db-primary nginx[1202]: 172.97.240.46 - sørensen "POST /.env HTTP/1.1" 500 15687 "-" "kube-probe/1.31" 2026-10-09T13:32:24.009454-07:00 edge-fr-1 postgres[13833]: LOG: duration: 8702.127 ms statement: SELECT * FROM orders WHERE customer_id = 97180 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:24.164822-07:00 web-01 nginx[1202]: 172.242.207.62 - ci "POST /wp-login.php HTTP/1.1" 200 72734 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:24.189875-07:00 web-01 app[30170]: INFO order 65858 confirmed for deploy in 4960 ms (region us-east-1, queue webhooks) 2026-10-09T13:32:24.363332-07:00 db-primary kernel: [32536.744253] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.225.200.156 DST=10.0.875.875 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=32536 DF PROTO=TCP SPT=52355 DPT=52355 WINDOW=32536 RES=0x00 SYN URGP=0 2026-10-09T13:32:24.413544-07:00 edge-fr-1 app[30717]: INFO health check ok: db 223 ms, cache 223 ms, queue depth 23 2026-10-09T13:32:24.679750-07:00 edge-fr-1 nginx[1205]: 10.250.64.187 - akira "POST /api/v2/search?q=invoice HTTP/1.1" 200 71799 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:24.701976-07:00 edge-fr-1 nginx[1202]: 10.245.216.3 - - "GET /admin HTTP/1.1" 200 62116 "-" "Go-http-client/1.1" 2026-10-09T13:32:24.760638-07:00 web-03 app[30001]: INFO request_id=0d9f0de4fc7c7c82 method=GET path=/health status=502 duration=2110ms 2026-10-09T13:32:24.791487-07:00 bastion kernel: [37125.527288] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.228.0.167 DST=10.0.340.340 LEN=68 TOS=0x00 PREC=0x00 TTL=68 ID=37125 DF PROTO=TCP SPT=32261 DPT=32261 WINDOW=37125 RES=0x00 SYN URGP=0 2026-10-09T13:32:24.990330-07:00 web-02 kernel: [77772.646221] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.37.100.67 DST=10.0.406.406 LEN=80 TOS=0x00 PREC=0x00 TTL=80 ID=77772 DF PROTO=TCP SPT=53955 DPT=53955 WINDOW=77772 RES=0x00 SYN URGP=0 2026-10-09T13:32:25.000802-07:00 api-07 nginx[1201]: 192.21.246.172 - - "GET /static/main.css HTTP/1.1" 200 49303 "-" "python-requests/2.32.3" 2026-10-09T13:32:25.100251-07:00 web-03 app[30563]: INFO request_id=97ccc712690bd1df method=GET path=/api/v2/orders/8841 status=200 duration=1669ms 2026-10-09T13:32:25.167389-07:00 web-02 app[30784]: INFO order 69185 confirmed for root in 1160 ms (region eu-west-1, queue orders) 2026-10-09T13:32:25.334627-07:00 api-08 nginx[1206]: 45.202.40.30 - - "GET /wp-login.php HTTP/1.1" 301 59838 "-" "Go-http-client/1.1" 2026-10-09T13:32:25.456728-07:00 api-08 app[30433]: INFO order 49704 confirmed for priya in 4327 ms (region eu-west-1, queue invoices) 2026-10-09T13:32:25.510854-07:00 edge-fr-1 app[30087]: DEBUG cache hit ratio 47% over the last minute (61692 lookups) 2026-10-09T13:32:25.707490-07:00 api-08 sshd[19996]: Accepted publickey for akira from 45.210.237.43 port 9777 ssh2: ED25519 SHA256:f3cda78d57a28165 2026-10-09T13:32:25.777037-07:00 web-02 app[30638]: INFO request_id=d356260399ec6fb4 method=GET path=/api/v2/users status=200 duration=5894ms 2026-10-09T13:32:25.898776-07:00 cache-3 sshd[55769]: Accepted publickey for ci from 192.202.172.117 port 30251 ssh2: ED25519 SHA256:b5fb06a228adfa7a 2026-10-09T13:32:26.018389-07:00 web-03 systemd[1]: session-17772.scope: Deactivated successfully. 2026-10-09T13:32:26.142967-07:00 api-08 nginx[1209]: 45.81.198.32 - françois "POST /api/v2/users HTTP/1.1" 200 43059 "-" "python-requests/2.32.3" 2026-10-09T13:32:26.263052-07:00 cache-3 app[30938]: INFO order 45703 confirmed for backup in 9691 ms (region eu-west-1, queue webhooks) 2026-10-09T13:32:26.332013-07:00 web-02 cron[33333]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:26.432008-07:00 worker-12 kernel: [71668.201444] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.183.207.168 DST=10.0.130.130 LEN=36 TOS=0x00 PREC=0x00 TTL=36 ID=71668 DF PROTO=TCP SPT=41457 DPT=41457 WINDOW=71668 RES=0x00 SYN URGP=0 2026-10-09T13:32:26.468868-07:00 worker-12 nginx[1207]: 172.138.212.185 - - "GET /admin HTTP/1.1" 500 46785 "-" "curl/8.4.0" 2026-10-09T13:32:26.915547-07:00 bastion dockerd[700]: time="2026-10-09T13:32:26.915547-07:00" level=warning msg="Health check for container 8cc39139d1678f7e error: context deadline exceeded" 2026-10-09T13:32:27.024398-07:00 db-primary systemd[1]: Started Session 75354 of User françois. 2026-10-09T13:32:27.142149-07:00 web-02 nginx[1200]: 172.7.167.162 - - "GET /health HTTP/1.1" 200 79467 "-" "python-requests/2.32.3" 2026-10-09T13:32:27.256616-07:00 cache-3 sshd[56805]: Invalid user backup from 172.87.245.29 port 55853 2026-10-09T13:32:27.302695-07:00 web-03 sshd[35716]: Failed password for invalid user müller from 192.89.227.78 port 54015 ssh2 2026-10-09T13:32:27.319061-07:00 web-01 sshd[3101]: Received disconnect from 203.46.15.87 port 38565:11: Bye Bye [preauth] 2026-10-09T13:32:27.358060-07:00 edge-fr-1 app[30456]: INFO worker 20 finished job 678d0b00e08c2282 in 6874 ms 2026-10-09T13:32:27.710143-07:00 web-03 haproxy[923]: 203.160.201.249:51431 [34789] http-in app/db-primary 8271/0/78/78/8271 200 76333 - - ---- 235/235/12/12/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:27.738946-07:00 db-primary nginx[1210]: 203.115.154.166 - - "GET /.env HTTP/1.1" 500 85923 "-" "Go-http-client/1.1" 2026-10-09T13:32:27.802550-07:00 web-01 sshd[35297]: Accepted publickey for deploy from 203.13.103.78 port 12512 ssh2: ED25519 SHA256:d8b996c68967bdf5 2026-10-09T13:32:28.329783-07:00 web-02 nginx[1203]: 203.209.215.37 - priya "POST /api/v2/orders/8841 HTTP/1.1" 502 16413 "-" "Go-http-client/1.1" 2026-10-09T13:32:28.435722-07:00 db-primary nginx[1202]: 203.17.178.229 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 83914 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:28.614895-07:00 api-07 nginx[1201]: 172.242.212.197 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 64377 "-" "Go-http-client/1.1" 2026-10-09T13:32:28.792179-07:00 api-08 app[30830]: INFO worker 20 finished job cb217bfd3afe1195 in 1681 ms 2026-10-09T13:32:29.064001-07:00 worker-12 nginx[1202]: 10.12.248.108 - - "GET /metrics HTTP/1.1" 200 53829 "-" "curl/8.4.0" 2026-10-09T13:32:29.107652-07:00 cache-3 app[30403]: INFO worker 66 picked job 8e747b47849a6971 from queue invoices 2026-10-09T13:32:29.128933-07:00 web-03 cron[53262]: (müller) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:29.576966-07:00 db-replica systemd[1]: Started Session 90460 of User backup. 2026-10-09T13:32:29.629140-07:00 bastion haproxy[910]: 91.39.145.45:35578 [22692] http-in app/db-primary 1484/0/407/407/1484 500 50267 - - ---- 225/225/15/15/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:32:29.635194-07:00 edge-fr-1 sshd[55518]: Accepted publickey for françois from 45.85.46.218 port 59863 ssh2: ED25519 SHA256:09fc9e3c187a382a 2026-10-09T13:32:29.713641-07:00 db-replica nginx[1207]: 172.152.10.151 - müller "POST /api/v2/orders/8841 HTTP/1.1" 200 13966 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:30.053781-07:00 web-02 nginx[1205]: 91.171.192.99 - - "GET /api/v2/orders HTTP/1.1" 200 2877 "-" "python-requests/2.32.3" 2026-10-09T13:32:30.179797-07:00 api-07 app[30365]: INFO order 11368 confirmed for ci in 2556 ms (region eu-west-1, queue webhooks) 2026-10-09T13:32:30.371517-07:00 cache-3 app[30367]: INFO request_id=8b5c1c8842fefcbf method=GET path=/admin status=401 duration=158ms 2026-10-09T13:32:30.388553-07:00 api-07 app[30660]: WARN slow query (9529 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '71 minutes' 2026-10-09T13:32:30.677706-07:00 db-replica app[30263]: INFO worker 76 finished job d0815449a6ceee2e in 579 ms 2026-10-09T13:32:30.705382-07:00 bastion haproxy[948]: 172.58.47.182:27388 [95295] http-in app/bastion 7792/0/436/436/7792 200 19904 - - ---- 150/150/36/36/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:30.957452-07:00 edge-fr-1 sudo: sørensen : TTY=pts/0 ; PWD=/home/sørensen ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:32:30.964182-07:00 db-primary app[30721]: INFO request_id=29603a19fc602564 method=GET path=/login status=302 duration=5317ms 2026-10-09T13:32:31.253621-07:00 web-01 sshd[31776]: Invalid user müller from 203.13.174.121 port 1872 2026-10-09T13:32:31.474584-07:00 db-primary sshd[12003]: Accepted publickey for backup from 45.117.175.98 port 47762 ssh2: ED25519 SHA256:7e0b9392ceb95927 2026-10-09T13:32:31.539350-07:00 db-replica systemd[1]: Started Session 47778 of User deploy. 2026-10-09T13:32:31.539445-07:00 web-03 nginx[1204]: 45.154.128.129 - - "GET /health HTTP/1.1" 302 15297 "-" "kube-probe/1.31" 2026-10-09T13:32:31.745785-07:00 api-07 sshd[38460]: Connection closed by 45.39.58.108 port 20571 [preauth] 2026-10-09T13:32:31.745995-07:00 db-primary nginx[1209]: 172.59.249.158 - - "GET /admin HTTP/1.1" 502 84523 "-" "kube-probe/1.31" 2026-10-09T13:32:31.819305-07:00 api-08 postgres[24012]: LOG: duration: 9436.682 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:32.024059-07:00 worker-12 haproxy[919]: 10.255.180.193:51066 [79937] http-in app/cache-3 9303/0/115/115/9303 502 59969 - - ---- 571/571/38/38/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:32:32.433212-07:00 edge-fr-1 kernel: [25262.139483] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.133.11.31 DST=10.0.748.748 LEN=47 TOS=0x00 PREC=0x00 TTL=47 ID=25262 DF PROTO=TCP SPT=4673 DPT=4673 WINDOW=25262 RES=0x00 SYN URGP=0 2026-10-09T13:32:32.495703-07:00 api-07 app[30234]: INFO order 46078 confirmed for priya in 7458 ms (region eu-west-1, queue invoices) 2026-10-09T13:32:32.652044-07:00 web-01 haproxy[902]: 172.144.216.93:39180 [17543] http-in app/db-primary 4744/0/519/519/4744 200 31857 - - ---- 902/902/79/79/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:32.864336-07:00 cache-3 sshd[6593]: Accepted publickey for backup from 192.190.110.52 port 19900 ssh2: ED25519 SHA256:a2db6e8a3499cf47 2026-10-09T13:32:33.149585-07:00 api-08 postgres[2488]: LOG: duration: 4215.195 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:33.152362-07:00 web-03 sshd[60980]: Failed password for invalid user root from 203.204.176.221 port 36825 ssh2 2026-10-09T13:32:33.267212-07:00 cache-3 app[30382]: INFO health check ok: db 408 ms, cache 408 ms, queue depth 48 2026-10-09T13:32:33.438236-07:00 db-replica nginx[1208]: 192.87.225.135 - - "GET /api/v2/users HTTP/1.1" 404 74201 "-" "python-requests/2.32.3" 2026-10-09T13:32:33.446812-07:00 web-02 app[30620]: INFO order 20355 confirmed for akira in 5260 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:32:33.553231-07:00 cache-3 app[30882]: INFO order 59259 confirmed for root in 6211 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:32:33.566218-07:00 edge-fr-1 nginx[1203]: 10.223.80.124 - - "GET /static/main.css HTTP/1.1" 200 9575 "-" "kube-probe/1.31" 2026-10-09T13:32:33.816195-07:00 db-primary nginx[1207]: 192.170.233.170 - - "GET /favicon.ico HTTP/1.1" 200 47205 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:33.859205-07:00 api-07 app[30707]: INFO request_id=b109d94b89ce4195 method=GET path=/api/v2/orders status=500 duration=4801ms 2026-10-09T13:32:34.287619-07:00 edge-fr-1 sshd[14780]: pam_unix(sshd:session): session opened for user françois(uid=9708) by (uid=0) 2026-10-09T13:32:34.408467-07:00 api-07 app[30630]: INFO request_id=5f297865420036ff method=GET path=/static/main.css status=204 duration=3382ms 2026-10-09T13:32:34.439277-07:00 api-08 postgres[17587]: LOG: duration: 3806.950 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:34.508987-07:00 db-primary postgres[15154]: LOG: duration: 7320.22 ms statement: SELECT * FROM orders WHERE customer_id = 30180 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:34.540633-07:00 edge-fr-1 app[30498]: INFO worker 53 picked job afc225b1ceff7945 from queue webhooks 2026-10-09T13:32:34.570115-07:00 api-08 nginx[1204]: 192.41.111.130 - - "GET /login HTTP/1.1" 200 4825 "-" "curl/8.4.0" 2026-10-09T13:32:34.659074-07:00 api-08 nginx[1203]: 10.96.77.10 - ci "POST /metrics HTTP/1.1" 500 33191 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:34.891314-07:00 worker-12 app[30683]: INFO health check ok: db 553 ms, cache 553 ms, queue depth 51 2026-10-09T13:32:35.373978-07:00 edge-fr-1 nginx[1208]: 192.94.42.211 - - "GET /favicon.ico HTTP/1.1" 500 44684 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:35.438256-07:00 web-01 app[30148]: INFO health check ok: db 785 ms, cache 785 ms, queue depth 32 2026-10-09T13:32:35.453419-07:00 web-03 nginx[1205]: 172.87.193.199 - - "GET /api/v2/orders HTTP/1.1" 401 34080 "-" "python-requests/2.32.3" 2026-10-09T13:32:35.603484-07:00 web-02 sshd[48847]: Connection closed by 192.152.143.130 port 39891 [preauth] 2026-10-09T13:32:35.726041-07:00 db-primary app[30408]: INFO request_id=ebd1cd291c85789b method=GET path=/wp-login.php status=200 duration=4917ms 2026-10-09T13:32:35.863422-07:00 web-03 systemd[1]: session-58057.scope: Deactivated successfully. 2026-10-09T13:32:35.876966-07:00 db-primary kubelet[800]: I1009 13:32:35.898792 9670 kubelet.go:9670] "Pod is terminating, skipping pod status update" pod="default/api-0a1ed36da415f30e" 2026-10-09T13:32:36.182683-07:00 bastion app[30929]: INFO health check ok: db 239 ms, cache 239 ms, queue depth 28 2026-10-09T13:32:36.246212-07:00 worker-12 app[30072]: INFO health check ok: db 183 ms, cache 183 ms, queue depth 38 2026-10-09T13:32:36.392364-07:00 edge-fr-1 app[30094]: INFO request_id=e5ab7b655bef6688 method=GET path=/api/v2/users status=404 duration=8634ms 2026-10-09T13:32:36.397710-07:00 web-02 haproxy[939]: 45.234.149.228:39762 [27899] http-in app/web-01 8026/0/845/845/8026 404 69833 - - ---- 375/375/95/95/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:32:36.572674-07:00 worker-12 haproxy[929]: 10.126.112.104:28812 [75410] http-in app/web-01 8221/0/207/207/8221 404 78730 - - ---- 648/648/30/30/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:36.645558-07:00 web-03 app[30430]: INFO worker 38 finished job 5a4762ca5166047d in 4625 ms 2026-10-09T13:32:36.794703-07:00 cache-3 sshd[6438]: Accepted publickey for müller from 45.208.207.252 port 47325 ssh2: ED25519 SHA256:58319c53b2c44dc3 2026-10-09T13:32:36.990852-07:00 cache-3 sshd[8634]: Accepted publickey for akira from 172.151.85.27 port 30321 ssh2: ED25519 SHA256:58c3033251361d98 2026-10-09T13:32:37.023896-07:00 web-01 app[30619]: WARN retrying upstream 91.1.167.118:55402 after timeout (3288 ms), attempt 2 of 3 2026-10-09T13:32:37.152724-07:00 api-07 app[30804]: INFO health check ok: db 631 ms, cache 631 ms, queue depth 53 2026-10-09T13:32:37.226614-07:00 db-replica app[30322]: INFO order 30174 confirmed for ci in 9910 ms (region eu-west-1, queue emails) 2026-10-09T13:32:37.403295-07:00 worker-12 haproxy[901]: 10.22.15.72:63764 [87654] http-in app/db-replica 4120/0/3/3/4120 404 18026 - - ---- 303/303/76/76/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:37.555137-07:00 cache-3 nginx[1209]: 10.121.50.159 - deploy "POST /static/main.css HTTP/1.1" 200 12885 "-" "python-requests/2.32.3" 2026-10-09T13:32:37.589614-07:00 api-07 nginx[1204]: 203.15.122.188 - - "GET /favicon.ico HTTP/1.1" 200 33102 "-" "curl/8.4.0" 2026-10-09T13:32:37.590202-07:00 bastion nginx[1205]: 192.214.255.90 - zoë "POST /wp-login.php HTTP/1.1" 301 7041 "-" "Go-http-client/1.1" 2026-10-09T13:32:37.776345-07:00 web-02 sshd[9650]: Failed password for invalid user root from 203.29.23.28 port 47483 ssh2 2026-10-09T13:32:37.953151-07:00 api-08 sshd[50341]: Connection closed by 10.228.105.15 port 63333 [preauth] 2026-10-09T13:32:38.307754-07:00 web-02 app[30212]: INFO order 19966 confirmed for priya in 5216 ms (region ap-northeast-1, queue orders) 2026-10-09T13:32:38.385171-07:00 cache-3 haproxy[917]: 91.135.216.184:62612 [44454] http-in app/db-replica 6825/0/781/781/6825 404 53309 - - ---- 898/898/19/19/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:38.396958-07:00 web-02 app[30491]: INFO worker 31 picked job 282c5f7c055b07e1 from queue emails 2026-10-09T13:32:38.680776-07:00 worker-12 nginx[1206]: 91.27.13.254 - - "GET /login HTTP/1.1" 200 47612 "-" "curl/8.4.0" 2026-10-09T13:32:38.843783-07:00 cache-3 systemd[1]: session-56365.scope: Deactivated successfully. 2026-10-09T13:32:38.906002-07:00 edge-fr-1 app[30378]: INFO worker 92 picked job 6b37a70dcbf51939 from queue emails 2026-10-09T13:32:38.935793-07:00 web-01 sshd[53296]: Received disconnect from 91.80.101.174 port 47541:11: Bye Bye [preauth] 2026-10-09T13:32:39.197061-07:00 web-02 haproxy[947]: 45.192.107.197:10246 [20738] http-in app/api-07 8054/0/796/796/8054 502 37023 - - ---- 478/478/19/19/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:32:39.231381-07:00 db-primary nginx[1202]: 203.147.80.159 - root "POST /.env HTTP/1.1" 204 78827 "-" "kube-probe/1.31" 2026-10-09T13:32:39.443542-07:00 cache-3 app[30546]: INFO request_id=1d28f35b0c9b70e5 method=GET path=/api/v2/users status=302 duration=29ms 2026-10-09T13:32:39.551994-07:00 web-03 sshd[56957]: Connection closed by 203.75.34.64 port 51152 [preauth] 2026-10-09T13:32:39.736499-07:00 db-replica sshd[9941]: Invalid user deploy from 203.8.42.210 port 19774 2026-10-09T13:32:40.188246-07:00 cache-3 nginx[1202]: 203.208.241.157 - - "GET /api/v2/orders/8841 HTTP/1.1" 204 49216 "-" "python-requests/2.32.3" 2026-10-09T13:32:40.271173-07:00 db-primary nginx[1207]: 192.227.211.159 - - "GET /health HTTP/1.1" 502 52148 "-" "kube-probe/1.31" 2026-10-09T13:32:40.312690-07:00 bastion kernel: [36846.281585] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.235.212.239 DST=10.0.680.680 LEN=75 TOS=0x00 PREC=0x00 TTL=75 ID=36846 DF PROTO=TCP SPT=8668 DPT=8668 WINDOW=36846 RES=0x00 SYN URGP=0 2026-10-09T13:32:40.717760-07:00 web-02 sshd[43906]: Failed password for invalid user françois from 10.191.170.172 port 9891 ssh2 2026-10-09T13:32:40.730383-07:00 bastion nginx[1207]: 192.107.144.230 - müller "POST /health HTTP/1.1" 200 35639 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:41.104160-07:00 db-primary nginx[1205]: 10.9.55.172 - - "GET /api/v2/orders HTTP/1.1" 200 19408 "-" "Go-http-client/1.1" 2026-10-09T13:32:41.226545-07:00 web-02 nginx[1205]: 91.32.37.46 - - "GET /.env HTTP/1.1" 200 9260 "-" "kube-probe/1.31" 2026-10-09T13:32:41.242207-07:00 web-02 nginx[1209]: 203.228.205.112 - backup "POST /wp-login.php HTTP/1.1" 200 23033 "-" "Go-http-client/1.1" 2026-10-09T13:32:41.271617-07:00 worker-12 app[30787]: INFO request_id=73b815e800109ab3 method=GET path=/static/app.js status=200 duration=6119ms 2026-10-09T13:32:41.367217-07:00 db-replica haproxy[937]: 45.123.133.75:40509 [24254] http-in app/cache-3 889/0/984/984/889 200 29120 - - ---- 406/406/55/55/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:32:41.525184-07:00 api-07 app[30465]: INFO worker 62 finished job 15eb2cb2f7299845 in 5580 ms 2026-10-09T13:32:41.585602-07:00 api-07 dockerd[700]: time="2026-10-09T13:32:41.585602-07:00" level=info msg="Container 44618ab9e9787aef exited with code 0" 2026-10-09T13:32:41.615609-07:00 db-primary haproxy[950]: 203.203.131.190:34460 [96712] http-in app/edge-fr-1 4939/0/599/599/4939 500 12648 - - ---- 261/261/28/28/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:41.631051-07:00 bastion app[30978]: INFO request_id=b27e783aa2dc6b3b method=GET path=/metrics status=301 duration=1998ms 2026-10-09T13:32:41.678306-07:00 api-07 sshd[62790]: Connection closed by 91.135.177.149 port 45056 [preauth] 2026-10-09T13:32:41.705924-07:00 web-02 haproxy[922]: 203.132.20.111:27151 [76432] http-in app/web-02 7511/0/852/852/7511 204 5088 - - ---- 135/135/26/26/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:32:41.838219-07:00 web-03 nginx[1200]: 192.103.118.125 - - "GET /wp-login.php HTTP/1.1" 302 74708 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:41.867631-07:00 api-08 sshd[49811]: Accepted publickey for priya from 172.76.215.3 port 44354 ssh2: ED25519 SHA256:9c94125770a0f70d 2026-10-09T13:32:42.017636-07:00 edge-fr-1 haproxy[909]: 192.200.18.190:17723 [80777] http-in app/db-primary 5446/0/364/364/5446 200 38515 - - ---- 936/936/98/98/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:32:42.088464-07:00 worker-12 app[30749]: INFO order 80893 confirmed for françois in 9608 ms (region us-east-1, queue orders) 2026-10-09T13:32:42.156159-07:00 web-03 nginx[1207]: 91.176.85.232 - - "GET /static/app.js HTTP/1.1" 502 18541 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:42.343381-07:00 db-replica cron[14928]: (müller) CMD (/usr/bin/backup --quiet --target /srv/müller) 2026-10-09T13:32:42.546364-07:00 bastion nginx[1205]: 10.168.42.149 - - "GET /login HTTP/1.1" 200 45517 "-" "python-requests/2.32.3" 2026-10-09T13:32:42.566510-07:00 cache-3 app[30663]: INFO worker 33 picked job 27306a752cb95bee from queue orders 2026-10-09T13:32:42.912752-07:00 cache-3 app[30987]: INFO worker 52 picked job 0e55bb98afc6c32a from queue emails 2026-10-09T13:32:43.069149-07:00 api-07 sshd[54682]: Failed password for invalid user müller from 192.72.201.168 port 58583 ssh2 2026-10-09T13:32:43.074265-07:00 edge-fr-1 sshd[23099]: Connection closed by 192.80.12.149 port 59755 [preauth] 2026-10-09T13:32:43.269438-07:00 api-08 sshd[11469]: Accepted publickey for deploy from 172.237.158.45 port 47515 ssh2: ED25519 SHA256:92485ca3daa1bde0 2026-10-09T13:32:43.386727-07:00 api-08 app[30562]: INFO worker 16 finished job c1e5d5c65d9aff03 in 536 ms 2026-10-09T13:32:43.510339-07:00 cache-3 app[30414]: INFO order 49345 confirmed for ci in 250 ms (region eu-west-1, queue emails) 2026-10-09T13:32:43.589101-07:00 bastion haproxy[904]: 192.142.9.52:44426 [80557] http-in app/db-primary 319/0/618/618/319 301 81148 - - ---- 255/255/50/50/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:43.606636-07:00 edge-fr-1 app[30626]: INFO worker 58 finished job f1e8f381cd5055e0 in 8390 ms 2026-10-09T13:32:43.683304-07:00 api-07 app[30037]: WARN slow query (1176 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '86 minutes' 2026-10-09T13:32:43.686347-07:00 db-replica nginx[1206]: 91.180.12.156 - - "GET /metrics HTTP/1.1" 200 3703 "-" "curl/8.4.0" 2026-10-09T13:32:43.699313-07:00 bastion app[30078]: INFO worker 39 finished job cc30128065c0a0f6 in 8445 ms 2026-10-09T13:32:43.774006-07:00 db-replica app[30217]: INFO request_id=a71c93cbec8a71d9 method=GET path=/login status=200 duration=4621ms 2026-10-09T13:32:44.015287-07:00 db-replica sshd[21072]: Connection closed by 192.78.101.93 port 17099 [preauth] 2026-10-09T13:32:44.041508-07:00 db-primary app[30827]: INFO request_id=c5706170d505b627 method=GET path=/wp-login.php status=404 duration=6454ms 2026-10-09T13:32:44.126086-07:00 web-02 systemd[1]: session-82730.scope: Deactivated successfully. 2026-10-09T13:32:44.209555-07:00 web-03 app[30000]: INFO request_id=ca5cfe26533cdf41 method=GET path=/api/v2/search?q=invoice status=301 duration=8884ms 2026-10-09T13:32:44.305866-07:00 api-08 nginx[1203]: 203.240.19.39 - - "GET /api/v2/search?q=invoice HTTP/1.1" 204 47202 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:44.437271-07:00 worker-12 app[30008]: INFO worker 39 finished job 2453f3b6c3124058 in 1360 ms 2026-10-09T13:32:44.488807-07:00 web-02 app[30038]: INFO health check ok: db 950 ms, cache 950 ms, queue depth 57 2026-10-09T13:32:44.582698-07:00 db-primary systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:32:44.657851-07:00 api-07 nginx[1207]: 172.241.135.165 - - "GET /api/v2/orders HTTP/1.1" 200 79258 "-" "python-requests/2.32.3" 2026-10-09T13:32:44.658521-07:00 web-03 postgres[31860]: LOG: checkpoint complete: wrote 1662 buffers (0%); 0 WAL file(s) added, 0 removed, 72 recycled; write=3613.105 s, sync=0.105 s, total=3613.105 s 2026-10-09T13:32:44.755979-07:00 db-primary nginx[1207]: 45.248.249.218 - - "GET /admin HTTP/1.1" 302 38360 "-" "python-requests/2.32.3" 2026-10-09T13:32:44.850222-07:00 api-07 nginx[1202]: 192.215.80.7 - - "GET /metrics HTTP/1.1" 401 58744 "-" "Go-http-client/1.1" 2026-10-09T13:32:44.856534-07:00 web-01 nginx[1204]: 10.7.86.245 - - "GET /health HTTP/1.1" 200 46812 "-" "Go-http-client/1.1" 2026-10-09T13:32:45.091384-07:00 bastion app[30658]: INFO order 32541 confirmed for priya in 5179 ms (region us-east-1, queue invoices) 2026-10-09T13:32:45.114990-07:00 web-02 app[30860]: INFO worker 61 picked job b83c8950aebc8138 from queue webhooks 2026-10-09T13:32:45.142749-07:00 api-07 haproxy[918]: 45.225.186.75:27923 [24731] http-in app/api-07 8616/0/812/812/8616 502 54703 - - ---- 464/464/77/77/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:32:45.187891-07:00 web-03 app[30573]: INFO request_id=a8ce3e0b563138e6 method=GET path=/static/app.js status=204 duration=8934ms 2026-10-09T13:32:45.310444-07:00 db-replica app[30586]: INFO health check ok: db 544 ms, cache 544 ms, queue depth 78 2026-10-09T13:32:45.364865-07:00 db-primary app[30712]: INFO order 16451 confirmed for zoë in 1120 ms (region us-east-1, queue invoices) 2026-10-09T13:32:45.479496-07:00 bastion app[30001]: INFO request_id=274c7eeffe4f9756 method=GET path=/static/main.css status=404 duration=5197ms 2026-10-09T13:32:45.564867-07:00 api-07 haproxy[913]: 172.226.28.222:13060 [47729] http-in app/db-primary 894/0/791/791/894 302 56900 - - ---- 874/874/16/16/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:32:45.689263-07:00 web-02 sshd[18745]: Received disconnect from 10.170.250.171 port 49470:11: Bye Bye [preauth] 2026-10-09T13:32:45.877401-07:00 web-02 postgres[25409]: LOG: duration: 445.576 ms statement: SELECT * FROM orders WHERE customer_id = 77671 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:46.002223-07:00 edge-fr-1 app[30043]: DEBUG cache hit ratio 69% over the last minute (83857 lookups) 2026-10-09T13:32:46.156662-07:00 web-01 nginx[1201]: 192.246.228.16 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 65363 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:46.278448-07:00 api-08 app[30777]: INFO order 27169 confirmed for zoë in 7318 ms (region eu-west-1, queue orders) 2026-10-09T13:32:46.583387-07:00 cache-3 sshd[62272]: Connection closed by 45.58.244.73 port 10959 [preauth] 2026-10-09T13:32:46.875881-07:00 db-primary nginx[1210]: 10.88.173.123 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 15004 "-" "Go-http-client/1.1" 2026-10-09T13:32:46.900433-07:00 web-03 haproxy[925]: 172.1.90.182:48765 [85340] http-in app/cache-3 8336/0/899/899/8336 200 30007 - - ---- 307/307/95/95/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:32:46.972929-07:00 db-replica sshd[54264]: Accepted publickey for priya from 91.13.21.98 port 43119 ssh2: ED25519 SHA256:02f8c1c8dbdc3d64 2026-10-09T13:32:47.077661-07:00 web-01 systemd[1]: Started Session 91523 of User sørensen. 2026-10-09T13:32:47.191387-07:00 web-02 app[30595]: INFO order 79966 confirmed for priya in 2409 ms (region eu-west-1, queue emails) 2026-10-09T13:32:47.270767-07:00 web-01 app[30595]: INFO request_id=73ea3835f41baff2 method=GET path=/api/v2/orders/8841 status=200 duration=6860ms 2026-10-09T13:32:47.341067-07:00 api-07 app[30060]: DEBUG cache hit ratio 16% over the last minute (52639 lookups) 2026-10-09T13:32:47.384075-07:00 api-07 nginx[1206]: 10.84.214.9 - - "GET /wp-login.php HTTP/1.1" 200 89791 "-" "Go-http-client/1.1" 2026-10-09T13:32:47.401860-07:00 worker-12 haproxy[929]: 192.182.79.11:63986 [36768] http-in app/db-primary 5678/0/124/124/5678 204 60901 - - ---- 921/921/77/77/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:32:47.513838-07:00 db-primary app[30168]: INFO order 34397 confirmed for sørensen in 9132 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:32:47.749843-07:00 worker-12 sshd[41440]: Failed password for invalid user priya from 10.199.204.22 port 19939 ssh2 2026-10-09T13:32:47.897514-07:00 worker-12 haproxy[906]: 203.149.237.220:62627 [28690] http-in app/web-01 8022/0/134/134/8022 302 33092 - - ---- 239/239/54/54/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:32:48.044343-07:00 api-07 nginx[1203]: 203.254.116.237 - - "GET /login HTTP/1.1" 502 4936 "-" "Go-http-client/1.1" 2026-10-09T13:32:48.065136-07:00 web-03 app[30538]: INFO worker 34 finished job 66e20d2fcf9ac54a in 6587 ms 2026-10-09T13:32:48.217681-07:00 web-02 haproxy[936]: 192.76.101.230:59407 [32420] http-in app/bastion 7734/0/207/207/7734 200 41225 - - ---- 286/286/42/42/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:32:48.712145-07:00 web-02 app[30058]: INFO request_id=112c50c8ce8c635a method=GET path=/favicon.ico status=404 duration=2742ms 2026-10-09T13:32:48.727389-07:00 web-02 postgres[21318]: LOG: duration: 54.632 ms statement: SELECT * FROM orders WHERE customer_id = 76193 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:48.799785-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791577968.368:17761): pid=17761 uid=0 auid=5118 ses=297 msg='op=login id=5118 exe="/usr/sbin/sshd" hostname=? addr=45.131.62.111 terminal=/dev/pts/0 res=success' 2026-10-09T13:32:48.867165-07:00 worker-12 app[30556]: INFO order 12196 confirmed for ci in 2301 ms (region eu-west-1, queue invoices) 2026-10-09T13:32:48.948689-07:00 cache-3 app[30790]: WARN slow query (6716 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '79 minutes' 2026-10-09T13:32:48.973348-07:00 web-03 app[30368]: DEBUG cache hit ratio 19% over the last minute (90712 lookups) 2026-10-09T13:32:49.240103-07:00 db-replica kernel: [20208.398357] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.164.208.107 DST=10.0.490.490 LEN=13 TOS=0x00 PREC=0x00 TTL=13 ID=20208 DF PROTO=TCP SPT=25929 DPT=25929 WINDOW=20208 RES=0x00 SYN URGP=0 2026-10-09T13:32:49.267056-07:00 worker-12 nginx[1206]: 172.158.85.142 - zoë "POST /static/app.js HTTP/1.1" 204 67236 "-" "python-requests/2.32.3" 2026-10-09T13:32:49.446603-07:00 worker-12 app[30243]: INFO request_id=c720c8e13137a2ef method=GET path=/api/v2/users status=200 duration=6170ms 2026-10-09T13:32:49.574240-07:00 edge-fr-1 app[30432]: INFO worker 74 picked job 0e7ae99c194d62bf from queue emails 2026-10-09T13:32:49.589454-07:00 bastion sshd[59324]: Accepted publickey for sørensen from 192.92.184.57 port 43265 ssh2: ED25519 SHA256:d47e3de9121be0e0 2026-10-09T13:32:49.636130-07:00 web-01 haproxy[906]: 203.13.78.219:34052 [74684] http-in app/api-07 7838/0/507/507/7838 200 7104 - - ---- 624/624/90/90/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:32:49.787663-07:00 worker-12 dockerd[700]: time="2026-10-09T13:32:49.787663-07:00" level=info msg="Container 87a7fee326941ecb exited with code 0" 2026-10-09T13:32:49.827194-07:00 api-07 app[30522]: ERROR cache miss storm: 8938 misses in 1430 ms, key prefix session:müller 2026-10-09T13:32:50.325742-07:00 bastion sshd[42163]: Received disconnect from 10.71.195.156 port 27480:11: Bye Bye [preauth] 2026-10-09T13:32:50.515640-07:00 web-01 app[30322]: INFO worker 44 finished job 23f8802bd8b89549 in 6831 ms 2026-10-09T13:32:50.533518-07:00 api-08 app[30763]: INFO request_id=ca874ff959d5b182 method=GET path=/api/v2/orders/8841 status=302 duration=4146ms 2026-10-09T13:32:50.716056-07:00 web-01 nginx[1209]: 203.135.160.119 - - "GET /favicon.ico HTTP/1.1" 404 35530 "-" "python-requests/2.32.3" 2026-10-09T13:32:50.789531-07:00 edge-fr-1 nginx[1202]: 45.37.221.43 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 17549 "-" "curl/8.4.0" 2026-10-09T13:32:50.990674-07:00 edge-fr-1 haproxy[910]: 91.85.119.133:27005 [77993] http-in app/worker-12 7997/0/523/523/7997 200 53687 - - ---- 931/931/45/45/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:32:51.039814-07:00 web-02 systemd[1]: session-63871.scope: Deactivated successfully. 2026-10-09T13:32:51.077538-07:00 edge-fr-1 app[30428]: INFO order 76123 confirmed for priya in 6188 ms (region us-east-1, queue emails) 2026-10-09T13:32:51.110113-07:00 edge-fr-1 app[30054]: INFO request_id=bfc59f67ec09a831 method=GET path=/login status=500 duration=5374ms 2026-10-09T13:32:51.134837-07:00 worker-12 app[30305]: INFO request_id=c910070a59babdb2 method=GET path=/login status=502 duration=8856ms 2026-10-09T13:32:51.294700-07:00 db-primary app[30820]: INFO request_id=cba73ac8e13c7b4c method=GET path=/admin status=200 duration=3729ms 2026-10-09T13:32:51.374385-07:00 edge-fr-1 dockerd[700]: time="2026-10-09T13:32:51.374385-07:00" level=info msg="Container a9eab1e7ac9316e3 exited with code 0" 2026-10-09T13:32:51.607460-07:00 bastion nginx[1203]: 45.27.245.95 - müller "POST /favicon.ico HTTP/1.1" 404 25326 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:51.616962-07:00 web-01 sshd[14769]: Connection closed by 172.99.191.138 port 45498 [preauth] 2026-10-09T13:32:51.906042-07:00 api-07 kernel: [70668.413948] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.72.151.142 DST=10.0.900.900 LEN=51 TOS=0x00 PREC=0x00 TTL=51 ID=70668 DF PROTO=TCP SPT=22755 DPT=22755 WINDOW=70668 RES=0x00 SYN URGP=0 2026-10-09T13:32:52.014451-07:00 edge-fr-1 haproxy[912]: 192.204.16.75:58459 [35905] http-in app/edge-fr-1 8508/0/753/753/8508 404 48525 - - ---- 771/771/98/98/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:32:52.044139-07:00 db-primary kernel: [72415.919776] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.151.148.55 DST=10.0.112.112 LEN=25 TOS=0x00 PREC=0x00 TTL=25 ID=72415 DF PROTO=TCP SPT=13256 DPT=13256 WINDOW=72415 RES=0x00 SYN URGP=0 2026-10-09T13:32:52.112312-07:00 api-08 nginx[1204]: 172.181.131.154 - - "GET /health HTTP/1.1" 301 74598 "-" "curl/8.4.0" 2026-10-09T13:32:52.317306-07:00 worker-12 app[30709]: WARN slow query (7247 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '80 minutes' 2026-10-09T13:32:52.319395-07:00 web-01 app[30341]: INFO request_id=c02d43ecf26a38f3 method=GET path=/api/v2/users status=200 duration=9988ms 2026-10-09T13:32:52.385847-07:00 db-primary nginx[1208]: 172.117.135.157 - - "GET /login HTTP/1.1" 502 2866 "-" "python-requests/2.32.3" 2026-10-09T13:32:52.833186-07:00 bastion nginx[1208]: 91.73.214.98 - - "GET /static/app.js HTTP/1.1" 200 30978 "-" "kube-probe/1.31" 2026-10-09T13:32:53.343661-07:00 web-03 postgres[18554]: LOG: duration: 4440.880 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:53.361771-07:00 worker-12 app[30749]: WARN retrying upstream 172.18.227.168:39234 after timeout (1696 ms), attempt 3 of 3 2026-10-09T13:32:53.668533-07:00 web-02 audit: type=USER_LOGIN msg=audit(1791577973.854:44064): pid=44064 uid=0 auid=6547 ses=228 msg='op=login id=6547 exe="/usr/sbin/sshd" hostname=? addr=203.231.133.221 terminal=/dev/pts/0 res=success' 2026-10-09T13:32:53.683307-07:00 web-02 cron[58802]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:53.707393-07:00 api-08 app[30094]: INFO health check ok: db 21 ms, cache 21 ms, queue depth 23 2026-10-09T13:32:53.730439-07:00 web-03 app[30509]: INFO request_id=f50e656e144713a8 method=GET path=/health status=401 duration=9909ms 2026-10-09T13:32:53.884576-07:00 db-replica systemd[1]: session-42040.scope: Deactivated successfully. 2026-10-09T13:32:54.084704-07:00 web-01 postgres[30513]: LOG: duration: 7495.546 ms statement: SELECT * FROM orders WHERE customer_id = 93351 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:54.101858-07:00 bastion app[30890]: INFO worker 87 finished job de3b936ba092451c in 2378 ms 2026-10-09T13:32:54.358294-07:00 web-02 kernel: [21021.349206] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.195.165.71 DST=10.0.732.732 LEN=35 TOS=0x00 PREC=0x00 TTL=35 ID=21021 DF PROTO=TCP SPT=46324 DPT=46324 WINDOW=21021 RES=0x00 SYN URGP=0 2026-10-09T13:32:54.360253-07:00 api-08 nginx[1205]: 45.113.15.232 - - "GET /metrics HTTP/1.1" 200 12554 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:54.383171-07:00 api-07 app[30226]: INFO worker 54 picked job bafd8ad0f75cc4e3 from queue webhooks 2026-10-09T13:32:54.523755-07:00 api-08 nginx[1209]: 91.78.161.116 - - "GET /wp-login.php HTTP/1.1" 200 34136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:54.582857-07:00 web-02 sshd[18475]: Invalid user root from 203.207.120.24 port 31546 2026-10-09T13:32:54.668749-07:00 api-07 nginx[1202]: 192.106.104.242 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 79256 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:54.839820-07:00 worker-12 postgres[13685]: LOG: duration: 1332.943 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:54.898368-07:00 web-02 app[30035]: INFO order 93336 confirmed for root in 6092 ms (region ap-northeast-1, queue emails) 2026-10-09T13:32:54.916278-07:00 web-02 nginx[1204]: 10.230.177.5 - - "GET /.env HTTP/1.1" 401 83700 "-" "curl/8.4.0" 2026-10-09T13:32:55.008504-07:00 cache-3 app[30551]: INFO health check ok: db 582 ms, cache 582 ms, queue depth 86 2026-10-09T13:32:55.141648-07:00 db-primary postgres[28248]: LOG: duration: 1869.635 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:32:55.188781-07:00 web-01 nginx[1207]: 172.190.11.93 - - "GET /wp-login.php HTTP/1.1" 200 32038 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:32:55.192709-07:00 web-01 sshd[31682]: Failed password for invalid user zoë from 203.202.100.138 port 50578 ssh2 2026-10-09T13:32:55.325360-07:00 web-01 app[30328]: INFO worker 60 finished job dead2196875a7d12 in 7675 ms 2026-10-09T13:32:55.362111-07:00 edge-fr-1 nginx[1204]: 91.134.59.60 - - "GET /.env HTTP/1.1" 200 35770 "-" "kube-probe/1.31" 2026-10-09T13:32:55.424295-07:00 web-03 sshd[47393]: Connection closed by 192.246.246.61 port 62826 [preauth] 2026-10-09T13:32:55.502247-07:00 web-02 nginx[1201]: 192.239.229.206 - - "GET /api/v2/orders HTTP/1.1" 502 85727 "-" "curl/8.4.0" 2026-10-09T13:32:55.540307-07:00 cache-3 sshd[12791]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:32:55.798551-07:00 db-primary nginx[1203]: 10.174.167.106 - - "GET /static/app.js HTTP/1.1" 404 84593 "-" "python-requests/2.32.3" 2026-10-09T13:32:56.089894-07:00 bastion app[30374]: WARN slow query (254 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '60 minutes' 2026-10-09T13:32:56.091966-07:00 web-01 sshd[31034]: Accepted publickey for zoë from 10.136.98.234 port 2011 ssh2: ED25519 SHA256:de4aeb2b124cb185 2026-10-09T13:32:56.214905-07:00 bastion app[30157]: INFO request_id=65e43f38439972b2 method=GET path=/metrics status=401 duration=9418ms 2026-10-09T13:32:56.244970-07:00 worker-12 sshd[59569]: Connection closed by 192.205.91.216 port 23432 [preauth] 2026-10-09T13:32:56.551535-07:00 db-replica nginx[1201]: 45.143.29.202 - - "GET /api/v2/users HTTP/1.1" 200 73277 "-" "curl/8.4.0" 2026-10-09T13:32:56.571093-07:00 web-01 nginx[1200]: 192.74.70.183 - - "GET /admin HTTP/1.1" 302 78796 "-" "curl/8.4.0" 2026-10-09T13:32:56.612202-07:00 edge-fr-1 kubelet[800]: I1009 13:32:56.608724 8724 kubelet.go:8724] "Pod is terminating, skipping pod status update" pod="default/api-7e8e0802db143785" 2026-10-09T13:32:56.617729-07:00 worker-12 cron[11090]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:32:56.770820-07:00 cache-3 postgres[11068]: LOG: duration: 3062.642 ms statement: SELECT * FROM orders WHERE customer_id = 14870 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:32:56.979342-07:00 edge-fr-1 sshd[41033]: Received disconnect from 172.10.123.188 port 15528:11: Bye Bye [preauth] 2026-10-09T13:32:56.979930-07:00 edge-fr-1 systemd[1]: session-11007.scope: Deactivated successfully. 2026-10-09T13:32:57.010342-07:00 db-replica nginx[1206]: 172.211.66.213 - - "GET /api/v2/users HTTP/1.1" 502 3370 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:57.189239-07:00 web-02 sshd[7771]: Invalid user deploy from 10.225.89.216 port 11895 2026-10-09T13:32:57.422228-07:00 bastion nginx[1200]: 203.156.27.12 - - "GET /static/main.css HTTP/1.1" 200 11377 "-" "kube-probe/1.31" 2026-10-09T13:32:57.839300-07:00 api-08 app[30317]: INFO order 63986 confirmed for backup in 4994 ms (region eu-west-1, queue invoices) 2026-10-09T13:32:57.896722-07:00 web-03 dockerd[700]: time="2026-10-09T13:32:57.896722-07:00" level=warning msg="Health check for container 92964d01c8075cf6 error: context deadline exceeded" 2026-10-09T13:32:58.250565-07:00 web-03 app[30188]: INFO request_id=19c9a599d1b9b9ea method=GET path=/admin status=502 duration=2690ms 2026-10-09T13:32:58.345114-07:00 cache-3 nginx[1206]: 192.66.15.224 - - "GET /login HTTP/1.1" 301 46644 "-" "curl/8.4.0" 2026-10-09T13:32:58.374271-07:00 bastion nginx[1200]: 91.111.72.154 - - "GET /static/app.js HTTP/1.1" 404 69818 "-" "python-requests/2.32.3" 2026-10-09T13:32:58.394261-07:00 web-01 nginx[1207]: 45.134.77.124 - - "GET /admin HTTP/1.1" 302 54933 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:32:58.483596-07:00 api-08 app[30322]: INFO worker 18 picked job 4883875094da540a from queue orders 2026-10-09T13:32:58.647223-07:00 cache-3 app[30427]: INFO request_id=721b982abecb17de method=GET path=/api/v2/orders/8841 status=502 duration=5826ms 2026-10-09T13:32:59.377106-07:00 api-08 kernel: [91631.456849] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.159.4.254 DST=10.0.440.440 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=91631 DF PROTO=TCP SPT=9555 DPT=9555 WINDOW=91631 RES=0x00 SYN URGP=0 2026-10-09T13:32:59.498028-07:00 worker-12 kernel: [42062.065076] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.175.70.150 DST=10.0.378.378 LEN=20 TOS=0x00 PREC=0x00 TTL=20 ID=42062 DF PROTO=TCP SPT=1624 DPT=1624 WINDOW=42062 RES=0x00 SYN URGP=0 2026-10-09T13:32:59.567503-07:00 web-03 nginx[1202]: 203.124.133.136 - - "GET /health HTTP/1.1" 200 9714 "-" "python-requests/2.32.3" 2026-10-09T13:32:59.582899-07:00 cache-3 app[30085]: INFO order 13690 confirmed for zoë in 6880 ms (region ap-northeast-1, queue orders) 2026-10-09T13:32:59.612513-07:00 bastion haproxy[901]: 203.55.241.93:59263 [47438] http-in app/db-primary 7681/0/282/282/7681 301 38143 - - ---- 753/753/41/41/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:32:59.772500-07:00 worker-12 systemd[1]: session-95403.scope: Deactivated successfully. 2026-10-09T13:32:59.925475-07:00 web-03 kernel: [62320.194523] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.159.141.56 DST=10.0.797.797 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=62320 DF PROTO=TCP SPT=29056 DPT=29056 WINDOW=62320 RES=0x00 SYN URGP=0 2026-10-09T13:33:00.003933-07:00 web-01 app[30445]: INFO order 80635 confirmed for deploy in 3444 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:33:00.037743-07:00 cache-3 app[30031]: WARN retrying upstream 172.167.111.117:57376 after timeout (7144 ms), attempt 3 of 3 2026-10-09T13:33:00.047490-07:00 db-primary postgres[10968]: LOG: duration: 2638.146 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:00.391223-07:00 web-01 app[30091]: DEBUG cache hit ratio 51% over the last minute (36592 lookups) 2026-10-09T13:33:00.454317-07:00 db-replica haproxy[935]: Server app/web-03 is UP, reason: Layer7 check passed, code: 200, check duration: 849ms. 59 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:33:00.724421-07:00 cache-3 sshd[22112]: Accepted publickey for priya from 91.153.209.136 port 2658 ssh2: ED25519 SHA256:9a4c25b3bcdee274 2026-10-09T13:33:00.835204-07:00 db-primary nginx[1204]: 91.74.94.187 - - "GET /health HTTP/1.1" 301 55579 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:00.993169-07:00 api-07 sshd[61658]: Invalid user françois from 91.215.46.229 port 9256 2026-10-09T13:33:01.247219-07:00 cache-3 kernel: [63448.563905] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.220.225.59 DST=10.0.308.308 LEN=63 TOS=0x00 PREC=0x00 TTL=63 ID=63448 DF PROTO=TCP SPT=8470 DPT=8470 WINDOW=63448 RES=0x00 SYN URGP=0 2026-10-09T13:33:01.417364-07:00 web-01 app[30574]: INFO order 26928 confirmed for deploy in 3237 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:01.440634-07:00 web-03 sshd[14269]: Invalid user müller from 172.228.178.254 port 33106 2026-10-09T13:33:01.820467-07:00 api-07 nginx[1205]: 45.157.115.136 - - "GET /static/app.js HTTP/1.1" 502 85811 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:01.874556-07:00 api-07 nginx[1207]: 91.115.93.48 - zoë "POST /metrics HTTP/1.1" 200 54424 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:02.130302-07:00 db-primary app[30899]: INFO request_id=46e91a303aa162e8 method=GET path=/static/app.js status=200 duration=3469ms 2026-10-09T13:33:02.476252-07:00 api-07 sshd[49609]: Failed password for invalid user deploy from 91.123.10.80 port 35675 ssh2 2026-10-09T13:33:02.661443-07:00 db-replica app[30053]: INFO order 69938 confirmed for akira in 3333 ms (region us-east-1, queue invoices) 2026-10-09T13:33:02.680707-07:00 worker-12 app[30200]: INFO worker 25 finished job 159c7b9b66608cd3 in 9058 ms 2026-10-09T13:33:02.829993-07:00 api-07 postgres[16313]: LOG: duration: 782.411 ms statement: SELECT * FROM orders WHERE customer_id = 82018 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:02.849314-07:00 web-01 app[30267]: INFO worker 52 picked job 6971cf0c460d08ce from queue invoices 2026-10-09T13:33:03.217526-07:00 db-primary nginx[1208]: 172.30.8.78 - - "GET /static/app.js HTTP/1.1" 200 4702 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:03.323831-07:00 web-02 app[30571]: INFO request_id=7d8664066a260224 method=GET path=/.env status=500 duration=5113ms 2026-10-09T13:33:03.532005-07:00 db-replica postgres[30693]: LOG: checkpoint complete: wrote 9330 buffers (52%); 0 WAL file(s) added, 0 removed, 97 recycled; write=2064.883 s, sync=0.883 s, total=2064.883 s 2026-10-09T13:33:03.607982-07:00 worker-12 sshd[63430]: Invalid user zoë from 203.13.146.62 port 12477 2026-10-09T13:33:03.929060-07:00 worker-12 haproxy[907]: 45.183.232.245:22162 [40881] http-in app/cache-3 706/0/799/799/706 200 79383 - - ---- 961/961/26/26/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:33:04.051264-07:00 web-03 app[30624]: INFO order 62947 confirmed for deploy in 6122 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:33:04.246106-07:00 db-replica nginx[1210]: 203.26.201.229 - zoë "POST /static/app.js HTTP/1.1" 404 27706 "-" "kube-probe/1.31" 2026-10-09T13:33:04.677686-07:00 worker-12 app[30482]: ERROR payment declined for order 33548: card_declined (code 57), customer notified 2026-10-09T13:33:05.059291-07:00 cache-3 haproxy[938]: 10.66.19.25:24365 [19195] http-in app/api-07 1741/0/437/437/1741 302 63638 - - ---- 814/814/55/55/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:05.173755-07:00 edge-fr-1 postgres[12799]: LOG: duration: 457.719 ms statement: SELECT * FROM orders WHERE customer_id = 63363 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:05.279312-07:00 db-replica nginx[1206]: 203.10.148.57 - - "GET /static/app.js HTTP/1.1" 200 6772 "-" "curl/8.4.0" 2026-10-09T13:33:05.457662-07:00 db-replica app[30675]: INFO worker 73 finished job 1155ef642f5b6718 in 1069 ms 2026-10-09T13:33:05.704480-07:00 edge-fr-1 app[30353]: INFO order 52538 confirmed for priya in 7730 ms (region eu-west-1, queue webhooks) 2026-10-09T13:33:05.779652-07:00 web-03 sshd[37620]: Failed password for invalid user akira from 10.205.176.243 port 49665 ssh2 2026-10-09T13:33:05.808436-07:00 db-replica sshd[45001]: Failed password for invalid user françois from 45.115.188.24 port 20009 ssh2 2026-10-09T13:33:05.834100-07:00 web-03 app[30024]: INFO worker 64 picked job 080df92dfcf2a780 from queue emails 2026-10-09T13:33:06.199465-07:00 db-replica app[30695]: INFO worker 58 picked job 2485bb573378a1ce from queue webhooks 2026-10-09T13:33:06.536815-07:00 web-02 app[30206]: INFO worker 52 picked job d0b897ca192d0a56 from queue emails 2026-10-09T13:33:06.541700-07:00 bastion app[30401]: INFO request_id=141fd5435aec3ece method=GET path=/api/v2/users status=500 duration=6356ms 2026-10-09T13:33:06.892033-07:00 web-01 kernel: [32502.262207] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.72.136.216 DST=10.0.512.512 LEN=72 TOS=0x00 PREC=0x00 TTL=72 ID=32502 DF PROTO=TCP SPT=63211 DPT=63211 WINDOW=32502 RES=0x00 SYN URGP=0 2026-10-09T13:33:06.956228-07:00 cache-3 app[30153]: INFO order 59707 confirmed for sørensen in 9266 ms (region ap-northeast-1, queue emails) 2026-10-09T13:33:07.053857-07:00 cache-3 postgres[6089]: LOG: checkpoint complete: wrote 9865 buffers (36%); 0 WAL file(s) added, 0 removed, 93 recycled; write=1875.117 s, sync=0.117 s, total=1875.117 s 2026-10-09T13:33:07.069328-07:00 worker-12 haproxy[945]: 10.193.164.252:55552 [35733] http-in app/db-primary 8001/0/828/828/8001 200 29679 - - ---- 235/235/48/48/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:33:07.239887-07:00 web-03 sshd[19798]: Invalid user deploy from 91.33.34.111 port 30801 2026-10-09T13:33:07.594955-07:00 api-07 app[30251]: INFO request_id=67b5299516b5a94e method=GET path=/api/v2/orders/8841 status=301 duration=649ms 2026-10-09T13:33:07.603015-07:00 edge-fr-1 app[30974]: INFO order 45342 confirmed for backup in 5404 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:33:07.709032-07:00 db-primary app[30545]: INFO worker 64 picked job 0974ed77a6806e65 from queue orders 2026-10-09T13:33:07.741588-07:00 web-02 sshd[49954]: Connection closed by 45.16.70.233 port 40220 [preauth] 2026-10-09T13:33:07.768167-07:00 cache-3 app[30303]: INFO health check ok: db 351 ms, cache 351 ms, queue depth 55 2026-10-09T13:33:07.778042-07:00 cache-3 systemd[1]: session-75286.scope: Deactivated successfully. 2026-10-09T13:33:07.883970-07:00 web-01 nginx[1209]: 203.93.115.170 - - "GET /static/app.js HTTP/1.1" 200 64679 "-" "python-requests/2.32.3" 2026-10-09T13:33:08.080310-07:00 db-replica app[30094]: INFO request_id=516011518434da32 method=GET path=/admin status=200 duration=7482ms 2026-10-09T13:33:08.330987-07:00 db-replica sshd[34572]: Invalid user deploy from 192.162.200.162 port 1948 2026-10-09T13:33:08.353151-07:00 api-07 haproxy[901]: 203.4.208.106:34908 [46222] http-in app/web-01 5734/0/326/326/5734 502 80728 - - ---- 759/759/54/54/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:08.498717-07:00 bastion sshd[50730]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:33:08.506611-07:00 cache-3 postgres[29052]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 12906 remain, 8765 scanned (69% of total) 2026-10-09T13:33:08.959254-07:00 web-01 nginx[1207]: 45.71.93.40 - - "GET /api/v2/users HTTP/1.1" 404 40277 "-" "kube-probe/1.31" 2026-10-09T13:33:09.232738-07:00 worker-12 nginx[1209]: 192.183.65.149 - - "GET /.env HTTP/1.1" 404 32734 "-" "Go-http-client/1.1" 2026-10-09T13:33:09.274868-07:00 web-03 nginx[1210]: 192.135.196.45 - root "POST /favicon.ico HTTP/1.1" 401 89875 "-" "curl/8.4.0" 2026-10-09T13:33:09.635903-07:00 bastion app[30808]: INFO order 67876 confirmed for françois in 9593 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:09.895825-07:00 bastion app[30518]: INFO worker 21 finished job f824d149fa036a47 in 1328 ms 2026-10-09T13:33:10.010441-07:00 cache-3 app[30876]: INFO order 28533 confirmed for deploy in 255 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:33:10.079288-07:00 db-primary app[30837]: INFO request_id=48f06a9c9d172426 method=GET path=/health status=301 duration=5960ms 2026-10-09T13:33:10.085860-07:00 bastion app[30878]: WARN retrying upstream 172.195.145.217:21436 after timeout (9297 ms), attempt 2 of 3 2026-10-09T13:33:10.094712-07:00 web-03 app[30725]: INFO request_id=6d15dfb7d699b212 method=GET path=/api/v2/orders/8841 status=502 duration=6721ms 2026-10-09T13:33:10.178013-07:00 cache-3 app[30226]: INFO worker 89 picked job 44c5fe1d86752a66 from queue orders 2026-10-09T13:33:10.234471-07:00 api-08 nginx[1204]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.147.139.86, server: app.example.com, request: "GET /metrics HTTP/1.1", upstream: "http://10.0.462.462:8080/metrics" 2026-10-09T13:33:10.453167-07:00 cache-3 app[30058]: INFO health check ok: db 641 ms, cache 641 ms, queue depth 78 2026-10-09T13:33:10.604256-07:00 db-replica postgres[6750]: LOG: duration: 9004.94 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:10.605750-07:00 worker-12 app[30115]: INFO request_id=a16e0ffea61f4fcb method=GET path=/api/v2/orders/8841 status=204 duration=1064ms 2026-10-09T13:33:10.718739-07:00 db-primary nginx[1202]: 203.22.38.87 - - "GET /static/main.css HTTP/1.1" 200 83318 "-" "Go-http-client/1.1" 2026-10-09T13:33:11.035056-07:00 db-replica sshd[33483]: Connection closed by 45.214.210.168 port 1172 [preauth] 2026-10-09T13:33:11.052217-07:00 api-08 systemd[1]: Started Session 80338 of User priya. 2026-10-09T13:33:11.368238-07:00 db-primary app[30891]: INFO request_id=25bd5edb5b0c819b method=GET path=/metrics status=301 duration=110ms 2026-10-09T13:33:11.393324-07:00 api-07 nginx[1206]: 91.255.32.16 - - "GET /metrics HTTP/1.1" 200 17436 "-" "python-requests/2.32.3" 2026-10-09T13:33:11.465352-07:00 db-primary haproxy[926]: 91.12.63.219:44158 [11891] http-in app/api-07 820/0/184/184/820 204 36089 - - ---- 342/342/20/20/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:11.537851-07:00 edge-fr-1 app[30142]: INFO worker 43 finished job e8c12b8b7d2bd6a3 in 6559 ms 2026-10-09T13:33:11.691952-07:00 web-01 app[30061]: WARN slow query (5942 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '87 minutes' 2026-10-09T13:33:11.779853-07:00 db-replica nginx[1208]: 91.52.113.127 - - "GET /static/app.js HTTP/1.1" 200 84288 "-" "python-requests/2.32.3" 2026-10-09T13:33:11.849252-07:00 worker-12 app[30873]: INFO worker 46 picked job 28f9582a36a11e8f from queue invoices 2026-10-09T13:33:12.330175-07:00 web-02 app[30840]: INFO order 11393 confirmed for müller in 8453 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:12.423687-07:00 db-replica app[30907]: INFO worker 47 finished job 5084d12dd1aa3cc0 in 585 ms 2026-10-09T13:33:12.425587-07:00 web-03 nginx[1204]: 10.237.151.232 - - "GET /login HTTP/1.1" 301 2655 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:12.748247-07:00 worker-12 postgres[25154]: LOG: duration: 8011.803 ms statement: SELECT * FROM orders WHERE customer_id = 48486 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:12.832669-07:00 api-08 haproxy[928]: 91.97.126.84:59249 [32665] http-in app/web-03 2851/0/764/764/2851 200 3594 - - ---- 607/607/11/11/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:33:13.095660-07:00 api-07 nginx[1209]: 10.230.246.224 - - "GET /.env HTTP/1.1" 404 74041 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:13.404918-07:00 cache-3 kernel: [30924.462070] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.5.153.79 DST=10.0.789.789 LEN=78 TOS=0x00 PREC=0x00 TTL=78 ID=30924 DF PROTO=TCP SPT=37507 DPT=37507 WINDOW=30924 RES=0x00 SYN URGP=0 2026-10-09T13:33:13.405330-07:00 db-primary app[30707]: INFO order 84362 confirmed for deploy in 5161 ms (region us-east-1, queue invoices) 2026-10-09T13:33:13.641444-07:00 bastion app[30056]: INFO order 88800 confirmed for sørensen in 2547 ms (region eu-west-1, queue emails) 2026-10-09T13:33:13.678792-07:00 cache-3 sshd[50341]: Received disconnect from 91.113.76.195 port 28384:11: Bye Bye [preauth] 2026-10-09T13:33:13.774282-07:00 web-03 haproxy[905]: 91.180.104.23:33268 [18065] http-in app/bastion 606/0/14/14/606 200 5360 - - ---- 708/708/48/48/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:14.006810-07:00 web-02 nginx[1206]: 172.117.101.133 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 448 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:14.213094-07:00 api-07 haproxy[923]: 91.7.85.7:63785 [51822] http-in app/edge-fr-1 5122/0/907/907/5122 204 8674 - - ---- 163/163/61/61/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:14.243516-07:00 worker-12 app[30777]: INFO worker 90 picked job bb9200caacdcbd1d from queue webhooks 2026-10-09T13:33:14.429988-07:00 edge-fr-1 app[30686]: INFO order 78518 confirmed for sørensen in 5403 ms (region us-east-1, queue invoices) 2026-10-09T13:33:14.437128-07:00 db-primary app[30235]: INFO request_id=e823000670fcd988 method=GET path=/login status=200 duration=2333ms 2026-10-09T13:33:14.460546-07:00 db-primary haproxy[919]: 91.217.123.195:61130 [89116] http-in app/bastion 8818/0/477/477/8818 404 85211 - - ---- 926/926/82/82/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:33:14.636580-07:00 edge-fr-1 nginx[1201]: 172.85.103.218 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 14625 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:14.639750-07:00 db-primary app[30298]: INFO worker 21 picked job c000c112341ba5ab from queue invoices 2026-10-09T13:33:14.847154-07:00 cache-3 kernel: [88773.617961] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.152.87.113 DST=10.0.434.434 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=88773 DF PROTO=TCP SPT=25021 DPT=25021 WINDOW=88773 RES=0x00 SYN URGP=0 2026-10-09T13:33:14.993950-07:00 cache-3 app[30011]: INFO request_id=78d43391838f2f85 method=GET path=/static/app.js status=200 duration=6065ms 2026-10-09T13:33:15.192778-07:00 db-primary sshd[29444]: Connection closed by 10.174.41.147 port 7445 [preauth] 2026-10-09T13:33:15.258160-07:00 worker-12 app[30013]: ERROR cache miss storm: 9327 misses in 4829 ms, key prefix session:ci 2026-10-09T13:33:15.532761-07:00 worker-12 app[30178]: INFO worker 38 picked job 219f9f8f72092e94 from queue emails 2026-10-09T13:33:15.976340-07:00 bastion kernel: [67164.619123] TCP: request_sock_TCP: Possible SYN flooding on port 63909. Sending cookies. Check SNMP counters. 2026-10-09T13:33:16.348248-07:00 api-07 nginx[1208]: 91.83.240.2 - root "POST /static/app.js HTTP/1.1" 404 18372 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:16.592332-07:00 web-03 sshd[23499]: pam_unix(sshd:session): session opened for user root(uid=4933) by (uid=0) 2026-10-09T13:33:16.969071-07:00 cache-3 app[30500]: INFO request_id=8bd5aefda72cd436 method=GET path=/api/v2/orders/8841 status=302 duration=6030ms 2026-10-09T13:33:17.123056-07:00 edge-fr-1 sshd[44788]: pam_unix(sshd:session): session opened for user backup(uid=6859) by (uid=0) 2026-10-09T13:33:17.292297-07:00 web-03 nginx[1210]: 203.98.72.96 - - "GET /api/v2/orders HTTP/1.1" 301 37918 "-" "curl/8.4.0" 2026-10-09T13:33:17.446149-07:00 api-08 kernel: [57538.951061] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.229.6.113 DST=10.0.264.264 LEN=85 TOS=0x00 PREC=0x00 TTL=85 ID=57538 DF PROTO=TCP SPT=40274 DPT=40274 WINDOW=57538 RES=0x00 SYN URGP=0 2026-10-09T13:33:17.452188-07:00 edge-fr-1 app[30989]: INFO request_id=b91d5e58246dac37 method=GET path=/api/v2/search?q=invoice status=200 duration=8803ms 2026-10-09T13:33:17.643989-07:00 worker-12 postgres[5565]: LOG: duration: 7183.876 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:17.762736-07:00 web-02 app[30771]: INFO request_id=60c60eda49dd343b method=GET path=/metrics status=200 duration=5155ms 2026-10-09T13:33:17.988212-07:00 web-02 nginx[1205]: 91.16.106.215 - - "GET /api/v2/users HTTP/1.1" 204 16872 "-" "kube-probe/1.31" 2026-10-09T13:33:18.080290-07:00 api-08 app[30278]: INFO request_id=d0e30a8fa1630432 method=GET path=/health status=502 duration=9857ms 2026-10-09T13:33:18.180225-07:00 web-02 app[30824]: INFO health check ok: db 14 ms, cache 14 ms, queue depth 73 2026-10-09T13:33:18.266698-07:00 edge-fr-1 sshd[32135]: Failed password for invalid user müller from 172.222.232.90 port 29691 ssh2 2026-10-09T13:33:18.276337-07:00 edge-fr-1 cron[37358]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:33:18.387157-07:00 bastion haproxy[937]: 172.114.88.136:33709 [72346] http-in app/db-replica 8272/0/842/842/8272 404 38770 - - ---- 572/572/80/80/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:18.475790-07:00 bastion kubelet[800]: I1009 13:33:18.935057 7239 kubelet.go:7239] "Pod is terminating, skipping pod status update" pod="default/api-9331826ac882d3af" 2026-10-09T13:33:18.521098-07:00 db-replica haproxy[944]: 192.100.255.183:32660 [31034] http-in app/edge-fr-1 5831/0/735/735/5831 200 76978 - - ---- 678/678/27/27/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:18.564884-07:00 bastion app[30954]: INFO order 76686 confirmed for akira in 9717 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:18.606813-07:00 bastion haproxy[921]: 45.167.83.103:56103 [57175] http-in app/edge-fr-1 4648/0/111/111/4648 200 58223 - - ---- 283/283/57/57/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:18.623924-07:00 cache-3 app[30795]: INFO worker 63 picked job 9c41982aa8ed7d7c from queue emails 2026-10-09T13:33:18.746870-07:00 db-primary nginx[1206]: 45.26.109.29 - - "GET /metrics HTTP/1.1" 502 52563 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:18.749236-07:00 db-primary app[30015]: INFO worker 20 picked job f26291a2c5edad39 from queue webhooks 2026-10-09T13:33:18.850284-07:00 bastion kernel: [42869.941045] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.93.18.155 DST=10.0.127.127 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=42869 DF PROTO=TCP SPT=6295 DPT=6295 WINDOW=42869 RES=0x00 SYN URGP=0 2026-10-09T13:33:19.572656-07:00 db-replica nginx[1210]: 172.150.66.95 - - "GET /api/v2/orders HTTP/1.1" 500 26169 "-" "Go-http-client/1.1" 2026-10-09T13:33:19.904617-07:00 db-primary app[30896]: INFO worker 41 finished job 760ef241bc16d6f9 in 4860 ms 2026-10-09T13:33:20.082352-07:00 web-01 nginx[1204]: 203.61.43.105 - - "GET /wp-login.php HTTP/1.1" 404 37579 "-" "kube-probe/1.31" 2026-10-09T13:33:20.093955-07:00 cache-3 haproxy[942]: 192.230.21.126:54996 [40774] http-in app/api-08 4350/0/16/16/4350 500 54672 - - ---- 625/625/41/41/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:33:20.317888-07:00 db-replica nginx[1210]: 203.2.95.150 - - "GET /api/v2/orders HTTP/1.1" 301 65880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:20.376874-07:00 api-07 app[30289]: INFO request_id=03ad74d676e492dd method=GET path=/health status=302 duration=5648ms 2026-10-09T13:33:20.404055-07:00 db-primary app[30765]: INFO worker 15 picked job f6a0ab118882ab31 from queue emails 2026-10-09T13:33:20.501062-07:00 cache-3 haproxy[946]: 172.235.86.215:14682 [44752] http-in app/web-03 4199/0/77/77/4199 200 60963 - - ---- 446/446/74/74/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:33:20.628547-07:00 bastion app[30150]: INFO worker 83 finished job 543a666e80e11b8d in 4656 ms 2026-10-09T13:33:20.629110-07:00 web-03 haproxy[936]: 203.245.182.6:17202 [81062] http-in app/web-03 9861/0/649/649/9861 200 78652 - - ---- 181/181/75/75/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:20.659397-07:00 edge-fr-1 sshd[39851]: Accepted publickey for zoë from 45.11.178.23 port 18396 ssh2: ED25519 SHA256:daa93948d95312a2 2026-10-09T13:33:20.837238-07:00 cache-3 sshd[55823]: Connection closed by 91.208.198.93 port 57147 [preauth] 2026-10-09T13:33:20.955062-07:00 api-08 haproxy[949]: 192.215.72.46:40766 [32454] http-in app/cache-3 8879/0/807/807/8879 401 75845 - - ---- 785/785/64/64/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:33:20.978597-07:00 db-primary app[30508]: INFO request_id=40abaca8149edeb0 method=GET path=/.env status=200 duration=8810ms 2026-10-09T13:33:20.999501-07:00 cache-3 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.85.15.14, server: app.example.com, request: "GET /api/v2/search?q=invoice HTTP/1.1", upstream: "http://10.0.635.635:8080/api/v2/search?q=invoice" 2026-10-09T13:33:21.296927-07:00 api-08 nginx[1200]: 91.35.140.193 - - "GET /login HTTP/1.1" 301 8478 "-" "Go-http-client/1.1" 2026-10-09T13:33:21.389443-07:00 db-replica nginx[1209]: 91.116.59.218 - - "GET /metrics HTTP/1.1" 401 80445 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:21.438137-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791578001.574:99891): pid=99891 uid=0 auid=2408 ses=854 msg='op=login id=2408 exe="/usr/sbin/sshd" hostname=? addr=45.53.196.229 terminal=/dev/pts/0 res=success' 2026-10-09T13:33:21.484535-07:00 api-07 app[30916]: INFO request_id=068e5f0d339b7f5b method=GET path=/api/v2/orders status=302 duration=5392ms 2026-10-09T13:33:21.537639-07:00 web-01 kernel: [97597.956459] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.228.141.111 DST=10.0.390.390 LEN=70 TOS=0x00 PREC=0x00 TTL=70 ID=97597 DF PROTO=TCP SPT=14929 DPT=14929 WINDOW=97597 RES=0x00 SYN URGP=0 2026-10-09T13:33:21.625355-07:00 bastion systemd[1]: session-16086.scope: Deactivated successfully. 2026-10-09T13:33:21.687147-07:00 db-primary sshd[38524]: Received disconnect from 203.4.97.144 port 62357:11: Bye Bye [preauth] 2026-10-09T13:33:21.733799-07:00 cache-3 kernel: [22693.742380] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.95.122.41 DST=10.0.885.885 LEN=63 TOS=0x00 PREC=0x00 TTL=63 ID=22693 DF PROTO=TCP SPT=45356 DPT=45356 WINDOW=22693 RES=0x00 SYN URGP=0 2026-10-09T13:33:21.869464-07:00 cache-3 nginx[1200]: 192.42.69.214 - - "GET /health HTTP/1.1" 200 51106 "-" "Go-http-client/1.1" 2026-10-09T13:33:21.946456-07:00 db-primary app[30865]: INFO worker 13 picked job abaa182f1282ea85 from queue invoices 2026-10-09T13:33:21.960828-07:00 web-02 app[30002]: INFO order 45912 confirmed for deploy in 5399 ms (region eu-west-1, queue orders) 2026-10-09T13:33:22.000031-07:00 web-03 kernel: [95017.290878] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.14.108.140 DST=10.0.281.281 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=95017 DF PROTO=TCP SPT=6525 DPT=6525 WINDOW=95017 RES=0x00 SYN URGP=0 2026-10-09T13:33:22.012465-07:00 worker-12 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:33:22.208289-07:00 web-02 kernel: [32338.842048] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.144.204.225 DST=10.0.918.918 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=32338 DF PROTO=TCP SPT=63910 DPT=63910 WINDOW=32338 RES=0x00 SYN URGP=0 2026-10-09T13:33:22.244851-07:00 web-02 app[30777]: INFO request_id=ee72f5d580771223 method=GET path=/admin status=401 duration=8063ms 2026-10-09T13:33:22.294044-07:00 db-replica app[30548]: INFO worker 46 picked job 3b2647e04728d6a0 from queue orders 2026-10-09T13:33:22.500562-07:00 edge-fr-1 nginx[1206]: 192.229.122.191 - - "GET /metrics HTTP/1.1" 302 82452 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:22.765026-07:00 web-03 sudo: root : TTY=pts/0 ; PWD=/home/root ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:33:22.807324-07:00 cache-3 nginx[1204]: 91.62.218.187 - - "GET /static/main.css HTTP/1.1" 502 29589 "-" "python-requests/2.32.3" 2026-10-09T13:33:22.886457-07:00 web-03 haproxy[934]: 172.86.113.204:8606 [44501] http-in app/web-01 4577/0/894/894/4577 200 77226 - - ---- 661/661/53/53/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:22.978967-07:00 web-01 app[30596]: INFO request_id=ba9d0ab858ccd251 method=GET path=/health status=404 duration=2085ms 2026-10-09T13:33:22.998113-07:00 worker-12 app[30399]: INFO request_id=c5ac96f1fcdc8960 method=GET path=/favicon.ico status=404 duration=6594ms 2026-10-09T13:33:23.003877-07:00 cache-3 sshd[25644]: Failed password for invalid user backup from 203.207.248.43 port 6732 ssh2 2026-10-09T13:33:23.379709-07:00 bastion nginx[1209]: 45.0.210.173 - root "POST /.env HTTP/1.1" 404 22256 "-" "python-requests/2.32.3" 2026-10-09T13:33:23.536709-07:00 api-08 app[30918]: INFO health check ok: db 363 ms, cache 363 ms, queue depth 98 2026-10-09T13:33:23.693855-07:00 web-03 systemd[1]: Started Session 81642 of User sørensen. 2026-10-09T13:33:23.703108-07:00 worker-12 haproxy[906]: 45.187.48.30:8727 [90737] http-in app/db-primary 4112/0/691/691/4112 404 37065 - - ---- 811/811/38/38/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:33:23.918064-07:00 web-02 kernel: [96328.213954] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.208.186.146 DST=10.0.511.511 LEN=43 TOS=0x00 PREC=0x00 TTL=43 ID=96328 DF PROTO=TCP SPT=57660 DPT=57660 WINDOW=96328 RES=0x00 SYN URGP=0 2026-10-09T13:33:23.926184-07:00 db-replica app[30148]: INFO request_id=25847ca255659838 method=GET path=/.env status=302 duration=6530ms 2026-10-09T13:33:24.260742-07:00 edge-fr-1 postgres[6820]: LOG: duration: 1725.772 ms statement: SELECT * FROM orders WHERE customer_id = 60582 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:24.455198-07:00 web-02 app[30287]: WARN slow query (9363 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '43 minutes' 2026-10-09T13:33:24.465448-07:00 api-07 app[30225]: INFO worker 81 finished job 77632018ef57b3b3 in 76 ms 2026-10-09T13:33:24.471970-07:00 web-03 haproxy[950]: 203.217.23.243:63391 [23445] http-in app/web-02 3479/0/970/970/3479 200 9431 - - ---- 241/241/22/22/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:24.512913-07:00 bastion app[30877]: INFO worker 14 picked job 4f1dc8fe262cda4e from queue emails 2026-10-09T13:33:24.539406-07:00 web-01 app[30203]: INFO order 14247 confirmed for sørensen in 1345 ms (region us-east-1, queue orders) 2026-10-09T13:33:24.726686-07:00 cache-3 sshd[42797]: Accepted publickey for backup from 203.26.75.178 port 21775 ssh2: ED25519 SHA256:ee861b1b159f7e1a 2026-10-09T13:33:24.767851-07:00 db-primary app[30054]: INFO worker 19 picked job 02453b77213ba787 from queue emails 2026-10-09T13:33:24.852797-07:00 web-01 sshd[7318]: Received disconnect from 91.249.134.184 port 41642:11: Bye Bye [preauth] 2026-10-09T13:33:25.310348-07:00 db-replica app[30872]: INFO request_id=93edc87418853e0e method=GET path=/api/v2/orders/8841 status=404 duration=5485ms 2026-10-09T13:33:25.323686-07:00 bastion nginx[1206]: 192.164.242.216 - deploy "POST /admin HTTP/1.1" 302 11376 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:25.541621-07:00 web-03 systemd[1]: Started Session 64511 of User akira. 2026-10-09T13:33:25.752153-07:00 db-primary systemd[1]: Started Session 61423 of User müller. 2026-10-09T13:33:26.055522-07:00 web-03 app[30898]: INFO request_id=e2d95b4d3d62c10e method=GET path=/wp-login.php status=200 duration=1663ms 2026-10-09T13:33:26.303670-07:00 api-07 sshd[29284]: pam_unix(sshd:session): session opened for user backup(uid=8289) by (uid=0) 2026-10-09T13:33:26.390297-07:00 edge-fr-1 app[30636]: INFO worker 61 picked job 2ec47cb5f52ba6c2 from queue orders 2026-10-09T13:33:26.601300-07:00 db-replica app[31000]: INFO order 83185 confirmed for root in 6589 ms (region eu-west-1, queue emails) 2026-10-09T13:33:26.709335-07:00 worker-12 postgres[25108]: LOG: duration: 4959.899 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:26.842846-07:00 web-02 postgres[6966]: LOG: duration: 9470.418 ms statement: SELECT * FROM orders WHERE customer_id = 47467 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:26.871672-07:00 db-replica nginx[1204]: 91.15.194.180 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 38359 "-" "kube-probe/1.31" 2026-10-09T13:33:26.951926-07:00 cache-3 app[30806]: DEBUG cache hit ratio 17% over the last minute (83247 lookups) 2026-10-09T13:33:26.995278-07:00 db-replica nginx[1205]: 172.104.54.93 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 72439 "-" "curl/8.4.0" 2026-10-09T13:33:27.049305-07:00 api-07 sshd[22486]: pam_unix(sshd:session): session opened for user sørensen(uid=3117) by (uid=0) 2026-10-09T13:33:27.190888-07:00 web-01 app[30336]: INFO worker 30 picked job 10d169f02578bd70 from queue emails 2026-10-09T13:33:27.226827-07:00 web-03 sshd[40840]: Invalid user priya from 203.227.40.238 port 26806 2026-10-09T13:33:27.241411-07:00 web-01 app[30117]: INFO worker 18 finished job 4f752919573bb425 in 4474 ms 2026-10-09T13:33:27.560366-07:00 api-07 app[30529]: INFO health check ok: db 417 ms, cache 417 ms, queue depth 56 2026-10-09T13:33:27.597026-07:00 edge-fr-1 haproxy[948]: 91.4.164.120:47818 [45464] http-in app/cache-3 4562/0/815/815/4562 404 26154 - - ---- 927/927/49/49/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:33:27.860967-07:00 edge-fr-1 postgres[16381]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 98636 remain, 2842 scanned (59% of total) 2026-10-09T13:33:27.900699-07:00 db-primary nginx[1200]: 172.74.223.114 - - "GET /static/app.js HTTP/1.1" 200 16104 "-" "kube-probe/1.31" 2026-10-09T13:33:28.015675-07:00 api-08 nginx[1203]: 192.129.19.166 - root "POST /api/v2/orders/8841 HTTP/1.1" 404 24171 "-" "python-requests/2.32.3" 2026-10-09T13:33:28.358267-07:00 cache-3 dockerd[700]: time="2026-10-09T13:33:28.358267-07:00" level=warning msg="Health check for container 003ec21e0251bceb error: context deadline exceeded" 2026-10-09T13:33:28.472598-07:00 web-03 kernel: [72857.394519] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.254.40.52 DST=10.0.361.361 LEN=91 TOS=0x00 PREC=0x00 TTL=91 ID=72857 DF PROTO=TCP SPT=25620 DPT=25620 WINDOW=72857 RES=0x00 SYN URGP=0 2026-10-09T13:33:28.584410-07:00 worker-12 app[30523]: INFO worker 80 picked job 7fb9e5452d13c59b from queue orders 2026-10-09T13:33:28.623745-07:00 worker-12 nginx[1206]: 203.52.35.107 - françois "POST /api/v2/search?q=invoice HTTP/1.1" 200 25161 "-" "python-requests/2.32.3" 2026-10-09T13:33:28.655968-07:00 cache-3 sshd[46144]: Connection closed by 203.247.27.206 port 30811 [preauth] 2026-10-09T13:33:28.890599-07:00 api-07 nginx[1203]: 192.1.200.228 - backup "POST /admin HTTP/1.1" 500 51132 "-" "Go-http-client/1.1" 2026-10-09T13:33:28.911493-07:00 web-01 haproxy[923]: 45.43.31.233:22609 [42136] http-in app/web-03 3049/0/121/121/3049 302 23792 - - ---- 969/969/69/69/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:33:29.035082-07:00 worker-12 app[30194]: INFO worker 43 finished job 3003ca5546c60b0c in 9159 ms 2026-10-09T13:33:29.283452-07:00 web-01 nginx[1206]: 172.150.163.217 - - "GET /static/app.js HTTP/1.1" 302 52681 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:29.370789-07:00 bastion app[30728]: INFO request_id=8002fea12f5a7da7 method=GET path=/favicon.ico status=404 duration=185ms 2026-10-09T13:33:29.406695-07:00 web-03 sshd[10013]: Accepted publickey for sørensen from 91.51.231.250 port 5401 ssh2: ED25519 SHA256:10e23320b1f70829 2026-10-09T13:33:29.435191-07:00 web-03 app[30763]: INFO request_id=df34e50b60dfd1b1 method=GET path=/api/v2/users status=200 duration=4026ms 2026-10-09T13:33:29.453547-07:00 db-primary kernel: [83023.760848] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.157.145.60 DST=10.0.176.176 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=83023 DF PROTO=TCP SPT=39862 DPT=39862 WINDOW=83023 RES=0x00 SYN URGP=0 2026-10-09T13:33:29.461075-07:00 api-07 haproxy[916]: 45.80.210.219:45393 [38233] http-in app/api-08 1115/0/15/15/1115 301 60701 - - ---- 667/667/19/19/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:33:29.541470-07:00 db-replica postgres[21209]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 32040 remain, 1560 scanned (21% of total) 2026-10-09T13:33:29.556668-07:00 edge-fr-1 app[30639]: INFO request_id=8f1e436e23cf5880 method=GET path=/static/main.css status=401 duration=8697ms 2026-10-09T13:33:29.709596-07:00 api-08 app[30097]: INFO worker 61 finished job e4dda88caf299027 in 8910 ms 2026-10-09T13:33:29.729316-07:00 web-01 nginx[1209]: 192.145.217.190 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 16208 "-" "Go-http-client/1.1" 2026-10-09T13:33:29.949085-07:00 worker-12 sshd[6772]: Connection closed by 10.18.216.181 port 25248 [preauth] 2026-10-09T13:33:30.268663-07:00 api-08 haproxy[930]: 45.238.82.95:7309 [47468] http-in app/edge-fr-1 6964/0/618/618/6964 200 67911 - - ---- 551/551/85/85/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:30.874955-07:00 db-primary nginx[1200]: 172.202.172.34 - - "GET /admin HTTP/1.1" 200 18988 "-" "curl/8.4.0" 2026-10-09T13:33:30.878620-07:00 edge-fr-1 haproxy[939]: 91.240.133.136:13291 [41638] http-in app/worker-12 6006/0/331/331/6006 204 3606 - - ---- 783/783/32/32/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:30.969294-07:00 web-03 nginx[1200]: 45.35.17.149 - - "GET /static/main.css HTTP/1.1" 404 46873 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:31.066540-07:00 db-replica sshd[12537]: Invalid user françois from 10.124.22.75 port 41023 2026-10-09T13:33:31.075228-07:00 api-08 sshd[60537]: Accepted publickey for sørensen from 192.244.106.253 port 13114 ssh2: ED25519 SHA256:cbae76e5151f38c0 2026-10-09T13:33:31.142476-07:00 api-07 nginx[1200]: 172.132.212.195 - sørensen "POST /health HTTP/1.1" 200 3719 "-" "curl/8.4.0" 2026-10-09T13:33:31.400390-07:00 api-08 app[30467]: INFO request_id=0d0f90c49f585848 method=GET path=/api/v2/orders/8841 status=404 duration=4451ms 2026-10-09T13:33:31.423162-07:00 edge-fr-1 kernel: [25176.477887] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.67.215.186 DST=10.0.387.387 LEN=17 TOS=0x00 PREC=0x00 TTL=17 ID=25176 DF PROTO=TCP SPT=30687 DPT=30687 WINDOW=25176 RES=0x00 SYN URGP=0 2026-10-09T13:33:31.436391-07:00 api-07 nginx[1206]: 203.158.240.233 - - "GET /wp-login.php HTTP/1.1" 204 80046 "-" "python-requests/2.32.3" 2026-10-09T13:33:31.454539-07:00 db-primary app[30319]: INFO order 88329 confirmed for akira in 3004 ms (region eu-west-1, queue orders) 2026-10-09T13:33:31.686488-07:00 worker-12 app[30941]: INFO health check ok: db 889 ms, cache 889 ms, queue depth 16 2026-10-09T13:33:32.050321-07:00 db-replica haproxy[948]: 172.148.81.203:36527 [91902] http-in app/web-02 813/0/189/189/813 404 83476 - - ---- 801/801/22/22/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:32.263896-07:00 web-03 kernel: [31381.839630] TCP: request_sock_TCP: Possible SYN flooding on port 56554. Sending cookies. Check SNMP counters. 2026-10-09T13:33:32.507122-07:00 web-02 haproxy[915]: 192.225.121.47:48997 [25311] http-in app/worker-12 6992/0/710/710/6992 404 55051 - - ---- 667/667/56/56/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:33:32.597924-07:00 edge-fr-1 sshd[1057]: pam_unix(sshd:session): session opened for user sørensen(uid=9888) by (uid=0) 2026-10-09T13:33:32.949164-07:00 db-replica nginx[1202]: 45.111.17.191 - backup "POST /api/v2/search?q=invoice HTTP/1.1" 204 38643 "-" "kube-probe/1.31" 2026-10-09T13:33:32.997568-07:00 bastion app[30004]: INFO request_id=188135c4444305c0 method=GET path=/api/v2/users status=502 duration=1255ms 2026-10-09T13:33:33.151933-07:00 db-replica sshd[7416]: Accepted publickey for root from 45.108.144.111 port 19583 ssh2: ED25519 SHA256:4a19285c9ab5d837 2026-10-09T13:33:33.191434-07:00 edge-fr-1 app[30531]: INFO worker 51 finished job f695906da1f0353b in 3271 ms 2026-10-09T13:33:33.227382-07:00 bastion postgres[28214]: LOG: duration: 1117.528 ms statement: SELECT * FROM orders WHERE customer_id = 10064 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:33.331494-07:00 worker-12 nginx[1208]: 172.7.120.62 - - "GET /metrics HTTP/1.1" 200 70335 "-" "kube-probe/1.31" 2026-10-09T13:33:33.405625-07:00 api-07 app[30803]: INFO request_id=a2ee373f53ed2c9b method=GET path=/login status=401 duration=9844ms 2026-10-09T13:33:33.489628-07:00 api-08 app[30785]: INFO request_id=7bbb3aff05ff10b2 method=GET path=/api/v2/orders status=204 duration=7237ms 2026-10-09T13:33:33.490411-07:00 db-primary app[30290]: INFO request_id=4997bf01e8221127 method=GET path=/static/main.css status=404 duration=3388ms 2026-10-09T13:33:33.522711-07:00 web-02 nginx[1210]: 10.33.236.167 - - "GET /favicon.ico HTTP/1.1" 200 29113 "-" "kube-probe/1.31" 2026-10-09T13:33:33.547191-07:00 edge-fr-1 systemd[1]: session-18128.scope: Deactivated successfully. 2026-10-09T13:33:33.734273-07:00 api-07 sshd[13072]: Accepted publickey for müller from 192.2.143.171 port 18917 ssh2: ED25519 SHA256:70b4862fc17e3fe9 2026-10-09T13:33:33.916762-07:00 db-primary sshd[12103]: Failed password for invalid user sørensen from 45.171.149.215 port 15892 ssh2 2026-10-09T13:33:33.943700-07:00 cache-3 app[30274]: INFO order 97907 confirmed for sørensen in 6899 ms (region eu-west-1, queue invoices) 2026-10-09T13:33:33.969354-07:00 api-08 systemd[1]: session-53429.scope: Deactivated successfully. 2026-10-09T13:33:34.082700-07:00 edge-fr-1 haproxy[906]: 172.74.206.194:21029 [93001] http-in app/worker-12 2779/0/457/457/2779 200 61634 - - ---- 503/503/52/52/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:34.115114-07:00 cache-3 app[30189]: INFO request_id=0adc0795970da0f2 method=GET path=/metrics status=500 duration=6246ms 2026-10-09T13:33:34.488382-07:00 api-08 nginx[1210]: 192.116.165.163 - akira "POST /.env HTTP/1.1" 200 14359 "-" "python-requests/2.32.3" 2026-10-09T13:33:34.515485-07:00 worker-12 nginx[1210]: 91.162.77.183 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 76029 "-" "python-requests/2.32.3" 2026-10-09T13:33:34.649381-07:00 edge-fr-1 haproxy[907]: 91.201.221.100:20755 [68162] http-in app/db-replica 9351/0/575/575/9351 204 23415 - - ---- 431/431/88/88/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:33:34.831304-07:00 db-primary nginx[1200]: 192.194.236.66 - backup "POST /health HTTP/1.1" 502 9582 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:34.897554-07:00 web-01 app[30796]: INFO worker 41 finished job cbe6d14a8362ef52 in 6445 ms 2026-10-09T13:33:34.927074-07:00 worker-12 app[30367]: INFO request_id=0851699cbe7c5b54 method=GET path=/metrics status=404 duration=6254ms 2026-10-09T13:33:34.943169-07:00 web-02 app[30633]: INFO order 82321 confirmed for deploy in 4981 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:34.949736-07:00 web-03 app[30476]: INFO request_id=dc3266622699ba8c method=GET path=/api/v2/orders/8841 status=500 duration=9429ms 2026-10-09T13:33:35.082354-07:00 db-replica haproxy[930]: 10.65.243.114:45854 [61686] http-in app/api-08 6374/0/459/459/6374 200 8758 - - ---- 613/613/61/61/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:33:35.185252-07:00 db-primary nginx[1205]: 203.73.145.215 - - "GET /metrics HTTP/1.1" 200 35437 "-" "python-requests/2.32.3" 2026-10-09T13:33:35.284948-07:00 web-02 postgres[19633]: LOG: duration: 8660.581 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:35.427473-07:00 api-08 app[30844]: INFO request_id=5d2155699c03ff3d method=GET path=/.env status=301 duration=5762ms 2026-10-09T13:33:35.684342-07:00 bastion app[30542]: INFO worker 91 finished job d74997f001e97345 in 3478 ms 2026-10-09T13:33:35.694595-07:00 cache-3 app[30383]: INFO request_id=736708248737a9be method=GET path=/admin status=500 duration=5787ms 2026-10-09T13:33:35.877655-07:00 edge-fr-1 app[30079]: INFO health check ok: db 435 ms, cache 435 ms, queue depth 82 2026-10-09T13:33:36.113242-07:00 web-02 postgres[3580]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 49399 remain, 3562 scanned (2% of total) 2026-10-09T13:33:36.144439-07:00 worker-12 sshd[62680]: Received disconnect from 172.176.36.193 port 28084:11: Bye Bye [preauth] 2026-10-09T13:33:36.232224-07:00 web-02 nginx[1208]: 172.205.176.132 - deploy "POST /api/v2/orders/8841 HTTP/1.1" 200 2358 "-" "Go-http-client/1.1" 2026-10-09T13:33:36.402090-07:00 api-08 sshd[35114]: pam_unix(sshd:session): session opened for user müller(uid=5257) by (uid=0) 2026-10-09T13:33:36.532092-07:00 cache-3 systemd[1]: session-72371.scope: Deactivated successfully. 2026-10-09T13:33:36.625858-07:00 worker-12 haproxy[900]: 45.136.141.66:55273 [53761] http-in app/api-08 9394/0/603/603/9394 200 65247 - - ---- 170/170/46/46/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:33:36.674939-07:00 bastion haproxy[947]: 172.73.194.160:12230 [66258] http-in app/worker-12 521/0/19/19/521 200 56005 - - ---- 835/835/78/78/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:33:36.796847-07:00 db-replica app[30551]: INFO worker 61 finished job 06242c0d6ddd9ea9 in 1389 ms 2026-10-09T13:33:36.970654-07:00 web-01 kernel: [21942.421823] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.0.181.14 DST=10.0.135.135 LEN=97 TOS=0x00 PREC=0x00 TTL=97 ID=21942 DF PROTO=TCP SPT=5142 DPT=5142 WINDOW=21942 RES=0x00 SYN URGP=0 2026-10-09T13:33:37.003034-07:00 worker-12 app[30278]: INFO request_id=afb0c642433e6358 method=GET path=/api/v2/search?q=invoice status=200 duration=2419ms 2026-10-09T13:33:37.336980-07:00 worker-12 nginx[1210]: 172.252.166.5 - - "GET /admin HTTP/1.1" 200 65666 "-" "kube-probe/1.31" 2026-10-09T13:33:37.547116-07:00 worker-12 nginx[1207]: 91.24.205.68 - - "GET /health HTTP/1.1" 200 12478 "-" "kube-probe/1.31" 2026-10-09T13:33:37.609451-07:00 worker-12 app[30156]: INFO request_id=b97741d3256e665c method=GET path=/favicon.ico status=404 duration=9946ms 2026-10-09T13:33:37.899413-07:00 web-01 nginx[1209]: 10.226.118.78 - - "GET /static/app.js HTTP/1.1" 502 31556 "-" "curl/8.4.0" 2026-10-09T13:33:38.136742-07:00 web-02 nginx[1200]: 192.45.86.178 - - "GET /api/v2/users HTTP/1.1" 200 41779 "-" "python-requests/2.32.3" 2026-10-09T13:33:38.244577-07:00 web-02 postgres[21367]: LOG: duration: 8236.468 ms statement: SELECT * FROM orders WHERE customer_id = 48609 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:38.472471-07:00 worker-12 sshd[4109]: pam_unix(sshd:session): session opened for user zoë(uid=6794) by (uid=0) 2026-10-09T13:33:38.484794-07:00 db-replica haproxy[936]: 45.59.29.173:16685 [73278] http-in app/api-08 1176/0/517/517/1176 301 479 - - ---- 766/766/68/68/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:38.574073-07:00 cache-3 app[30542]: INFO request_id=71b345195c75d853 method=GET path=/metrics status=200 duration=6886ms 2026-10-09T13:33:39.103007-07:00 cache-3 haproxy[945]: 91.164.32.210:61827 [85206] http-in app/edge-fr-1 9655/0/613/613/9655 404 85465 - - ---- 520/520/84/84/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:33:39.169308-07:00 api-08 nginx[1209]: 10.19.237.176 - - "GET /static/main.css HTTP/1.1" 204 86741 "-" "Go-http-client/1.1" 2026-10-09T13:33:39.327848-07:00 db-replica sshd[20642]: Invalid user root from 203.133.11.201 port 62713 2026-10-09T13:33:39.368390-07:00 web-02 nginx[1200]: 172.90.88.117 - - "GET /.env HTTP/1.1" 200 30640 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:39.512301-07:00 web-02 sshd[31726]: Connection closed by 192.186.61.39 port 45137 [preauth] 2026-10-09T13:33:39.544057-07:00 edge-fr-1 app[30744]: INFO request_id=575b4b1af9a09b55 method=GET path=/static/app.js status=200 duration=4588ms 2026-10-09T13:33:39.607678-07:00 worker-12 systemd[1]: session-74848.scope: Deactivated successfully. 2026-10-09T13:33:39.706029-07:00 web-03 nginx[1210]: 192.87.20.50 - - "GET /login HTTP/1.1" 301 29015 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:39.817623-07:00 web-03 sshd[29607]: Failed password for invalid user zoë from 45.163.139.62 port 2583 ssh2 2026-10-09T13:33:39.932467-07:00 web-01 systemd[1]: Started Session 77468 of User sørensen. 2026-10-09T13:33:40.010878-07:00 bastion nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.244.99.47, server: app.example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.340.340:8080/favicon.ico" 2026-10-09T13:33:40.022847-07:00 db-primary app[30937]: INFO health check ok: db 315 ms, cache 315 ms, queue depth 68 2026-10-09T13:33:40.092442-07:00 worker-12 app[30835]: DEBUG cache hit ratio 84% over the last minute (78854 lookups) 2026-10-09T13:33:40.157778-07:00 worker-12 sshd[10121]: Invalid user backup from 172.78.185.133 port 38473 2026-10-09T13:33:40.235668-07:00 edge-fr-1 nginx[1204]: 203.121.195.213 - - "GET /api/v2/orders HTTP/1.1" 302 68930 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:40.237249-07:00 web-01 app[30478]: INFO worker 74 picked job 9e8877fda17cabdc from queue orders 2026-10-09T13:33:40.254648-07:00 api-07 nginx[1201]: 45.189.123.73 - deploy "POST /.env HTTP/1.1" 200 75226 "-" "python-requests/2.32.3" 2026-10-09T13:33:40.266123-07:00 bastion postgres[4700]: LOG: duration: 6543.158 ms statement: SELECT * FROM orders WHERE customer_id = 95671 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:40.339265-07:00 web-03 nginx[1201]: 192.79.96.162 - - "GET /metrics HTTP/1.1" 301 3316 "-" "python-requests/2.32.3" 2026-10-09T13:33:40.416950-07:00 web-03 haproxy[911]: 10.61.109.237:10226 [57559] http-in app/web-03 4288/0/62/62/4288 200 44409 - - ---- 485/485/66/66/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:33:40.551064-07:00 api-07 app[30092]: INFO worker 72 picked job f48a13ba6b7e8a38 from queue emails 2026-10-09T13:33:40.567391-07:00 web-02 app[30440]: INFO health check ok: db 585 ms, cache 585 ms, queue depth 57 2026-10-09T13:33:40.674781-07:00 db-replica systemd[1]: session-87424.scope: Deactivated successfully. 2026-10-09T13:33:40.805983-07:00 api-07 app[30418]: INFO request_id=c042ba914c7422a8 method=GET path=/metrics status=200 duration=4537ms 2026-10-09T13:33:41.082874-07:00 db-primary app[30180]: INFO health check ok: db 82 ms, cache 82 ms, queue depth 10 2026-10-09T13:33:41.393825-07:00 bastion haproxy[928]: 45.246.113.105:39835 [55751] http-in app/bastion 1823/0/930/930/1823 200 43828 - - ---- 410/410/91/91/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:33:41.446148-07:00 web-03 haproxy[932]: 192.106.222.38:61880 [61582] http-in app/web-02 1975/0/28/28/1975 404 73559 - - ---- 934/934/89/89/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:33:41.676393-07:00 worker-12 app[30547]: INFO order 37643 confirmed for sørensen in 9394 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:33:41.765283-07:00 api-08 kernel: [84831.340114] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.168.85.101 DST=10.0.376.376 LEN=19 TOS=0x00 PREC=0x00 TTL=19 ID=84831 DF PROTO=TCP SPT=15185 DPT=15185 WINDOW=84831 RES=0x00 SYN URGP=0 2026-10-09T13:33:41.989721-07:00 cache-3 app[30442]: INFO request_id=95799b646ebf880d method=GET path=/admin status=404 duration=4902ms 2026-10-09T13:33:42.137490-07:00 db-primary dockerd[700]: time="2026-10-09T13:33:42.137490-07:00" level=info msg="Container bd8670681f63d7fd exited with code 0" 2026-10-09T13:33:42.195723-07:00 api-07 app[30320]: INFO worker 82 picked job 7e258957e4bac7e5 from queue invoices 2026-10-09T13:33:42.326859-07:00 db-replica nginx[1210]: 45.34.187.209 - - "GET /favicon.ico HTTP/1.1" 200 66770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:42.547138-07:00 worker-12 app[30127]: INFO request_id=1f659f7cbf31c22f method=GET path=/metrics status=502 duration=5816ms 2026-10-09T13:33:42.688056-07:00 db-primary app[30176]: INFO request_id=6a43e4f9c3724105 method=GET path=/api/v2/search?q=invoice status=200 duration=3656ms 2026-10-09T13:33:42.797028-07:00 web-03 sshd[13421]: Connection closed by 203.249.166.37 port 5322 [preauth] 2026-10-09T13:33:42.984004-07:00 worker-12 nginx[1200]: 45.196.228.188 - - "GET /health HTTP/1.1" 200 77797 "-" "python-requests/2.32.3" 2026-10-09T13:33:43.014498-07:00 web-02 nginx[1206]: 203.129.127.113 - zoë "POST /api/v2/orders/8841 HTTP/1.1" 502 86060 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:43.026480-07:00 web-03 postgres[17979]: LOG: duration: 5452.462 ms statement: SELECT * FROM orders WHERE customer_id = 13426 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:43.097977-07:00 web-03 nginx[1208]: 203.197.49.147 - müller "POST /api/v2/orders/8841 HTTP/1.1" 302 49580 "-" "python-requests/2.32.3" 2026-10-09T13:33:43.263598-07:00 bastion nginx[1206]: 45.245.140.239 - - "GET /static/app.js HTTP/1.1" 200 64415 "-" "kube-probe/1.31" 2026-10-09T13:33:43.326384-07:00 worker-12 app[30993]: INFO request_id=6641d0850cf176ba method=GET path=/favicon.ico status=200 duration=3141ms 2026-10-09T13:33:43.414234-07:00 web-02 systemd[1]: session-44893.scope: Deactivated successfully. 2026-10-09T13:33:43.473840-07:00 edge-fr-1 app[30239]: INFO worker 80 finished job 1c9abc9f85fb547e in 7555 ms 2026-10-09T13:33:43.553280-07:00 api-07 nginx[1206]: 10.240.238.102 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 7408 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:43.560385-07:00 web-01 nginx[1202]: 91.125.132.16 - - "GET /api/v2/orders/8841 HTTP/1.1" 302 44894 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:43.643365-07:00 web-01 nginx[1201]: 203.177.169.242 - - "GET /health HTTP/1.1" 200 62399 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:43.899895-07:00 db-primary nginx[1208]: 192.56.89.65 - - "GET /login HTTP/1.1" 301 69828 "-" "Go-http-client/1.1" 2026-10-09T13:33:43.989699-07:00 api-08 app[30042]: INFO request_id=b901d9b7a24426cf method=GET path=/.env status=204 duration=2126ms 2026-10-09T13:33:44.254863-07:00 web-03 sshd[25758]: Invalid user priya from 45.92.134.134 port 45947 2026-10-09T13:33:44.443295-07:00 edge-fr-1 sshd[25064]: Accepted publickey for root from 203.16.70.174 port 61236 ssh2: ED25519 SHA256:35c8a7a7545e64c7 2026-10-09T13:33:44.532940-07:00 cache-3 haproxy[921]: 91.41.203.192:48890 [86909] http-in app/edge-fr-1 1065/0/401/401/1065 200 37568 - - ---- 841/841/80/80/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:33:44.758586-07:00 edge-fr-1 cron[8217]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:33:44.986734-07:00 api-08 sshd[20666]: Received disconnect from 10.152.163.61 port 37455:11: Bye Bye [preauth] 2026-10-09T13:33:45.051146-07:00 web-02 app[30399]: INFO worker 33 finished job 2ab6d60524addd12 in 7013 ms 2026-10-09T13:33:45.092538-07:00 web-01 sshd[33342]: Connection closed by 91.52.172.2 port 46104 [preauth] 2026-10-09T13:33:45.149193-07:00 web-01 app[30386]: INFO request_id=b56fca5ae38163a1 method=GET path=/favicon.ico status=404 duration=8522ms 2026-10-09T13:33:45.190832-07:00 web-01 app[30910]: INFO request_id=ea5a649bcd0470c4 method=GET path=/api/v2/orders status=404 duration=7868ms 2026-10-09T13:33:45.285042-07:00 edge-fr-1 nginx[1204]: 172.9.92.134 - - "GET /metrics HTTP/1.1" 500 77022 "-" "kube-probe/1.31" 2026-10-09T13:33:45.399262-07:00 web-03 systemd[1]: Started Session 55855 of User sørensen. 2026-10-09T13:33:45.509422-07:00 web-01 kernel: [33020.445222] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.205.223.192 DST=10.0.328.328 LEN=84 TOS=0x00 PREC=0x00 TTL=84 ID=33020 DF PROTO=TCP SPT=26104 DPT=26104 WINDOW=33020 RES=0x00 SYN URGP=0 2026-10-09T13:33:45.766210-07:00 web-03 app[30366]: INFO worker 83 finished job 9c72fcea28e8693b in 9901 ms 2026-10-09T13:33:45.802086-07:00 bastion nginx[1205]: 192.55.176.57 - - "GET /favicon.ico HTTP/1.1" 301 2585 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:45.863569-07:00 api-07 nginx[1207]: 172.82.48.100 - - "GET /static/main.css HTTP/1.1" 302 60363 "-" "kube-probe/1.31" 2026-10-09T13:33:46.062294-07:00 worker-12 app[30601]: INFO request_id=6874c64b3923986b method=GET path=/login status=302 duration=7629ms 2026-10-09T13:33:46.129099-07:00 bastion haproxy[931]: 45.252.235.201:44673 [24023] http-in app/web-01 9259/0/902/902/9259 500 1512 - - ---- 629/629/89/89/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:33:46.958378-07:00 bastion nginx[1209]: 203.60.63.58 - - "GET /admin HTTP/1.1" 204 39789 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:47.012527-07:00 cache-3 app[30961]: INFO request_id=cd8a2de9b5244601 method=GET path=/api/v2/orders/8841 status=200 duration=9993ms 2026-10-09T13:33:47.078498-07:00 api-08 haproxy[948]: 192.251.120.236:59774 [11914] http-in app/api-08 6821/0/821/821/6821 200 37953 - - ---- 268/268/21/21/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:33:47.336067-07:00 bastion sshd[15335]: Received disconnect from 203.89.230.101 port 4460:11: Bye Bye [preauth] 2026-10-09T13:33:47.567706-07:00 worker-12 app[30884]: DEBUG cache hit ratio 98% over the last minute (80389 lookups) 2026-10-09T13:33:47.746521-07:00 cache-3 nginx[1210]: 45.164.109.185 - - "GET /.env HTTP/1.1" 204 57527 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:47.798446-07:00 web-03 app[30837]: INFO request_id=084652b6c61cc22a method=GET path=/.env status=302 duration=9133ms 2026-10-09T13:33:48.126706-07:00 cache-3 nginx[1202]: 192.22.32.108 - - "GET /favicon.ico HTTP/1.1" 204 53965 "-" "Go-http-client/1.1" 2026-10-09T13:33:48.231489-07:00 bastion app[30986]: INFO health check ok: db 814 ms, cache 814 ms, queue depth 58 2026-10-09T13:33:48.440584-07:00 edge-fr-1 sshd[16824]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:33:48.710340-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578028.976:89734): pid=89734 uid=0 auid=8127 ses=549 msg='op=login id=8127 exe="/usr/sbin/sshd" hostname=? addr=91.251.98.215 terminal=/dev/pts/0 res=success' 2026-10-09T13:33:49.035017-07:00 db-replica systemd[1]: Started Session 47363 of User müller. 2026-10-09T13:33:49.138603-07:00 web-02 app[30181]: INFO worker 63 picked job 2d755d504252ca77 from queue orders 2026-10-09T13:33:49.143045-07:00 web-01 app[30283]: INFO worker 14 picked job 304254f8571b658b from queue orders 2026-10-09T13:33:49.254948-07:00 cache-3 nginx[1209]: 45.183.10.93 - - "GET /admin HTTP/1.1" 302 9318 "-" "curl/8.4.0" 2026-10-09T13:33:49.275157-07:00 bastion sshd[1454]: Connection closed by 45.197.252.183 port 56359 [preauth] 2026-10-09T13:33:49.407118-07:00 worker-12 nginx[1210]: 10.234.102.70 - - "GET /static/app.js HTTP/1.1" 404 43685 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:49.522235-07:00 web-02 app[30073]: DEBUG cache hit ratio 98% over the last minute (56520 lookups) 2026-10-09T13:33:49.625767-07:00 web-02 nginx[1202]: 172.195.3.9 - - "GET /api/v2/orders HTTP/1.1" 404 50488 "-" "kube-probe/1.31" 2026-10-09T13:33:49.637739-07:00 web-03 app[30450]: INFO request_id=83489df10542d12b method=GET path=/api/v2/search?q=invoice status=404 duration=329ms 2026-10-09T13:33:49.676420-07:00 db-primary app[30775]: INFO worker 94 finished job 08d79aeda1a6be23 in 5451 ms 2026-10-09T13:33:49.688392-07:00 api-07 postgres[8297]: LOG: duration: 7873.190 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:49.808281-07:00 cache-3 postgres[28200]: LOG: duration: 5138.89 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:49.823943-07:00 web-03 sshd[42160]: Accepted publickey for akira from 172.173.22.24 port 58872 ssh2: ED25519 SHA256:a9bb9aab463e0fac 2026-10-09T13:33:49.840876-07:00 worker-12 haproxy[948]: 203.225.133.53:61690 [21270] http-in app/api-08 5015/0/614/614/5015 404 42859 - - ---- 795/795/40/40/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:33:49.867773-07:00 api-08 kernel: [53807.849847] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.38.24.105 DST=10.0.599.599 LEN=84 TOS=0x00 PREC=0x00 TTL=84 ID=53807 DF PROTO=TCP SPT=20963 DPT=20963 WINDOW=53807 RES=0x00 SYN URGP=0 2026-10-09T13:33:49.894808-07:00 edge-fr-1 postgres[10528]: LOG: duration: 2300.482 ms statement: SELECT * FROM orders WHERE customer_id = 81857 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:49.902256-07:00 web-02 nginx[1203]: 203.51.43.79 - akira "POST /api/v2/users HTTP/1.1" 502 36549 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:50.080745-07:00 bastion app[30993]: INFO request_id=1b3a07f044f5e0ca method=GET path=/wp-login.php status=200 duration=9843ms 2026-10-09T13:33:50.288460-07:00 db-replica nginx[1200]: 192.97.92.178 - - "GET /static/main.css HTTP/1.1" 500 50186 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:50.566270-07:00 worker-12 app[30822]: INFO order 53860 confirmed for zoë in 70 ms (region eu-west-1, queue invoices) 2026-10-09T13:33:50.682635-07:00 cache-3 nginx[1210]: 192.236.189.157 - françois "POST /api/v2/orders HTTP/1.1" 200 36933 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:50.685788-07:00 web-03 nginx[1201]: 91.214.151.69 - - "GET /static/app.js HTTP/1.1" 200 85491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:50.966503-07:00 api-08 app[30431]: INFO request_id=6de98b96583dc702 method=GET path=/api/v2/search?q=invoice status=404 duration=5749ms 2026-10-09T13:33:51.076772-07:00 cache-3 app[30221]: INFO request_id=51109073089be0eb method=GET path=/admin status=404 duration=5458ms 2026-10-09T13:33:51.083588-07:00 web-03 app[30516]: INFO order 59165 confirmed for backup in 6413 ms (region us-east-1, queue emails) 2026-10-09T13:33:51.125872-07:00 web-03 haproxy[908]: 10.72.120.172:10838 [50052] http-in app/web-01 8545/0/111/111/8545 404 39099 - - ---- 555/555/22/22/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:33:51.199687-07:00 api-07 nginx[1204]: 172.218.237.165 - - "GET /api/v2/users HTTP/1.1" 500 35607 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:33:51.231821-07:00 web-03 sshd[57747]: Failed password for invalid user root from 45.194.22.234 port 59259 ssh2 2026-10-09T13:33:51.415955-07:00 api-07 app[30734]: INFO order 98102 confirmed for deploy in 9484 ms (region eu-west-1, queue orders) 2026-10-09T13:33:51.899622-07:00 web-03 sshd[9134]: Failed password for invalid user ci from 91.136.157.19 port 12924 ssh2 2026-10-09T13:33:51.979059-07:00 api-08 app[30882]: INFO request_id=4ff993b53f0abad4 method=GET path=/api/v2/orders status=301 duration=6281ms 2026-10-09T13:33:52.063385-07:00 worker-12 app[30834]: INFO request_id=f2a73d5354a89b54 method=GET path=/metrics status=404 duration=5513ms 2026-10-09T13:33:52.176092-07:00 edge-fr-1 haproxy[901]: 203.84.50.61:56939 [39984] http-in app/web-02 4243/0/599/599/4243 301 28682 - - ---- 488/488/89/89/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:33:52.381821-07:00 edge-fr-1 sshd[15892]: Failed password for invalid user deploy from 172.128.212.132 port 36318 ssh2 2026-10-09T13:33:52.449067-07:00 api-08 sshd[18031]: Accepted publickey for priya from 91.178.219.167 port 46506 ssh2: ED25519 SHA256:c4555169f51531d8 2026-10-09T13:33:52.539397-07:00 web-03 haproxy[911]: 203.195.24.141:36869 [75092] http-in app/web-01 7184/0/833/833/7184 404 39458 - - ---- 334/334/79/79/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:33:52.606093-07:00 api-07 app[30513]: INFO order 43369 confirmed for akira in 4446 ms (region eu-west-1, queue invoices) 2026-10-09T13:33:52.635652-07:00 web-03 app[30552]: INFO request_id=06b9e69c23e590cd method=GET path=/admin status=302 duration=3893ms 2026-10-09T13:33:53.032138-07:00 web-03 nginx[1204]: 172.207.140.135 - ci "POST /static/app.js HTTP/1.1" 200 38723 "-" "kube-probe/1.31" 2026-10-09T13:33:53.036657-07:00 api-08 app[30060]: INFO request_id=82fb43aea518cf17 method=GET path=/api/v2/search?q=invoice status=200 duration=8058ms 2026-10-09T13:33:53.160222-07:00 db-primary sshd[54434]: Accepted publickey for backup from 45.210.185.164 port 35476 ssh2: ED25519 SHA256:aaec59b9f926e750 2026-10-09T13:33:53.258991-07:00 web-02 postgres[17323]: LOG: duration: 4091.781 ms statement: SELECT * FROM orders WHERE customer_id = 24522 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:53.307231-07:00 db-replica app[30113]: INFO order 18558 confirmed for deploy in 3264 ms (region ap-northeast-1, queue emails) 2026-10-09T13:33:53.603523-07:00 db-replica systemd[1]: Started Session 69019 of User deploy. 2026-10-09T13:33:53.718198-07:00 web-01 haproxy[946]: 203.174.191.65:23095 [26413] http-in app/web-01 8322/0/944/944/8322 404 80302 - - ---- 584/584/20/20/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:33:53.896353-07:00 db-primary sshd[56660]: Failed password for invalid user sørensen from 172.207.39.189 port 9120 ssh2 2026-10-09T13:33:53.896894-07:00 api-08 postgres[31863]: LOG: duration: 9819.723 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:54.140335-07:00 web-02 cron[25985]: (sørensen) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:33:54.416367-07:00 edge-fr-1 app[30350]: DEBUG cache hit ratio 77% over the last minute (28007 lookups) 2026-10-09T13:33:54.553370-07:00 api-07 app[30665]: INFO worker 93 finished job fd8c96c3620b800b in 9101 ms 2026-10-09T13:33:54.564537-07:00 web-02 app[30601]: INFO health check ok: db 652 ms, cache 652 ms, queue depth 46 2026-10-09T13:33:54.567617-07:00 db-primary app[30409]: INFO worker 73 picked job eabc6f1d0783f4d6 from queue emails 2026-10-09T13:33:54.575160-07:00 api-08 app[30173]: INFO order 66377 confirmed for backup in 8138 ms (region eu-west-1, queue emails) 2026-10-09T13:33:54.646555-07:00 api-08 kernel: [62496.619944] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.121.196.169 DST=10.0.755.755 LEN=48 TOS=0x00 PREC=0x00 TTL=48 ID=62496 DF PROTO=TCP SPT=57898 DPT=57898 WINDOW=62496 RES=0x00 SYN URGP=0 2026-10-09T13:33:54.744408-07:00 edge-fr-1 cron[44407]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:33:54.848099-07:00 cache-3 sshd[39572]: Accepted publickey for priya from 45.65.205.16 port 50460 ssh2: ED25519 SHA256:a4637914e6d82019 2026-10-09T13:33:54.928758-07:00 web-02 postgres[24489]: LOG: duration: 6407.623 ms statement: SELECT * FROM orders WHERE customer_id = 76182 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:33:55.020650-07:00 web-02 app[30775]: INFO order 26933 confirmed for müller in 1016 ms (region us-east-1, queue orders) 2026-10-09T13:33:55.273545-07:00 db-primary nginx[1204]: 10.44.224.44 - - "GET /wp-login.php HTTP/1.1" 204 78317 "-" "kube-probe/1.31" 2026-10-09T13:33:55.393055-07:00 worker-12 app[30231]: INFO worker 19 finished job edbb7be74453b0e0 in 1067 ms 2026-10-09T13:33:55.409426-07:00 db-primary app[30590]: INFO worker 36 finished job 95ed93f2cabbb6f3 in 3377 ms 2026-10-09T13:33:55.593522-07:00 web-03 app[30467]: INFO order 57891 confirmed for müller in 5367 ms (region eu-west-1, queue orders) 2026-10-09T13:33:55.643995-07:00 edge-fr-1 haproxy[938]: 172.169.216.2:64742 [74143] http-in app/cache-3 4629/0/675/675/4629 301 12909 - - ---- 884/884/91/91/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:33:55.664947-07:00 cache-3 sshd[40633]: pam_unix(sshd:session): session opened for user françois(uid=9915) by (uid=0) 2026-10-09T13:33:55.717651-07:00 edge-fr-1 app[30417]: INFO order 54225 confirmed for priya in 9551 ms (region eu-west-1, queue emails) 2026-10-09T13:33:55.760917-07:00 web-01 sshd[19265]: Accepted publickey for ci from 192.203.31.85 port 13332 ssh2: ED25519 SHA256:fcc5ce7b384613ec 2026-10-09T13:33:55.843381-07:00 cache-3 app[30994]: INFO health check ok: db 590 ms, cache 590 ms, queue depth 42 2026-10-09T13:33:55.863926-07:00 web-02 postgres[17913]: LOG: duration: 7719.158 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:55.914312-07:00 cache-3 postgres[14129]: LOG: checkpoint complete: wrote 3262 buffers (98%); 0 WAL file(s) added, 0 removed, 90 recycled; write=315.663 s, sync=0.663 s, total=315.663 s 2026-10-09T13:33:56.002917-07:00 bastion app[30971]: INFO request_id=421661730e8d4d5e method=GET path=/login status=204 duration=3368ms 2026-10-09T13:33:56.128039-07:00 worker-12 app[30547]: INFO worker 57 picked job a88e2d1f33d7b3bc from queue orders 2026-10-09T13:33:56.259760-07:00 db-replica cron[12176]: (root) CMD (/usr/bin/backup --quiet --target /srv/root) 2026-10-09T13:33:56.395848-07:00 web-03 postgres[2662]: LOG: duration: 8080.455 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:56.504279-07:00 api-08 kubelet[800]: I1009 13:33:56.028056 3549 kubelet.go:3549] "Pod is terminating, skipping pod status update" pod="default/api-9e54b8b0d8dbda56" 2026-10-09T13:33:56.817415-07:00 web-01 nginx[1200]: 203.116.157.244 - sørensen "POST /metrics HTTP/1.1" 200 2347 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:56.830016-07:00 web-03 kernel: [91444.444353] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.75.135.119 DST=10.0.863.863 LEN=94 TOS=0x00 PREC=0x00 TTL=94 ID=91444 DF PROTO=TCP SPT=14864 DPT=14864 WINDOW=91444 RES=0x00 SYN URGP=0 2026-10-09T13:33:56.870064-07:00 web-03 app[30509]: INFO worker 95 finished job 12657a54e62f8c78 in 9085 ms 2026-10-09T13:33:56.889872-07:00 web-02 app[30694]: INFO order 94535 confirmed for deploy in 9547 ms (region ap-northeast-1, queue orders) 2026-10-09T13:33:57.057943-07:00 web-02 app[30113]: INFO order 91192 confirmed for müller in 8696 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:33:57.079478-07:00 db-replica kubelet[800]: E1009 13:33:57.433077 5561 pod_workers.go:5561] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-fefc2ad04a4679ec" 2026-10-09T13:33:57.280661-07:00 edge-fr-1 nginx[1207]: 10.178.171.245 - - "GET /static/app.js HTTP/1.1" 200 4855 "-" "curl/8.4.0" 2026-10-09T13:33:57.470695-07:00 edge-fr-1 kernel: [57051.429235] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.232.141.95 DST=10.0.925.925 LEN=61 TOS=0x00 PREC=0x00 TTL=61 ID=57051 DF PROTO=TCP SPT=22558 DPT=22558 WINDOW=57051 RES=0x00 SYN URGP=0 2026-10-09T13:33:57.482279-07:00 db-primary sshd[17800]: pam_unix(sshd:session): session opened for user sørensen(uid=8080) by (uid=0) 2026-10-09T13:33:57.509508-07:00 worker-12 app[30643]: INFO request_id=daf6695416b55947 method=GET path=/api/v2/orders status=500 duration=1727ms 2026-10-09T13:33:57.700560-07:00 db-replica nginx[1208]: 203.230.211.237 - ci "POST /favicon.ico HTTP/1.1" 200 2223 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:57.739968-07:00 worker-12 app[30665]: INFO worker 54 finished job 92c55651eb9a7d3f in 3632 ms 2026-10-09T13:33:57.951615-07:00 web-03 app[30960]: INFO worker 71 finished job 43347c5daf8b9cd6 in 5718 ms 2026-10-09T13:33:57.975166-07:00 bastion app[30803]: INFO health check ok: db 670 ms, cache 670 ms, queue depth 39 2026-10-09T13:33:58.028939-07:00 api-08 app[30414]: INFO request_id=b585f4a428f4beb2 method=GET path=/api/v2/orders/8841 status=404 duration=7053ms 2026-10-09T13:33:58.242029-07:00 edge-fr-1 haproxy[922]: 203.210.159.205:50770 [32661] http-in app/web-01 7820/0/151/151/7820 204 16724 - - ---- 803/803/67/67/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:33:58.245308-07:00 edge-fr-1 sudo: priya : TTY=pts/0 ; PWD=/home/priya ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:33:58.408778-07:00 edge-fr-1 app[30267]: INFO request_id=72572031ef89aa09 method=GET path=/login status=401 duration=7079ms 2026-10-09T13:33:58.731334-07:00 db-replica nginx[1207]: 10.2.177.134 - - "GET /.env HTTP/1.1" 302 19997 "-" "curl/8.4.0" 2026-10-09T13:33:58.849823-07:00 cache-3 nginx[1210]: 192.232.154.136 - - "GET /wp-login.php HTTP/1.1" 200 71313 "-" "kube-probe/1.31" 2026-10-09T13:33:58.872073-07:00 worker-12 haproxy[942]: 10.209.108.73:34636 [82878] http-in app/api-07 5511/0/5/5/5511 301 87413 - - ---- 854/854/98/98/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:33:58.920845-07:00 db-primary app[30007]: ERROR unhandled exception in worker 26 while processing job 3502b049233414f2 java.lang.NullPointerException: Cannot invoke "com.example.billing.Invoice.getTotal()" because "invoice" is null at com.example.billing.InvoiceService.charge(InvoiceService.java:320) at com.example.billing.InvoiceService.process(InvoiceService.java:70) at com.example.jobs.Worker.run(Worker.java:892) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:840) 2026-10-09T13:33:58.966094-07:00 web-02 sshd[41985]: Connection closed by 45.102.113.203 port 36019 [preauth] 2026-10-09T13:33:59.151819-07:00 api-07 postgres[19480]: LOG: duration: 1178.663 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:33:59.509306-07:00 web-01 nginx[1210]: 172.109.229.71 - - "GET /health HTTP/1.1" 200 23612 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:33:59.616591-07:00 api-07 cron[33933]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:33:59.656706-07:00 api-08 nginx[1210]: 203.242.161.34 - - "GET /metrics HTTP/1.1" 404 46121 "-" "curl/8.4.0" 2026-10-09T13:33:59.664907-07:00 web-02 app[30679]: INFO order 12180 confirmed for sørensen in 2295 ms (region us-east-1, queue emails) 2026-10-09T13:33:59.841551-07:00 db-replica app[30160]: INFO health check ok: db 259 ms, cache 259 ms, queue depth 99 2026-10-09T13:33:59.862468-07:00 db-primary sshd[60471]: Invalid user müller from 10.38.210.111 port 4053 2026-10-09T13:33:59.976394-07:00 api-08 systemd[1]: session-28195.scope: Deactivated successfully. 2026-10-09T13:34:00.195808-07:00 web-03 nginx[1203]: 172.87.200.236 - - "GET /metrics HTTP/1.1" 401 86580 "-" "Go-http-client/1.1" 2026-10-09T13:34:00.384481-07:00 bastion nginx[1206]: 10.225.149.23 - - "GET /favicon.ico HTTP/1.1" 404 27125 "-" "Go-http-client/1.1" 2026-10-09T13:34:00.406260-07:00 edge-fr-1 nginx[1208]: 91.118.192.187 - priya "POST /login HTTP/1.1" 204 63786 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:00.477837-07:00 worker-12 systemd[1]: session-84726.scope: Deactivated successfully. 2026-10-09T13:34:00.796670-07:00 api-07 nginx[1200]: 172.122.161.104 - - "GET /favicon.ico HTTP/1.1" 302 38961 "-" "python-requests/2.32.3" 2026-10-09T13:34:00.903350-07:00 bastion sshd[3593]: Received disconnect from 192.114.33.45 port 46138:11: Bye Bye [preauth] 2026-10-09T13:34:01.364222-07:00 api-07 app[30664]: INFO worker 30 picked job ab38e3d0fd78db72 from queue invoices 2026-10-09T13:34:01.590770-07:00 api-08 app[30950]: INFO health check ok: db 716 ms, cache 716 ms, queue depth 28 2026-10-09T13:34:01.681069-07:00 edge-fr-1 sshd[56803]: Received disconnect from 45.220.245.50 port 26674:11: Bye Bye [preauth] 2026-10-09T13:34:01.720641-07:00 cache-3 app[30787]: INFO health check ok: db 349 ms, cache 349 ms, queue depth 42 2026-10-09T13:34:01.768936-07:00 api-08 sshd[5214]: Failed password for invalid user sørensen from 192.186.243.200 port 23059 ssh2 2026-10-09T13:34:01.801382-07:00 db-replica nginx[1201]: 192.203.164.118 - - "GET /api/v2/orders HTTP/1.1" 204 42042 "-" "kube-probe/1.31" 2026-10-09T13:34:02.078858-07:00 edge-fr-1 sshd[11168]: Invalid user deploy from 91.247.203.198 port 51409 2026-10-09T13:34:02.296353-07:00 edge-fr-1 app[30823]: INFO request_id=0cc9a6ec2114309a method=GET path=/static/main.css status=401 duration=3800ms 2026-10-09T13:34:02.298032-07:00 api-07 nginx[1203]: 203.164.12.26 - priya "POST /metrics HTTP/1.1" 200 3723 "-" "curl/8.4.0" 2026-10-09T13:34:02.348545-07:00 db-primary postgres[26306]: LOG: duration: 6221.341 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:02.404260-07:00 web-02 nginx[1207]: 203.226.149.253 - - "GET /api/v2/orders/8841 HTTP/1.1" 301 49022 "-" "curl/8.4.0" 2026-10-09T13:34:02.431959-07:00 api-07 nginx[1208]: 203.247.136.169 - akira "POST /api/v2/orders/8841 HTTP/1.1" 200 14469 "-" "python-requests/2.32.3" 2026-10-09T13:34:02.497129-07:00 web-03 systemd[1]: session-55623.scope: Deactivated successfully. 2026-10-09T13:34:02.564373-07:00 edge-fr-1 app[30094]: DEBUG cache hit ratio 55% over the last minute (15085 lookups) 2026-10-09T13:34:02.573289-07:00 worker-12 postgres[12004]: LOG: duration: 7655.920 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:02.799522-07:00 worker-12 dockerd[700]: time="2026-10-09T13:34:02.799522-07:00" level=info msg="Container a742972df1d1f58c exited with code 0" 2026-10-09T13:34:02.953835-07:00 worker-12 app[30822]: INFO worker 16 finished job 1d4f9eb4887ca5d7 in 4551 ms 2026-10-09T13:34:03.360462-07:00 edge-fr-1 app[30568]: INFO worker 72 picked job 7cd60e359fd4a852 from queue emails 2026-10-09T13:34:03.394353-07:00 web-02 sshd[26432]: Accepted publickey for akira from 45.254.2.207 port 59183 ssh2: ED25519 SHA256:d71a5d3411eb9abe 2026-10-09T13:34:03.520953-07:00 web-01 nginx[1209]: 203.163.141.124 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 49007 "-" "kube-probe/1.31" 2026-10-09T13:34:03.529384-07:00 edge-fr-1 app[30509]: INFO request_id=faae6d23f863391b method=GET path=/login status=404 duration=5729ms 2026-10-09T13:34:03.799551-07:00 cache-3 app[30781]: INFO request_id=1a0588b7687bc029 method=GET path=/health status=200 duration=5252ms 2026-10-09T13:34:04.230011-07:00 web-01 haproxy[927]: 91.205.56.151:53164 [55774] http-in app/db-replica 21/0/669/669/21 200 28810 - - ---- 607/607/40/40/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:34:04.247007-07:00 api-07 sshd[64006]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:34:04.252889-07:00 web-02 kernel: [49527.759860] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.115.144.227 DST=10.0.674.674 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=49527 DF PROTO=TCP SPT=60125 DPT=60125 WINDOW=49527 RES=0x00 SYN URGP=0 2026-10-09T13:34:04.354236-07:00 cache-3 sshd[38442]: Connection closed by 10.146.167.142 port 63764 [preauth] 2026-10-09T13:34:04.512572-07:00 api-08 app[30395]: INFO request_id=28fc9fd538750331 method=GET path=/health status=301 duration=9975ms 2026-10-09T13:34:04.585306-07:00 db-replica nginx[1204]: 172.201.79.182 - priya "POST /api/v2/orders/8841 HTTP/1.1" 404 69518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:04.624349-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791578044.794:11830): pid=11830 uid=0 auid=7361 ses=244 msg='op=login id=7361 exe="/usr/sbin/sshd" hostname=? addr=10.51.202.204 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:04.905451-07:00 edge-fr-1 nginx[1208]: 10.39.34.46 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 16277 "-" "kube-probe/1.31" 2026-10-09T13:34:05.046989-07:00 api-07 haproxy[908]: 172.73.202.45:4421 [98373] http-in app/edge-fr-1 2033/0/262/262/2033 401 61559 - - ---- 334/334/45/45/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:34:05.059748-07:00 api-07 app[30202]: INFO worker 31 picked job f1134c0c2053d4e7 from queue webhooks 2026-10-09T13:34:05.200130-07:00 web-03 sshd[63892]: Failed password for invalid user deploy from 10.87.190.209 port 59413 ssh2 2026-10-09T13:34:05.298696-07:00 web-02 app[30097]: DEBUG cache hit ratio 48% over the last minute (86856 lookups) 2026-10-09T13:34:05.523168-07:00 edge-fr-1 cron[21170]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:34:05.903322-07:00 web-01 app[30027]: INFO worker 10 picked job d20c27845f17658c from queue orders 2026-10-09T13:34:05.915299-07:00 api-08 app[30753]: INFO worker 86 picked job 816380bfc72250e6 from queue orders 2026-10-09T13:34:05.995980-07:00 cache-3 app[30312]: INFO worker 51 picked job 50849b51279279b1 from queue webhooks 2026-10-09T13:34:06.049916-07:00 bastion nginx[1204]: 203.63.244.217 - françois "POST /wp-login.php HTTP/1.1" 200 67038 "-" "Go-http-client/1.1" 2026-10-09T13:34:06.130132-07:00 edge-fr-1 app[30825]: INFO request_id=9ebcfeb2e81050f3 method=GET path=/api/v2/orders status=404 duration=9861ms 2026-10-09T13:34:06.289613-07:00 api-08 audit: type=USER_LOGIN msg=audit(1791578046.248:76436): pid=76436 uid=0 auid=3734 ses=168 msg='op=login id=3734 exe="/usr/sbin/sshd" hostname=? addr=203.208.47.204 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:06.290091-07:00 bastion app[30458]: INFO health check ok: db 42 ms, cache 42 ms, queue depth 68 2026-10-09T13:34:06.299055-07:00 api-07 app[30717]: INFO worker 70 picked job 1626347fcde13ba2 from queue orders 2026-10-09T13:34:06.400901-07:00 api-08 app[30923]: INFO worker 70 picked job f582148ef02189fc from queue orders 2026-10-09T13:34:06.589773-07:00 web-01 nginx[1208]: 91.87.192.194 - - "GET /static/main.css HTTP/1.1" 200 26193 "-" "curl/8.4.0" 2026-10-09T13:34:06.892080-07:00 web-03 nginx[1203]: 203.243.47.25 - priya "POST /api/v2/search?q=invoice HTTP/1.1" 200 29601 "-" "Go-http-client/1.1" 2026-10-09T13:34:07.401299-07:00 edge-fr-1 nginx[1207]: 45.112.39.85 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 65435 "-" "curl/8.4.0" 2026-10-09T13:34:07.555209-07:00 worker-12 nginx[1210]: 10.112.176.48 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 77589 "-" "Go-http-client/1.1" 2026-10-09T13:34:07.817433-07:00 api-07 app[30776]: INFO order 97461 confirmed for müller in 5982 ms (region eu-west-1, queue invoices) 2026-10-09T13:34:07.915494-07:00 db-primary nginx[1207]: 203.130.146.169 - deploy "POST /login HTTP/1.1" 200 61881 "-" "python-requests/2.32.3" 2026-10-09T13:34:07.978075-07:00 web-02 app[30181]: INFO worker 20 picked job f04b4f16344b00e0 from queue invoices 2026-10-09T13:34:08.281363-07:00 db-replica sshd[8662]: Failed password for invalid user müller from 172.110.177.3 port 45107 ssh2 2026-10-09T13:34:08.363382-07:00 worker-12 app[30674]: INFO request_id=181a9617d4db8f04 method=GET path=/static/main.css status=302 duration=7942ms 2026-10-09T13:34:08.404228-07:00 db-primary postgres[26248]: LOG: duration: 1622.817 ms statement: SELECT * FROM orders WHERE customer_id = 21338 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:08.534880-07:00 web-01 app[30204]: INFO worker 53 picked job 509e9064255907e4 from queue orders 2026-10-09T13:34:08.569940-07:00 db-replica nginx[1210]: 45.120.93.134 - - "GET /admin HTTP/1.1" 204 59949 "-" "Go-http-client/1.1" 2026-10-09T13:34:08.650621-07:00 worker-12 app[30867]: INFO health check ok: db 157 ms, cache 157 ms, queue depth 33 2026-10-09T13:34:08.657297-07:00 api-07 postgres[22278]: LOG: duration: 9605.228 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:08.799121-07:00 worker-12 app[30832]: INFO worker 61 picked job 0422dac265b7d94c from queue invoices 2026-10-09T13:34:08.830492-07:00 api-08 sshd[14876]: Invalid user backup from 91.230.134.65 port 26905 2026-10-09T13:34:08.903832-07:00 edge-fr-1 app[30996]: INFO worker 79 finished job e536d46d18c08361 in 6973 ms 2026-10-09T13:34:09.038315-07:00 edge-fr-1 systemd[1]: session-30748.scope: Deactivated successfully. 2026-10-09T13:34:09.118779-07:00 web-03 app[30604]: INFO request_id=6081af9b3f8f8196 method=GET path=/static/main.css status=404 duration=7937ms 2026-10-09T13:34:09.641165-07:00 web-02 cron[13003]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:34:09.649149-07:00 api-08 app[30074]: INFO request_id=79b28d40f7f324ae method=GET path=/api/v2/orders/8841 status=502 duration=8688ms 2026-10-09T13:34:09.733719-07:00 db-replica app[30222]: INFO order 79967 confirmed for backup in 4383 ms (region us-east-1, queue invoices) 2026-10-09T13:34:09.783350-07:00 db-primary nginx[1201]: 192.122.166.116 - - "GET /metrics HTTP/1.1" 200 2914 "-" "curl/8.4.0" 2026-10-09T13:34:10.222067-07:00 web-01 nginx[1206]: 192.115.15.221 - - "GET /health HTTP/1.1" 401 58893 "-" "python-requests/2.32.3" 2026-10-09T13:34:10.314025-07:00 web-03 haproxy[923]: 91.52.201.193:44253 [77807] http-in app/api-08 4787/0/874/874/4787 200 52538 - - ---- 794/794/83/83/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:34:10.318306-07:00 bastion kernel: [93390.729793] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.227.137.43 DST=10.0.502.502 LEN=93 TOS=0x00 PREC=0x00 TTL=93 ID=93390 DF PROTO=TCP SPT=2903 DPT=2903 WINDOW=93390 RES=0x00 SYN URGP=0 2026-10-09T13:34:10.475345-07:00 bastion sshd[12481]: Failed password for invalid user zoë from 45.234.20.203 port 48288 ssh2 2026-10-09T13:34:10.629078-07:00 db-replica postgres[26354]: LOG: duration: 1684.648 ms statement: SELECT * FROM orders WHERE customer_id = 84663 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:10.873354-07:00 api-08 sshd[38797]: Accepted publickey for akira from 10.85.13.169 port 34762 ssh2: ED25519 SHA256:e6712f7242627f45 2026-10-09T13:34:10.950275-07:00 cache-3 app[30567]: INFO request_id=54305d9b258cb601 method=GET path=/admin status=204 duration=6016ms 2026-10-09T13:34:10.974633-07:00 cache-3 postgres[18934]: LOG: duration: 234.50 ms statement: SELECT * FROM orders WHERE customer_id = 37983 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:10.991816-07:00 db-primary postgres[24682]: LOG: duration: 2402.981 ms statement: SELECT * FROM orders WHERE customer_id = 48332 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:11.071549-07:00 db-replica postgres[2056]: LOG: duration: 7734.211 ms statement: SELECT * FROM orders WHERE customer_id = 97453 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:11.155944-07:00 web-02 nginx[1204]: 45.203.250.90 - zoë "POST /api/v2/users HTTP/1.1" 200 66007 "-" "Go-http-client/1.1" 2026-10-09T13:34:11.265544-07:00 edge-fr-1 app[30674]: INFO worker 31 picked job 3ad084b3151a48f1 from queue invoices 2026-10-09T13:34:11.317205-07:00 api-07 app[30915]: INFO worker 48 picked job 35b82b3e17e08ba1 from queue emails 2026-10-09T13:34:11.397062-07:00 api-08 nginx[1206]: 172.82.140.111 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 18420 "-" "Go-http-client/1.1" 2026-10-09T13:34:11.771790-07:00 edge-fr-1 nginx[1210]: 91.158.81.120 - - "GET /static/main.css HTTP/1.1" 200 35455 "-" "kube-probe/1.31" 2026-10-09T13:34:12.096831-07:00 api-07 app[30206]: INFO request_id=20388cb201aec16f method=GET path=/.env status=404 duration=1889ms 2026-10-09T13:34:12.310235-07:00 api-07 app[30213]: INFO order 24456 confirmed for ci in 5616 ms (region eu-west-1, queue emails) 2026-10-09T13:34:12.372061-07:00 api-08 cron[9605]: (françois) CMD (/usr/bin/backup --quiet --target /srv/françois) 2026-10-09T13:34:12.502420-07:00 web-03 systemd[1]: session-10381.scope: Deactivated successfully. 2026-10-09T13:34:12.755566-07:00 cache-3 app[30938]: ERROR cache miss storm: 4629 misses in 6334 ms, key prefix session:deploy 2026-10-09T13:34:12.924106-07:00 api-07 app[30315]: INFO order 63555 confirmed for backup in 7461 ms (region eu-west-1, queue webhooks) 2026-10-09T13:34:13.320789-07:00 bastion haproxy[908]: Server app/edge-fr-1 is UP, reason: Layer7 check passed, code: 200, check duration: 277ms. 84 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:34:13.502079-07:00 web-02 app[30082]: INFO worker 52 finished job d582765eca358516 in 2942 ms 2026-10-09T13:34:13.628588-07:00 worker-12 app[30615]: WARN retrying upstream 192.159.170.160:11620 after timeout (255 ms), attempt 3 of 3 2026-10-09T13:34:13.815805-07:00 web-02 haproxy[949]: 91.0.208.26:49164 [58597] http-in app/db-primary 2995/0/475/475/2995 200 79526 - - ---- 199/199/40/40/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:34:14.211389-07:00 cache-3 systemd[1]: Finished Cleanup of Temporary Directories. 2026-10-09T13:34:14.235426-07:00 db-replica haproxy[937]: 203.110.145.169:43562 [25033] http-in app/web-03 9303/0/268/268/9303 500 53514 - - ---- 708/708/61/61/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:34:14.774999-07:00 web-02 kernel: [33682.979691] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.179.34.161 DST=10.0.602.602 LEN=73 TOS=0x00 PREC=0x00 TTL=73 ID=33682 DF PROTO=TCP SPT=61094 DPT=61094 WINDOW=33682 RES=0x00 SYN URGP=0 2026-10-09T13:34:14.943695-07:00 db-replica nginx[1201]: 91.24.251.216 - - "GET /static/main.css HTTP/1.1" 200 60764 "-" "curl/8.4.0" 2026-10-09T13:34:14.979047-07:00 db-primary nginx[1204]: 45.169.236.213 - - "GET /.env HTTP/1.1" 401 22475 "-" "curl/8.4.0" 2026-10-09T13:34:15.031482-07:00 bastion app[30755]: INFO worker 80 finished job 30300139f813b506 in 5875 ms 2026-10-09T13:34:15.100821-07:00 api-07 kernel: [87400.708945] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.64.68.154 DST=10.0.224.224 LEN=72 TOS=0x00 PREC=0x00 TTL=72 ID=87400 DF PROTO=TCP SPT=48164 DPT=48164 WINDOW=87400 RES=0x00 SYN URGP=0 2026-10-09T13:34:15.193979-07:00 bastion nginx[1203]: 192.68.248.160 - - "GET /api/v2/orders HTTP/1.1" 200 74787 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:15.207947-07:00 bastion sshd[62741]: Received disconnect from 203.11.190.147 port 14675:11: Bye Bye [preauth] 2026-10-09T13:34:15.296401-07:00 web-01 haproxy[941]: 192.249.252.188:54286 [15979] http-in app/web-02 9957/0/489/489/9957 200 70459 - - ---- 358/358/75/75/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:34:15.420236-07:00 web-02 sshd[48404]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:34:15.712315-07:00 edge-fr-1 app[30142]: INFO worker 14 finished job ceae033f35e3315b in 8050 ms 2026-10-09T13:34:15.777189-07:00 db-primary haproxy[908]: 91.12.68.33:49337 [37806] http-in app/web-02 9917/0/61/61/9917 500 25071 - - ---- 256/256/63/63/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:34:15.835194-07:00 web-01 nginx[1210]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.10.19.154, server: app.example.com, request: "GET /health HTTP/1.1", upstream: "http://10.0.415.415:8080/health" 2026-10-09T13:34:15.870525-07:00 edge-fr-1 app[30676]: INFO worker 60 picked job ba3094b5829b6463 from queue emails 2026-10-09T13:34:16.050503-07:00 web-03 app[30243]: INFO worker 57 picked job 06b6b3a18148aef1 from queue orders 2026-10-09T13:34:16.172776-07:00 worker-12 haproxy[914]: 203.149.199.196:11248 [67288] http-in app/web-01 9829/0/826/826/9829 200 87791 - - ---- 578/578/10/10/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:34:16.292397-07:00 worker-12 nginx[1201]: 91.174.233.114 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 34050 "-" "Go-http-client/1.1" 2026-10-09T13:34:16.323590-07:00 db-replica app[30395]: INFO worker 27 picked job c12eeba65d438071 from queue emails 2026-10-09T13:34:16.402795-07:00 db-replica sshd[25527]: Failed password for invalid user ci from 10.237.232.152 port 32093 ssh2 2026-10-09T13:34:16.444899-07:00 web-03 nginx[1208]: 10.228.207.32 - - "GET /admin HTTP/1.1" 500 39471 "-" "python-requests/2.32.3" 2026-10-09T13:34:16.854192-07:00 worker-12 app[30176]: INFO worker 39 picked job 7640da4024d10ce5 from queue orders 2026-10-09T13:34:17.164233-07:00 db-replica cron[15774]: (deploy) CMD (/usr/bin/backup --quiet --target /srv/deploy) 2026-10-09T13:34:17.165997-07:00 cache-3 systemd[1]: session-59777.scope: Deactivated successfully. 2026-10-09T13:34:17.325617-07:00 edge-fr-1 app[30828]: WARN slow query (8844 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '26 minutes' 2026-10-09T13:34:17.358151-07:00 web-02 postgres[28088]: LOG: duration: 9095.661 ms statement: SELECT * FROM orders WHERE customer_id = 72167 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:17.360317-07:00 db-replica app[30703]: INFO health check ok: db 749 ms, cache 749 ms, queue depth 28 2026-10-09T13:34:18.093322-07:00 api-07 dockerd[700]: time="2026-10-09T13:34:18.093322-07:00" level=info msg="Container 860c7771477d3a45 exited with code 0" 2026-10-09T13:34:18.235884-07:00 db-primary kernel: [30767.206876] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.86.248.145 DST=10.0.705.705 LEN=69 TOS=0x00 PREC=0x00 TTL=69 ID=30767 DF PROTO=TCP SPT=16038 DPT=16038 WINDOW=30767 RES=0x00 SYN URGP=0 2026-10-09T13:34:18.246866-07:00 web-02 cron[11022]: (sørensen) CMD (/usr/bin/backup --quiet --target /srv/sørensen) 2026-10-09T13:34:18.267325-07:00 web-01 sshd[23245]: Invalid user sørensen from 172.67.123.51 port 19814 2026-10-09T13:34:18.290284-07:00 edge-fr-1 app[30575]: INFO order 13551 confirmed for zoë in 241 ms (region ap-northeast-1, queue emails) 2026-10-09T13:34:18.345203-07:00 db-primary app[30203]: INFO request_id=93c633142ecb0cfd method=GET path=/health status=404 duration=464ms 2026-10-09T13:34:18.394836-07:00 db-primary app[30933]: INFO order 29320 confirmed for priya in 7718 ms (region us-east-1, queue webhooks) 2026-10-09T13:34:18.550043-07:00 web-03 app[30537]: INFO order 61672 confirmed for deploy in 6376 ms (region ap-northeast-1, queue orders) 2026-10-09T13:34:18.857196-07:00 web-03 sshd[29369]: Failed password for invalid user sørensen from 45.118.146.156 port 45503 ssh2 2026-10-09T13:34:18.903144-07:00 db-primary sshd[37247]: Accepted publickey for ci from 10.37.212.29 port 6460 ssh2: ED25519 SHA256:38ef4b136e32a7e9 2026-10-09T13:34:18.921583-07:00 edge-fr-1 cron[13441]: (ci) CMD (/usr/bin/backup --quiet --target /srv/ci) 2026-10-09T13:34:19.218835-07:00 api-07 sshd[55020]: Accepted publickey for zoë from 45.74.121.202 port 13209 ssh2: ED25519 SHA256:523e630193d90b76 2026-10-09T13:34:19.566507-07:00 bastion app[30262]: INFO request_id=1e7a43a4b71b3306 method=GET path=/api/v2/orders status=302 duration=9167ms 2026-10-09T13:34:19.770758-07:00 api-07 app[30156]: INFO order 45016 confirmed for ci in 2301 ms (region us-east-1, queue emails) 2026-10-09T13:34:19.897969-07:00 bastion sshd[9188]: Received disconnect from 172.229.139.117 port 45632:11: Bye Bye [preauth] 2026-10-09T13:34:20.117971-07:00 cache-3 haproxy[907]: 203.214.78.106:8242 [87451] http-in app/worker-12 1050/0/916/916/1050 401 59154 - - ---- 616/616/30/30/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:34:20.259120-07:00 db-replica app[30907]: INFO worker 10 picked job 6758a5cd41d46062 from queue emails 2026-10-09T13:34:20.315863-07:00 worker-12 postgres[28108]: LOG: duration: 6119.107 ms statement: SELECT * FROM orders WHERE customer_id = 33037 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:20.400311-07:00 worker-12 nginx[1207]: 203.114.191.180 - müller "POST /api/v2/users HTTP/1.1" 204 51822 "-" "kube-probe/1.31" 2026-10-09T13:34:20.773075-07:00 api-08 app[30855]: INFO request_id=e9f8432a618e51cf method=GET path=/api/v2/search?q=invoice status=200 duration=2022ms 2026-10-09T13:34:20.834397-07:00 db-primary kernel: [68770.358589] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/app.service,task=java,pid=68770,uid=3551 2026-10-09T13:34:21.274364-07:00 api-08 app[30122]: INFO request_id=1abd980ceae0a29e method=GET path=/static/app.js status=401 duration=3029ms 2026-10-09T13:34:21.360519-07:00 cache-3 sshd[54523]: Accepted publickey for root from 192.12.232.17 port 23608 ssh2: ED25519 SHA256:cd1da2bc83f3bf5a 2026-10-09T13:34:21.524354-07:00 edge-fr-1 haproxy[921]: 203.184.154.217:54916 [64881] http-in app/web-02 8380/0/986/986/8380 404 89817 - - ---- 297/297/10/10/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:34:21.572665-07:00 edge-fr-1 systemd[1]: session-72595.scope: Deactivated successfully. 2026-10-09T13:34:21.608861-07:00 cache-3 sshd[9785]: Accepted publickey for akira from 91.87.87.212 port 5627 ssh2: ED25519 SHA256:abb4871d9e66f65e 2026-10-09T13:34:21.639586-07:00 db-replica app[30274]: INFO request_id=2ba2d8228a772974 method=GET path=/api/v2/search?q=invoice status=404 duration=8533ms 2026-10-09T13:34:21.703193-07:00 db-primary systemd[1]: Started Session 21271 of User françois. 2026-10-09T13:34:21.731070-07:00 api-07 systemd[1]: Started Session 57401 of User françois. 2026-10-09T13:34:21.781157-07:00 worker-12 nginx[1210]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.59.68.137, server: app.example.com, request: "GET /login HTTP/1.1", upstream: "http://10.0.528.528:8080/login" 2026-10-09T13:34:21.982275-07:00 worker-12 postgres[23793]: LOG: duration: 7583.351 ms statement: SELECT * FROM orders WHERE customer_id = 65493 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:22.060766-07:00 web-03 sshd[57259]: Received disconnect from 192.75.243.82 port 61684:11: Bye Bye [preauth] 2026-10-09T13:34:22.151245-07:00 web-03 app[30866]: WARN slow query (6601 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '15 minutes' 2026-10-09T13:34:22.252874-07:00 api-07 app[30728]: INFO order 62575 confirmed for sørensen in 2232 ms (region eu-west-1, queue emails) 2026-10-09T13:34:22.287496-07:00 web-03 sshd[56346]: Connection closed by 172.185.57.40 port 13476 [preauth] 2026-10-09T13:34:22.364760-07:00 api-07 app[30025]: INFO worker 19 picked job 71a8747834168de0 from queue invoices 2026-10-09T13:34:22.402597-07:00 db-primary haproxy[917]: 192.224.88.84:14649 [56985] http-in app/web-02 9655/0/482/482/9655 301 42055 - - ---- 627/627/30/30/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:34:22.539444-07:00 db-replica nginx[1201]: 203.179.254.211 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 1895 "-" "python-requests/2.32.3" 2026-10-09T13:34:22.623628-07:00 db-replica app[30121]: INFO health check ok: db 887 ms, cache 887 ms, queue depth 62 2026-10-09T13:34:22.629905-07:00 web-01 nginx[1205]: 172.6.216.17 - - "GET /health HTTP/1.1" 404 29508 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:22.650508-07:00 api-08 app[30952]: INFO request_id=303dd3094d49e58a method=GET path=/admin status=200 duration=6709ms 2026-10-09T13:34:22.767688-07:00 web-02 app[30934]: ERROR cache miss storm: 3603 misses in 204 ms, key prefix session:root 2026-10-09T13:34:22.888124-07:00 web-02 cron[46536]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:34:23.073402-07:00 cache-3 sshd[60944]: Received disconnect from 45.105.112.40 port 11751:11: Bye Bye [preauth] 2026-10-09T13:34:23.247046-07:00 web-02 app[30344]: INFO order 86648 confirmed for sørensen in 4462 ms (region ap-northeast-1, queue emails) 2026-10-09T13:34:23.322095-07:00 bastion systemd[1]: Started Session 70768 of User ci. 2026-10-09T13:34:23.735479-07:00 web-03 app[30663]: INFO worker 42 finished job d0310394db018685 in 639 ms 2026-10-09T13:34:23.863882-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578063.135:69695): pid=69695 uid=0 auid=4299 ses=676 msg='op=login id=4299 exe="/usr/sbin/sshd" hostname=? addr=91.20.254.95 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:23.968686-07:00 web-01 app[30796]: INFO health check ok: db 945 ms, cache 945 ms, queue depth 53 2026-10-09T13:34:24.236041-07:00 api-08 app[30668]: INFO request_id=134dbe8cfaed7110 method=GET path=/api/v2/users status=401 duration=3406ms 2026-10-09T13:34:24.284960-07:00 web-02 app[30033]: INFO request_id=0cfa467ca8472f0f method=GET path=/static/app.js status=500 duration=380ms 2026-10-09T13:34:24.378259-07:00 bastion app[30490]: INFO request_id=dffffe49667da931 method=GET path=/login status=404 duration=782ms 2026-10-09T13:34:24.408270-07:00 db-replica haproxy[936]: 192.174.169.246:4362 [45754] http-in app/web-03 1403/0/113/113/1403 404 41890 - - ---- 969/969/58/58/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:34:24.505578-07:00 api-07 postgres[8376]: LOG: checkpoint complete: wrote 8010 buffers (70%); 0 WAL file(s) added, 0 removed, 10 recycled; write=7621.528 s, sync=0.528 s, total=7621.528 s 2026-10-09T13:34:24.999219-07:00 cache-3 sshd[18619]: Connection closed by 45.13.195.68 port 6343 [preauth] 2026-10-09T13:34:25.274814-07:00 web-01 haproxy[910]: 203.20.133.101:13817 [46699] http-in app/bastion 1108/0/906/906/1108 404 53073 - - ---- 620/620/55/55/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:34:25.404819-07:00 worker-12 nginx[1206]: 192.42.42.229 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 56505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:25.462681-07:00 cache-3 systemd[1]: Started Session 64576 of User deploy. 2026-10-09T13:34:25.805303-07:00 edge-fr-1 app[30337]: INFO order 49894 confirmed for root in 3895 ms (region us-east-1, queue emails) 2026-10-09T13:34:25.925025-07:00 db-replica app[30161]: INFO request_id=ee6e5cf2af5d954a method=GET path=/api/v2/search?q=invoice status=200 duration=8965ms 2026-10-09T13:34:26.477500-07:00 db-primary systemd[1]: session-24950.scope: Deactivated successfully. 2026-10-09T13:34:26.541460-07:00 cache-3 nginx[1209]: 192.22.166.83 - - "GET /static/app.js HTTP/1.1" 200 79530 "-" "python-requests/2.32.3" 2026-10-09T13:34:26.582222-07:00 worker-12 postgres[16647]: LOG: duration: 4886.756 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:26.620639-07:00 db-replica haproxy[907]: 203.95.195.87:9978 [96502] http-in app/db-primary 8306/0/322/322/8306 200 56355 - - ---- 421/421/98/98/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:34:27.051011-07:00 db-primary sshd[62746]: Failed password for invalid user ci from 10.156.41.44 port 54230 ssh2 2026-10-09T13:34:27.126806-07:00 web-03 app[30064]: INFO worker 46 finished job d6662fcf47a62604 in 6032 ms 2026-10-09T13:34:27.206180-07:00 cache-3 app[30724]: INFO worker 71 finished job e826bb936cdceaeb in 7067 ms 2026-10-09T13:34:27.394644-07:00 cache-3 systemd[1]: Started Session 22782 of User backup. 2026-10-09T13:34:27.481314-07:00 web-02 nginx[1204]: 203.35.100.208 - - "GET /wp-login.php HTTP/1.1" 204 65743 "-" "kube-probe/1.31" 2026-10-09T13:34:27.546229-07:00 web-03 app[30566]: INFO worker 58 picked job 521d9084337bd8d3 from queue webhooks 2026-10-09T13:34:27.589260-07:00 api-07 app[30269]: INFO request_id=07a6062aeed16944 method=GET path=/admin status=200 duration=6938ms 2026-10-09T13:34:27.752031-07:00 api-08 sshd[22278]: Accepted publickey for zoë from 91.170.111.205 port 54695 ssh2: ED25519 SHA256:85986ce358cba548 2026-10-09T13:34:27.773140-07:00 db-replica nginx[1205]: 91.109.62.100 - - "GET /.env HTTP/1.1" 200 3001 "-" "Go-http-client/1.1" 2026-10-09T13:34:27.822293-07:00 bastion postgres[6060]: LOG: duration: 9437.675 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:27.967511-07:00 api-08 app[30813]: WARN retrying upstream 10.203.83.27:60533 after timeout (4256 ms), attempt 2 of 3 2026-10-09T13:34:28.002672-07:00 cache-3 app[30032]: INFO request_id=ec9d0817face40a5 method=GET path=/api/v2/users status=404 duration=6120ms 2026-10-09T13:34:28.021078-07:00 bastion app[30618]: INFO request_id=0a21f9ba2d73a41a method=GET path=/favicon.ico status=404 duration=5621ms 2026-10-09T13:34:28.045889-07:00 api-08 kernel: [41436.911923] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.38.122.1 DST=10.0.700.700 LEN=97 TOS=0x00 PREC=0x00 TTL=97 ID=41436 DF PROTO=TCP SPT=49582 DPT=49582 WINDOW=41436 RES=0x00 SYN URGP=0 2026-10-09T13:34:28.133114-07:00 web-03 app[30298]: INFO request_id=4184da26ba8a3c88 method=GET path=/favicon.ico status=200 duration=5804ms 2026-10-09T13:34:28.233726-07:00 web-02 app[30237]: INFO worker 52 finished job 7c1282856cdc27a6 in 163 ms 2026-10-09T13:34:28.253439-07:00 web-03 nginx[1202]: 45.6.108.240 - - "GET /admin HTTP/1.1" 502 38617 "-" "curl/8.4.0" 2026-10-09T13:34:28.273124-07:00 db-primary haproxy[912]: 203.255.138.221:56330 [65706] http-in app/db-primary 3972/0/367/367/3972 500 32403 - - ---- 525/525/91/91/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:34:28.396070-07:00 web-03 nginx[1206]: 203.142.177.190 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 37557 "-" "python-requests/2.32.3" 2026-10-09T13:34:28.420362-07:00 api-07 sshd[6952]: Failed password for invalid user françois from 203.146.177.1 port 35269 ssh2 2026-10-09T13:34:28.437959-07:00 api-08 app[30636]: INFO request_id=36d98120896ef64d method=GET path=/login status=302 duration=1685ms 2026-10-09T13:34:28.579630-07:00 db-primary audit: type=USER_LOGIN msg=audit(1791578068.15:68321): pid=68321 uid=0 auid=6191 ses=164 msg='op=login id=6191 exe="/usr/sbin/sshd" hostname=? addr=45.124.79.140 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:28.596879-07:00 db-primary postgres[11659]: LOG: duration: 8019.508 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:28.638331-07:00 bastion nginx[1206]: 203.57.8.204 - - "GET /api/v2/orders HTTP/1.1" 401 64828 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:28.727587-07:00 edge-fr-1 app[30766]: INFO order 98945 confirmed for müller in 7893 ms (region us-east-1, queue webhooks) 2026-10-09T13:34:28.789627-07:00 api-07 nginx[1207]: 45.129.164.156 - müller "POST /login HTTP/1.1" 200 38546 "-" "curl/8.4.0" 2026-10-09T13:34:28.968352-07:00 worker-12 sshd[15608]: Connection closed by 10.43.4.5 port 45945 [preauth] 2026-10-09T13:34:29.115830-07:00 api-08 sshd[63422]: Connection closed by 192.162.185.91 port 62449 [preauth] 2026-10-09T13:34:29.124359-07:00 cache-3 postgres[9894]: LOG: duration: 9432.418 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:29.159945-07:00 db-replica sshd[53633]: Failed password for invalid user sørensen from 192.112.95.129 port 54609 ssh2 2026-10-09T13:34:29.173054-07:00 web-03 sshd[6424]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:34:29.376613-07:00 web-01 app[30634]: INFO worker 26 finished job 9dcbec7849369651 in 5587 ms 2026-10-09T13:34:29.515958-07:00 db-primary app[30292]: INFO worker 35 picked job 4d69b5eac7c38ff2 from queue webhooks 2026-10-09T13:34:29.593174-07:00 web-02 app[30930]: INFO worker 10 finished job 68d5c0bd7c7978d9 in 3945 ms 2026-10-09T13:34:29.659693-07:00 api-07 sshd[14548]: Invalid user deploy from 203.12.180.182 port 61468 2026-10-09T13:34:29.753190-07:00 web-03 app[30256]: INFO worker 18 finished job fe147c15182008b1 in 1819 ms 2026-10-09T13:34:29.886728-07:00 db-replica nginx[1204]: 203.36.159.7 - françois "POST /favicon.ico HTTP/1.1" 301 36581 "-" "python-requests/2.32.3" 2026-10-09T13:34:29.898068-07:00 api-07 app[30101]: INFO worker 93 picked job 3071f15220a886a1 from queue emails 2026-10-09T13:34:29.966486-07:00 worker-12 app[30183]: INFO request_id=afd9f2057303b999 method=GET path=/metrics status=200 duration=9364ms 2026-10-09T13:34:30.002353-07:00 cache-3 nginx[1207]: 91.145.52.163 - - "GET /api/v2/orders HTTP/1.1" 302 87648 "-" "Go-http-client/1.1" 2026-10-09T13:34:30.233085-07:00 api-08 haproxy[929]: 192.201.91.28:13291 [53037] http-in app/db-primary 9924/0/208/208/9924 502 53726 - - ---- 559/559/70/70/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:34:30.326111-07:00 api-08 app[30009]: INFO request_id=c43aaeb0cbf001a6 method=GET path=/admin status=500 duration=2387ms 2026-10-09T13:34:30.338641-07:00 bastion cron[8132]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:34:30.403914-07:00 web-03 app[30614]: INFO request_id=5a18260afd58b36c method=GET path=/.env status=200 duration=8362ms 2026-10-09T13:34:30.439067-07:00 worker-12 app[30989]: INFO request_id=f7bff8f759e3703c method=GET path=/admin status=401 duration=368ms 2026-10-09T13:34:30.496079-07:00 cache-3 kubelet[800]: E1009 13:34:30.951457 6989 pod_workers.go:6989] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-50df61ae53a4709a" 2026-10-09T13:34:30.511656-07:00 web-01 nginx[1200]: 10.102.71.228 - ci "POST /wp-login.php HTTP/1.1" 302 41051 "-" "python-requests/2.32.3" 2026-10-09T13:34:30.571749-07:00 db-primary nginx[1203]: 45.230.68.80 - - "GET /static/app.js HTTP/1.1" 200 62657 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:30.650479-07:00 web-02 systemd[1]: session-66386.scope: Deactivated successfully. 2026-10-09T13:34:30.735597-07:00 api-08 nginx[1205]: 91.0.85.18 - - "GET /api/v2/users HTTP/1.1" 301 67318 "-" "curl/8.4.0" 2026-10-09T13:34:30.738150-07:00 worker-12 app[30170]: INFO request_id=87de9bccbaecfdf4 method=GET path=/favicon.ico status=200 duration=2765ms 2026-10-09T13:34:30.856740-07:00 cache-3 haproxy[907]: 192.169.240.192:24905 [39963] http-in app/api-07 3857/0/826/826/3857 500 4086 - - ---- 188/188/97/97/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:34:31.086288-07:00 web-02 nginx[1203]: 203.173.187.118 - - "GET /api/v2/orders HTTP/1.1" 502 4036 "-" "Go-http-client/1.1" 2026-10-09T13:34:31.253145-07:00 edge-fr-1 nginx[1210]: 10.169.169.48 - - "GET /login HTTP/1.1" 302 48432 "-" "curl/8.4.0" 2026-10-09T13:34:31.504047-07:00 api-08 nginx[1201]: 192.185.169.38 - - "GET /metrics HTTP/1.1" 404 70402 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:31.561178-07:00 api-07 sshd[11334]: Connection closed by 10.235.85.36 port 20182 [preauth] 2026-10-09T13:34:31.843244-07:00 web-03 app[30279]: INFO request_id=30e1ca3744cc5afb method=GET path=/health status=200 duration=6586ms 2026-10-09T13:34:31.925458-07:00 web-01 systemd[1]: session-14585.scope: Deactivated successfully. 2026-10-09T13:34:31.942090-07:00 web-02 nginx[1209]: 10.174.142.246 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 83376 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:32.221227-07:00 db-replica nginx[1205]: 192.163.139.150 - - "GET /api/v2/orders HTTP/1.1" 404 82531 "-" "python-requests/2.32.3" 2026-10-09T13:34:32.382595-07:00 edge-fr-1 sshd[57648]: Accepted publickey for zoë from 172.31.119.199 port 30659 ssh2: ED25519 SHA256:4e02a9a0202cd828 2026-10-09T13:34:32.398057-07:00 api-08 app[30040]: INFO request_id=facc579303ea6582 method=GET path=/favicon.ico status=302 duration=1941ms 2026-10-09T13:34:32.407667-07:00 web-02 cron[28288]: (priya) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:34:32.463992-07:00 web-01 nginx[1201]: 45.52.231.48 - - "GET /api/v2/orders HTTP/1.1" 401 46081 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:32.486144-07:00 bastion app[30201]: INFO order 59514 confirmed for root in 5627 ms (region us-east-1, queue orders) 2026-10-09T13:34:32.537567-07:00 db-replica app[30948]: INFO request_id=2eda31229163ed9c method=GET path=/static/main.css status=401 duration=618ms 2026-10-09T13:34:32.593049-07:00 web-03 app[30925]: INFO worker 63 picked job be8f2761eb2ab03d from queue invoices 2026-10-09T13:34:32.716461-07:00 web-01 sshd[18577]: Connection closed by 10.203.169.244 port 59438 [preauth] 2026-10-09T13:34:32.738418-07:00 worker-12 nginx[1206]: 10.71.4.63 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 29541 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:32.839759-07:00 web-02 app[30220]: INFO request_id=97d2f8016f6c1942 method=GET path=/.env status=200 duration=2559ms 2026-10-09T13:34:32.896447-07:00 db-replica sshd[19807]: Accepted publickey for backup from 172.117.122.22 port 62088 ssh2: ED25519 SHA256:b6ea23bb3b352fac 2026-10-09T13:34:33.256326-07:00 bastion app[30250]: INFO worker 10 finished job 6ed11cbcb44f26a7 in 2820 ms 2026-10-09T13:34:33.291516-07:00 web-03 app[30485]: INFO order 63757 confirmed for priya in 7958 ms (region us-east-1, queue orders) 2026-10-09T13:34:33.449477-07:00 web-01 app[30403]: INFO order 33214 confirmed for akira in 1128 ms (region eu-west-1, queue webhooks) 2026-10-09T13:34:33.672586-07:00 web-02 nginx[1209]: 192.54.102.133 - - "GET /static/main.css HTTP/1.1" 502 42735 "-" "kube-probe/1.31" 2026-10-09T13:34:33.749247-07:00 bastion sshd[6819]: pam_unix(sshd:session): session opened for user ci(uid=9292) by (uid=0) 2026-10-09T13:34:33.846529-07:00 api-08 nginx[1209]: 10.104.50.19 - - "GET /favicon.ico HTTP/1.1" 404 6995 "-" "curl/8.4.0" 2026-10-09T13:34:33.848117-07:00 api-08 nginx[1208]: 45.69.227.1 - - "GET /api/v2/orders HTTP/1.1" 204 87922 "-" "Go-http-client/1.1" 2026-10-09T13:34:33.877256-07:00 worker-12 nginx[1201]: 203.122.99.250 - - "GET /metrics HTTP/1.1" 502 80799 "-" "Go-http-client/1.1" 2026-10-09T13:34:33.922138-07:00 cache-3 app[30072]: INFO health check ok: db 145 ms, cache 145 ms, queue depth 97 2026-10-09T13:34:33.955976-07:00 web-01 nginx[1205]: 172.16.45.193 - - "GET /health HTTP/1.1" 401 20915 "-" "Go-http-client/1.1" 2026-10-09T13:34:33.959977-07:00 db-replica systemd[1]: Started Session 27184 of User priya. 2026-10-09T13:34:34.003501-07:00 web-02 app[30054]: INFO worker 31 finished job 07b4ef0141889ef0 in 5556 ms 2026-10-09T13:34:34.005910-07:00 db-primary app[30865]: INFO worker 89 finished job 203170afea9d427d in 4181 ms 2026-10-09T13:34:34.315993-07:00 web-03 app[30368]: INFO request_id=e16a96fe2779f8c6 method=GET path=/api/v2/orders status=500 duration=9813ms 2026-10-09T13:34:34.424335-07:00 cache-3 systemd[1]: session-79114.scope: Deactivated successfully. 2026-10-09T13:34:34.430578-07:00 edge-fr-1 haproxy[928]: 45.203.77.117:16491 [92022] http-in app/db-primary 8759/0/160/160/8759 301 4441 - - ---- 196/196/76/76/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:34:34.511698-07:00 worker-12 postgres[29168]: LOG: duration: 1552.844 ms statement: SELECT * FROM orders WHERE customer_id = 62674 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:35.085406-07:00 api-07 app[30844]: INFO worker 25 finished job 62aed0ba68b20eb2 in 1514 ms 2026-10-09T13:34:35.598034-07:00 web-01 nginx[1210]: 45.215.66.77 - - "GET /.env HTTP/1.1" 401 42955 "-" "Go-http-client/1.1" 2026-10-09T13:34:35.630825-07:00 web-01 nginx[1210]: 45.18.36.34 - - "GET /health HTTP/1.1" 404 77894 "-" "curl/8.4.0" 2026-10-09T13:34:35.780938-07:00 edge-fr-1 app[30327]: ERROR payment declined for order 47899: card_declined (code 73), customer notified 2026-10-09T13:34:35.789943-07:00 api-08 haproxy[950]: 91.203.45.139:51124 [62696] http-in app/web-03 2376/0/555/555/2376 404 52690 - - ---- 875/875/48/48/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:34:35.843981-07:00 worker-12 nginx[1209]: 10.203.182.18 - - "GET /admin HTTP/1.1" 200 58540 "-" "Go-http-client/1.1" 2026-10-09T13:34:35.881790-07:00 web-01 postgres[17719]: LOG: duration: 8266.270 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:36.084985-07:00 worker-12 nginx[1202]: 45.46.237.177 - - "GET /api/v2/orders HTTP/1.1" 401 84962 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:36.447267-07:00 db-primary nginx[1207]: 91.63.173.176 - akira "POST /metrics HTTP/1.1" 200 28413 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:36.503697-07:00 edge-fr-1 kernel: [47152.314604] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.161.59.45 DST=10.0.385.385 LEN=60 TOS=0x00 PREC=0x00 TTL=60 ID=47152 DF PROTO=TCP SPT=21350 DPT=21350 WINDOW=47152 RES=0x00 SYN URGP=0 2026-10-09T13:34:36.825246-07:00 web-02 app[30242]: INFO health check ok: db 753 ms, cache 753 ms, queue depth 94 2026-10-09T13:34:36.913023-07:00 cache-3 app[30727]: INFO order 76609 confirmed for deploy in 9872 ms (region eu-west-1, queue invoices) 2026-10-09T13:34:37.041390-07:00 web-01 sshd[7642]: Accepted publickey for akira from 91.170.167.17 port 53813 ssh2: ED25519 SHA256:650e2ccf9be2c63f 2026-10-09T13:34:37.177465-07:00 api-07 nginx[1209]: 192.214.77.66 - priya "POST /api/v2/search?q=invoice HTTP/1.1" 200 39716 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:37.189281-07:00 api-07 app[30264]: INFO worker 89 picked job a39eb50b94769ce2 from queue orders 2026-10-09T13:34:37.755188-07:00 db-replica haproxy[935]: 10.126.28.109:48312 [88501] http-in app/web-01 4926/0/831/831/4926 200 86286 - - ---- 935/935/78/78/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:34:37.848584-07:00 bastion kernel: [20671.210597] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.83.23.13 DST=10.0.623.623 LEN=48 TOS=0x00 PREC=0x00 TTL=48 ID=20671 DF PROTO=TCP SPT=15681 DPT=15681 WINDOW=20671 RES=0x00 SYN URGP=0 2026-10-09T13:34:38.149278-07:00 web-01 sshd[15090]: Accepted publickey for müller from 172.136.32.236 port 41913 ssh2: ED25519 SHA256:50e6fe68536f0971 2026-10-09T13:34:38.362873-07:00 bastion nginx[1202]: 203.194.41.25 - - "GET /health HTTP/1.1" 301 19632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:38.385707-07:00 web-03 sshd[12078]: Received disconnect from 91.184.126.44 port 17368:11: Bye Bye [preauth] 2026-10-09T13:34:38.428402-07:00 worker-12 app[30039]: INFO worker 74 finished job 24750539eb9167bf in 5981 ms 2026-10-09T13:34:38.908523-07:00 worker-12 app[30791]: INFO request_id=6afc7a3d00ad6b44 method=GET path=/admin status=301 duration=630ms 2026-10-09T13:34:39.089834-07:00 worker-12 sshd[18654]: Received disconnect from 192.167.131.26 port 17289:11: Bye Bye [preauth] 2026-10-09T13:34:39.165976-07:00 web-01 app[30038]: INFO worker 57 finished job 12db6fbeacc02ce0 in 3906 ms 2026-10-09T13:34:39.634904-07:00 worker-12 nginx[1202]: 10.84.225.103 - - "GET /static/app.js HTTP/1.1" 404 14401 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:40.009749-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578080.874:14932): pid=14932 uid=0 auid=2213 ses=992 msg='op=login id=2213 exe="/usr/sbin/sshd" hostname=? addr=10.195.109.201 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:40.074915-07:00 cache-3 systemd[1]: Started Session 26524 of User zoë. 2026-10-09T13:34:40.181825-07:00 worker-12 nginx[1200]: 172.158.71.144 - - "GET /api/v2/users HTTP/1.1" 200 75368 "-" "Go-http-client/1.1" 2026-10-09T13:34:40.439138-07:00 bastion app[30333]: INFO worker 76 picked job 76c9ac88ef533dce from queue webhooks 2026-10-09T13:34:40.891008-07:00 api-08 nginx[1209]: 203.95.232.216 - backup "POST /api/v2/orders/8841 HTTP/1.1" 200 30668 "-" "curl/8.4.0" 2026-10-09T13:34:41.033447-07:00 web-03 haproxy[909]: 91.159.203.235:29446 [68125] http-in app/db-primary 3764/0/140/140/3764 200 19772 - - ---- 278/278/60/60/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:34:41.081548-07:00 cache-3 app[30851]: INFO order 34373 confirmed for priya in 2106 ms (region us-east-1, queue orders) 2026-10-09T13:34:41.107728-07:00 web-02 nginx[1209]: 10.124.95.137 - - "GET /.env HTTP/1.1" 301 76752 "-" "kube-probe/1.31" 2026-10-09T13:34:41.137602-07:00 db-replica sshd[9396]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:34:41.297403-07:00 web-02 app[30257]: INFO worker 70 finished job ca14cee34f2965fb in 6863 ms 2026-10-09T13:34:41.660816-07:00 worker-12 sshd[42726]: Failed password for invalid user deploy from 203.96.193.252 port 56388 ssh2 2026-10-09T13:34:41.729491-07:00 web-02 nginx[1209]: 172.235.55.150 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 51156 "-" "curl/8.4.0" 2026-10-09T13:34:41.795826-07:00 db-primary app[30114]: INFO order 56422 confirmed for ci in 31 ms (region ap-northeast-1, queue orders) 2026-10-09T13:34:41.866821-07:00 api-07 nginx[1204]: 91.156.97.172 - - "GET /login HTTP/1.1" 200 55997 "-" "kube-probe/1.31" 2026-10-09T13:34:41.944655-07:00 worker-12 nginx[1203]: 45.52.21.146 - - "GET /api/v2/users HTTP/1.1" 500 3489 "-" "Go-http-client/1.1" 2026-10-09T13:34:42.182538-07:00 cache-3 app[30196]: INFO worker 56 picked job c5d3391bcb2981b8 from queue orders 2026-10-09T13:34:42.194669-07:00 edge-fr-1 postgres[3556]: LOG: checkpoint complete: wrote 8334 buffers (92%); 0 WAL file(s) added, 0 removed, 25 recycled; write=44.192 s, sync=0.192 s, total=44.192 s 2026-10-09T13:34:42.208223-07:00 db-replica haproxy[943]: 10.47.4.66:19088 [38411] http-in app/db-replica 6255/0/22/22/6255 401 57091 - - ---- 468/468/43/43/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:34:42.276957-07:00 web-03 app[30254]: INFO worker 17 picked job a12fc5ffe635e9e9 from queue invoices 2026-10-09T13:34:42.307878-07:00 web-03 kernel: [87332.687176] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.1.203.33 DST=10.0.660.660 LEN=36 TOS=0x00 PREC=0x00 TTL=36 ID=87332 DF PROTO=TCP SPT=61684 DPT=61684 WINDOW=87332 RES=0x00 SYN URGP=0 2026-10-09T13:34:42.524341-07:00 db-replica systemd[1]: session-77608.scope: Deactivated successfully. 2026-10-09T13:34:42.545305-07:00 db-primary app[30558]: INFO order 70031 confirmed for deploy in 5421 ms (region eu-west-1, queue invoices) 2026-10-09T13:34:42.628936-07:00 web-01 nginx[1207]: 172.127.252.102 - - "GET /wp-login.php HTTP/1.1" 200 21698 "-" "Go-http-client/1.1" 2026-10-09T13:34:42.712828-07:00 cache-3 nginx[1204]: 203.180.217.245 - - "GET /static/app.js HTTP/1.1" 200 35450 "-" "python-requests/2.32.3" 2026-10-09T13:34:42.738639-07:00 web-01 app[30469]: INFO request_id=5b7a0bab4214bdee method=GET path=/static/main.css status=500 duration=4396ms 2026-10-09T13:34:42.765949-07:00 api-07 haproxy[927]: 203.205.203.69:19479 [16987] http-in app/bastion 4220/0/756/756/4220 200 48673 - - ---- 686/686/48/48/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:34:42.966721-07:00 web-02 sshd[30854]: Received disconnect from 172.15.112.23 port 55560:11: Bye Bye [preauth] 2026-10-09T13:34:43.128452-07:00 db-primary haproxy[932]: 10.83.214.96:18333 [10831] http-in app/bastion 476/0/828/828/476 200 86675 - - ---- 321/321/47/47/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:34:43.144986-07:00 edge-fr-1 app[30314]: INFO request_id=bb0765b4b589aebd method=GET path=/.env status=200 duration=8778ms 2026-10-09T13:34:43.156220-07:00 bastion nginx[1209]: 45.143.223.93 - - "GET /metrics HTTP/1.1" 301 57703 "-" "curl/8.4.0" 2026-10-09T13:34:43.309376-07:00 db-replica sshd[3511]: Connection closed by 203.109.151.138 port 43713 [preauth] 2026-10-09T13:34:43.368541-07:00 db-primary nginx[1210]: 91.0.203.79 - - "GET /static/app.js HTTP/1.1" 200 29450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:43.445331-07:00 bastion app[30695]: INFO request_id=b0bd81bba877e079 method=GET path=/static/app.js status=200 duration=7399ms 2026-10-09T13:34:43.473910-07:00 edge-fr-1 app[30139]: DEBUG cache hit ratio 67% over the last minute (34140 lookups) 2026-10-09T13:34:43.589948-07:00 web-02 sshd[7129]: pam_unix(sshd:session): session opened for user sørensen(uid=9461) by (uid=0) 2026-10-09T13:34:43.793557-07:00 db-replica sshd[45793]: Invalid user ci from 45.205.236.66 port 51720 2026-10-09T13:34:44.048550-07:00 web-01 kernel: [69967.779254] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.56.79.131 DST=10.0.117.117 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=69967 DF PROTO=TCP SPT=34279 DPT=34279 WINDOW=69967 RES=0x00 SYN URGP=0 2026-10-09T13:34:44.285106-07:00 web-01 app[30445]: INFO worker 52 finished job 3b9c44baa97a9846 in 4678 ms 2026-10-09T13:34:44.311982-07:00 api-07 nginx[1209]: 172.119.28.164 - root "POST /wp-login.php HTTP/1.1" 500 36147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:44.506439-07:00 db-replica haproxy[928]: 91.115.9.212:61608 [64783] http-in app/db-primary 7108/0/203/203/7108 200 829 - - ---- 900/900/55/55/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:34:44.573970-07:00 bastion haproxy[934]: 192.159.145.254:60113 [74998] http-in app/web-03 3525/0/39/39/3525 204 76152 - - ---- 241/241/36/36/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:34:44.973193-07:00 api-08 sshd[9179]: Invalid user zoë from 45.23.80.129 port 30777 2026-10-09T13:34:45.346884-07:00 edge-fr-1 haproxy[901]: 172.238.32.238:43995 [83340] http-in app/api-07 2381/0/501/501/2381 401 64594 - - ---- 168/168/62/62/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:34:45.363019-07:00 web-03 postgres[29609]: LOG: duration: 6499.43 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:45.584899-07:00 api-07 systemd[1]: Started Session 79646 of User sørensen. 2026-10-09T13:34:45.894360-07:00 web-03 nginx[1210]: 192.61.97.160 - - "GET /api/v2/users HTTP/1.1" 500 581 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:45.957529-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791578085.180:93034): pid=93034 uid=0 auid=5366 ses=789 msg='op=login id=5366 exe="/usr/sbin/sshd" hostname=? addr=91.78.15.237 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:46.210350-07:00 edge-fr-1 kernel: [19340.982447] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.103.48.178 DST=10.0.423.423 LEN=15 TOS=0x00 PREC=0x00 TTL=15 ID=19340 DF PROTO=TCP SPT=61065 DPT=61065 WINDOW=19340 RES=0x00 SYN URGP=0 2026-10-09T13:34:46.288289-07:00 api-08 app[30534]: INFO request_id=7538a4d493e018af method=GET path=/.env status=200 duration=8503ms 2026-10-09T13:34:46.315853-07:00 worker-12 nginx[1203]: 91.247.205.75 - - "GET /metrics HTTP/1.1" 302 2737 "-" "curl/8.4.0" 2026-10-09T13:34:46.357912-07:00 db-primary app[30130]: INFO order 18379 confirmed for françois in 9414 ms (region eu-west-1, queue invoices) 2026-10-09T13:34:46.412912-07:00 edge-fr-1 app[30929]: INFO request_id=7dc14c21da1e681f method=GET path=/login status=200 duration=8970ms 2026-10-09T13:34:46.569486-07:00 web-03 nginx[1200]: 91.143.36.18 - - "GET /health HTTP/1.1" 200 23024 "-" "python-requests/2.32.3" 2026-10-09T13:34:46.601939-07:00 cache-3 app[30679]: INFO request_id=530aff92ef0d2afa method=GET path=/login status=301 duration=2174ms 2026-10-09T13:34:46.702284-07:00 db-primary nginx[1208]: 172.46.255.146 - - "GET /wp-login.php HTTP/1.1" 302 16744 "-" "python-requests/2.32.3" 2026-10-09T13:34:46.738020-07:00 api-08 nginx[1210]: 192.61.199.99 - sørensen "POST /api/v2/search?q=invoice HTTP/1.1" 204 13595 "-" "kube-probe/1.31" 2026-10-09T13:34:46.914708-07:00 web-03 haproxy[936]: 203.180.153.88:64115 [18015] http-in app/db-replica 3064/0/650/650/3064 404 49916 - - ---- 268/268/38/38/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:34:47.168204-07:00 cache-3 sshd[10937]: Connection closed by 91.211.31.70 port 32301 [preauth] 2026-10-09T13:34:47.176354-07:00 edge-fr-1 nginx[1202]: 192.44.0.32 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 23217 "-" "curl/8.4.0" 2026-10-09T13:34:47.214375-07:00 db-primary app[30524]: INFO worker 74 finished job 3312b5fbf12a466b in 2586 ms 2026-10-09T13:34:47.227755-07:00 api-08 haproxy[915]: 203.35.53.243:35044 [97272] http-in app/edge-fr-1 4383/0/90/90/4383 200 48505 - - ---- 208/208/58/58/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:34:47.368153-07:00 web-02 nginx[1203]: 172.242.200.224 - - "GET /static/main.css HTTP/1.1" 301 49112 "-" "python-requests/2.32.3" 2026-10-09T13:34:47.577837-07:00 web-01 sshd[33400]: Connection closed by 203.89.130.235 port 6272 [preauth] 2026-10-09T13:34:47.628842-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791578087.645:90250): pid=90250 uid=0 auid=6347 ses=223 msg='op=login id=6347 exe="/usr/sbin/sshd" hostname=? addr=192.244.65.168 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:47.709464-07:00 bastion nginx[1207]: 10.14.142.126 - - "GET /admin HTTP/1.1" 200 70146 "-" "python-requests/2.32.3" 2026-10-09T13:34:47.844748-07:00 web-03 app[30184]: INFO order 78120 confirmed for sørensen in 7169 ms (region us-east-1, queue webhooks) 2026-10-09T13:34:47.918148-07:00 worker-12 app[30224]: DEBUG cache hit ratio 22% over the last minute (97061 lookups) 2026-10-09T13:34:48.048103-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791578088.267:54067): pid=54067 uid=0 auid=3797 ses=860 msg='op=login id=3797 exe="/usr/sbin/sshd" hostname=? addr=203.194.224.60 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:48.104997-07:00 api-08 app[30228]: INFO request_id=097128e44fe0af09 method=GET path=/login status=200 duration=6915ms 2026-10-09T13:34:48.179802-07:00 worker-12 sshd[11523]: Accepted publickey for root from 10.7.233.46 port 53023 ssh2: ED25519 SHA256:d9032af854c8b3e2 2026-10-09T13:34:48.277426-07:00 api-07 app[30930]: WARN retrying upstream 172.162.96.214:51425 after timeout (4969 ms), attempt 3 of 3 2026-10-09T13:34:48.323726-07:00 web-03 nginx[1210]: 203.62.54.80 - - "GET /wp-login.php HTTP/1.1" 200 73781 "-" "curl/8.4.0" 2026-10-09T13:34:48.366022-07:00 api-07 audit: type=USER_LOGIN msg=audit(1791578088.335:67099): pid=67099 uid=0 auid=8065 ses=918 msg='op=login id=8065 exe="/usr/sbin/sshd" hostname=? addr=45.249.82.246 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:48.432948-07:00 web-03 nginx[1204]: 45.110.157.155 - - "GET /static/app.js HTTP/1.1" 200 55339 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:48.452310-07:00 api-08 nginx[1200]: 192.189.184.187 - - "GET /api/v2/orders/8841 HTTP/1.1" 500 69557 "-" "curl/8.4.0" 2026-10-09T13:34:48.637833-07:00 web-01 audit: type=USER_LOGIN msg=audit(1791578088.767:99448): pid=99448 uid=0 auid=1963 ses=301 msg='op=login id=1963 exe="/usr/sbin/sshd" hostname=? addr=91.238.0.91 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:48.683948-07:00 web-01 app[30308]: INFO request_id=e437bcc727ea28ea method=GET path=/admin status=200 duration=2079ms 2026-10-09T13:34:48.706305-07:00 bastion haproxy[912]: 91.196.208.242:7703 [17482] http-in app/bastion 4725/0/714/714/4725 200 89189 - - ---- 536/536/46/46/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:34:48.979928-07:00 api-08 kernel: [65275.870324] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.226.42.208 DST=10.0.250.250 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=65275 DF PROTO=TCP SPT=45908 DPT=45908 WINDOW=65275 RES=0x00 SYN URGP=0 2026-10-09T13:34:49.013092-07:00 web-03 systemd[1]: session-99458.scope: Deactivated successfully. 2026-10-09T13:34:49.028175-07:00 api-08 nginx[1204]: 91.210.160.213 - - "GET /login HTTP/1.1" 401 4286 "-" "kube-probe/1.31" 2026-10-09T13:34:49.169633-07:00 api-07 app[30675]: INFO request_id=bff4bb66783d3c40 method=GET path=/login status=200 duration=8002ms 2026-10-09T13:34:49.178360-07:00 web-03 sudo: root : TTY=pts/0 ; PWD=/home/root ; USER=root ; COMMAND=/usr/bin/systemctl restart app.service 2026-10-09T13:34:49.654097-07:00 db-replica app[30032]: DEBUG cache hit ratio 42% over the last minute (29632 lookups) 2026-10-09T13:34:49.981657-07:00 db-primary nginx[1203]: 91.191.81.70 - backup "POST /api/v2/orders/8841 HTTP/1.1" 502 29579 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:50.022234-07:00 web-02 app[30527]: INFO worker 71 finished job 349312e243912add in 1441 ms 2026-10-09T13:34:50.255353-07:00 db-replica app[30613]: INFO request_id=0bcf935bf0e4bb1d method=GET path=/admin status=502 duration=8755ms 2026-10-09T13:34:50.316840-07:00 web-03 nginx[1204]: 192.118.219.35 - - "GET /login HTTP/1.1" 200 10723 "-" "Go-http-client/1.1" 2026-10-09T13:34:50.346766-07:00 api-07 app[30233]: INFO request_id=b22b777a8dba09c6 method=GET path=/metrics status=200 duration=8341ms 2026-10-09T13:34:50.350999-07:00 bastion app[30833]: INFO order 31943 confirmed for zoë in 9258 ms (region us-east-1, queue invoices) 2026-10-09T13:34:50.503568-07:00 edge-fr-1 systemd[1]: Started Session 19094 of User backup. 2026-10-09T13:34:50.551135-07:00 worker-12 app[30833]: INFO health check ok: db 686 ms, cache 686 ms, queue depth 43 2026-10-09T13:34:50.555293-07:00 api-08 kernel: [28800.161070] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.207.7.219 DST=10.0.741.741 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=28800 DF PROTO=TCP SPT=10594 DPT=10594 WINDOW=28800 RES=0x00 SYN URGP=0 2026-10-09T13:34:50.611029-07:00 bastion app[30359]: INFO worker 88 finished job b89b7249df34bc67 in 9908 ms 2026-10-09T13:34:50.787937-07:00 web-02 nginx[1205]: 192.188.27.1 - - "GET /api/v2/orders HTTP/1.1" 502 51803 "-" "Go-http-client/1.1" 2026-10-09T13:34:50.961273-07:00 edge-fr-1 app[30343]: INFO worker 90 finished job 96273d938e11db89 in 6016 ms 2026-10-09T13:34:50.990719-07:00 cache-3 app[30834]: INFO worker 30 picked job b8c7a884628d71f9 from queue orders 2026-10-09T13:34:51.004383-07:00 bastion nginx[1201]: 45.36.110.95 - akira "POST /static/app.js HTTP/1.1" 401 79027 "-" "curl/8.4.0" 2026-10-09T13:34:51.159892-07:00 web-01 cron[42364]: (backup) CMD (/usr/bin/backup --quiet --target /srv/backup) 2026-10-09T13:34:51.193933-07:00 api-08 kernel: [49311.081655] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.111.187.4 DST=10.0.550.550 LEN=35 TOS=0x00 PREC=0x00 TTL=35 ID=49311 DF PROTO=TCP SPT=5667 DPT=5667 WINDOW=49311 RES=0x00 SYN URGP=0 2026-10-09T13:34:51.306298-07:00 api-08 sshd[22780]: Connection closed by 91.1.196.253 port 25711 [preauth] 2026-10-09T13:34:51.308491-07:00 worker-12 nginx[1209]: 203.78.150.200 - françois "POST /static/app.js HTTP/1.1" 302 28974 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:51.633694-07:00 worker-12 app[30887]: INFO worker 52 finished job 823afb7535238ab4 in 420 ms 2026-10-09T13:34:51.663884-07:00 api-08 sshd[15737]: Received disconnect from 91.197.136.35 port 34322:11: Bye Bye [preauth] 2026-10-09T13:34:51.874631-07:00 db-replica haproxy[940]: 172.21.60.220:32919 [63133] http-in app/api-08 6479/0/211/211/6479 200 13083 - - ---- 107/107/42/42/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:34:52.354389-07:00 db-replica nginx[1203]: 203.25.220.190 - - "GET /api/v2/search?q=invoice HTTP/1.1" 301 27584 "-" "kube-probe/1.31" 2026-10-09T13:34:52.569319-07:00 api-07 app[30238]: INFO health check ok: db 644 ms, cache 644 ms, queue depth 84 2026-10-09T13:34:52.649661-07:00 db-primary haproxy[914]: 172.203.116.17:29600 [29026] http-in app/api-08 9926/0/268/268/9926 200 26291 - - ---- 554/554/49/49/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:34:52.847770-07:00 db-replica app[30412]: INFO health check ok: db 45 ms, cache 45 ms, queue depth 58 2026-10-09T13:34:53.022043-07:00 web-01 haproxy[917]: 172.248.234.166:53482 [58064] http-in app/bastion 7133/0/303/303/7133 200 27205 - - ---- 908/908/44/44/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:34:53.191781-07:00 worker-12 nginx[1208]: 10.196.81.173 - - "GET /api/v2/search?q=invoice HTTP/1.1" 302 49727 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:34:53.496649-07:00 cache-3 nginx[1205]: 192.91.221.243 - - "GET /static/app.js HTTP/1.1" 401 52104 "-" "python-requests/2.32.3" 2026-10-09T13:34:53.617586-07:00 web-01 sshd[23245]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:34:53.645287-07:00 web-03 nginx[1201]: 45.55.102.181 - - "GET /admin HTTP/1.1" 502 10148 "-" "kube-probe/1.31" 2026-10-09T13:34:53.716522-07:00 db-primary sshd[61395]: Accepted publickey for deploy from 192.214.111.93 port 14119 ssh2: ED25519 SHA256:97cc26eb73ffa698 2026-10-09T13:34:53.771856-07:00 db-primary haproxy[929]: 203.153.176.13:50558 [18223] http-in app/db-primary 2020/0/36/36/2020 204 64540 - - ---- 373/373/38/38/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:34:53.823518-07:00 db-replica dockerd[700]: time="2026-10-09T13:34:53.823518-07:00" level=info msg="Container b2dcc3bff0ca74b1 exited with code 0" 2026-10-09T13:34:53.987201-07:00 db-primary app[30153]: INFO order 86036 confirmed for deploy in 9141 ms (region eu-west-1, queue emails) 2026-10-09T13:34:54.122930-07:00 web-03 kernel: [24343.855108] TCP: request_sock_TCP: Possible SYN flooding on port 32973. Sending cookies. Check SNMP counters. 2026-10-09T13:34:54.332458-07:00 db-replica postgres[17490]: LOG: duration: 1875.783 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:54.376635-07:00 db-primary app[30685]: INFO order 51522 confirmed for françois in 1497 ms (region ap-northeast-1, queue emails) 2026-10-09T13:34:54.402459-07:00 worker-12 app[30095]: INFO worker 78 picked job 941ba1b44b0ea41a from queue orders 2026-10-09T13:34:54.581442-07:00 web-01 kernel: [62613.913781] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.223.116.201 DST=10.0.537.537 LEN=23 TOS=0x00 PREC=0x00 TTL=23 ID=62613 DF PROTO=TCP SPT=52767 DPT=52767 WINDOW=62613 RES=0x00 SYN URGP=0 2026-10-09T13:34:54.855655-07:00 db-primary systemd[1]: session-19688.scope: Deactivated successfully. 2026-10-09T13:34:54.917910-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578094.767:82260): pid=82260 uid=0 auid=1348 ses=756 msg='op=login id=1348 exe="/usr/sbin/sshd" hostname=? addr=192.193.210.72 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:55.346574-07:00 edge-fr-1 app[30337]: INFO worker 94 picked job 3bd2b45c18c59af7 from queue orders 2026-10-09T13:34:55.349030-07:00 cache-3 kernel: [19619.530813] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.215.144.79 DST=10.0.837.837 LEN=39 TOS=0x00 PREC=0x00 TTL=39 ID=19619 DF PROTO=TCP SPT=56457 DPT=56457 WINDOW=19619 RES=0x00 SYN URGP=0 2026-10-09T13:34:55.382586-07:00 bastion sshd[61714]: pam_unix(sshd:session): session opened for user backup(uid=9358) by (uid=0) 2026-10-09T13:34:55.471863-07:00 api-08 app[30580]: INFO worker 63 picked job e6c61911cebc214f from queue emails 2026-10-09T13:34:55.492732-07:00 db-primary app[30910]: ERROR cache miss storm: 2576 misses in 4565 ms, key prefix session:sørensen 2026-10-09T13:34:55.777177-07:00 cache-3 systemd[1]: Started Session 21585 of User priya. 2026-10-09T13:34:55.809584-07:00 db-primary nginx[1210]: 192.218.81.55 - - "GET /.env HTTP/1.1" 502 65477 "-" "kube-probe/1.31" 2026-10-09T13:34:55.876398-07:00 db-primary sshd[64555]: Accepted publickey for françois from 10.152.92.6 port 56779 ssh2: ED25519 SHA256:27d1de5a1080c2e2 2026-10-09T13:34:55.886730-07:00 edge-fr-1 audit: type=USER_LOGIN msg=audit(1791578095.196:29362): pid=29362 uid=0 auid=9180 ses=867 msg='op=login id=9180 exe="/usr/sbin/sshd" hostname=? addr=10.0.29.204 terminal=/dev/pts/0 res=success' 2026-10-09T13:34:55.917689-07:00 db-primary app[30880]: INFO request_id=5cdcca5b5da17e52 method=GET path=/api/v2/orders/8841 status=204 duration=885ms 2026-10-09T13:34:56.387467-07:00 worker-12 sshd[47676]: Connection closed by 192.147.168.227 port 64547 [preauth] 2026-10-09T13:34:56.391653-07:00 web-02 systemd[1]: Started Session 25050 of User zoë. 2026-10-09T13:34:56.477359-07:00 api-08 sshd[4677]: Failed password for invalid user françois from 91.172.253.175 port 30418 ssh2 2026-10-09T13:34:56.479726-07:00 web-03 postgres[3743]: LOG: duration: 6074.493 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:34:56.551064-07:00 cache-3 systemd[1]: session-47780.scope: Deactivated successfully. 2026-10-09T13:34:56.753952-07:00 worker-12 app[30976]: INFO request_id=9a940edcfd645be1 method=GET path=/static/app.js status=302 duration=4424ms 2026-10-09T13:34:56.834110-07:00 db-replica haproxy[901]: 10.102.178.141:56159 [81227] http-in app/edge-fr-1 5813/0/294/294/5813 200 6264 - - ---- 857/857/76/76/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:34:57.002611-07:00 api-08 app[30780]: INFO worker 32 finished job e5d038dcde8e7d7b in 6713 ms 2026-10-09T13:34:57.010135-07:00 web-02 app[30723]: INFO request_id=688c27a32e719a78 method=GET path=/api/v2/orders/8841 status=502 duration=9260ms 2026-10-09T13:34:57.112694-07:00 web-03 app[30602]: INFO request_id=f24f37dbd800737e method=GET path=/admin status=502 duration=7141ms 2026-10-09T13:34:57.195316-07:00 db-replica kernel: [98986.855856] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.231.101.129 DST=10.0.812.812 LEN=21 TOS=0x00 PREC=0x00 TTL=21 ID=98986 DF PROTO=TCP SPT=22857 DPT=22857 WINDOW=98986 RES=0x00 SYN URGP=0 2026-10-09T13:34:57.232344-07:00 api-08 sshd[5961]: pam_unix(sshd:session): session opened for user akira(uid=8044) by (uid=0) 2026-10-09T13:34:57.345068-07:00 bastion nginx[1202]: 172.209.128.239 - - "GET /metrics HTTP/1.1" 200 21694 "-" "python-requests/2.32.3" 2026-10-09T13:34:57.358047-07:00 web-01 haproxy[929]: 45.248.240.82:61049 [65951] http-in app/web-02 299/0/324/324/299 200 86482 - - ---- 960/960/40/40/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:34:57.369306-07:00 cache-3 nginx[1203]: 192.183.162.28 - - "GET /login HTTP/1.1" 200 80189 "-" "python-requests/2.32.3" 2026-10-09T13:34:57.383831-07:00 bastion app[30277]: INFO request_id=bd49ab459b21456f method=GET path=/.env status=301 duration=2279ms 2026-10-09T13:34:57.450174-07:00 bastion nginx[1207]: 45.89.160.104 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 57327 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:34:57.494813-07:00 bastion app[30319]: WARN retrying upstream 91.49.152.163:53491 after timeout (9015 ms), attempt 3 of 3 2026-10-09T13:34:57.495057-07:00 web-01 app[30202]: INFO worker 74 picked job 1c3aac4c3ef5cb30 from queue invoices 2026-10-09T13:34:57.528920-07:00 api-07 app[30791]: INFO request_id=5faa47c3d8f0b87b method=GET path=/static/main.css status=204 duration=4580ms 2026-10-09T13:34:57.644420-07:00 db-primary haproxy[925]: 91.67.173.19:28616 [17212] http-in app/worker-12 7370/0/151/151/7370 200 51324 - - ---- 840/840/17/17/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:34:57.671762-07:00 bastion kernel: [11171.015337] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.220.71.174 DST=10.0.904.904 LEN=59 TOS=0x00 PREC=0x00 TTL=59 ID=11171 DF PROTO=TCP SPT=18837 DPT=18837 WINDOW=11171 RES=0x00 SYN URGP=0 2026-10-09T13:34:57.686354-07:00 bastion app[30177]: INFO order 63982 confirmed for ci in 9660 ms (region eu-west-1, queue emails) 2026-10-09T13:34:57.749754-07:00 api-07 sshd[7458]: pam_unix(sshd:session): session closed for user akira 2026-10-09T13:34:57.836931-07:00 api-07 systemd[1]: session-13488.scope: Deactivated successfully. 2026-10-09T13:34:57.837627-07:00 db-primary nginx[1209]: 172.177.152.65 - - "GET /api/v2/orders HTTP/1.1" 200 65056 "-" "kube-probe/1.31" 2026-10-09T13:34:57.894039-07:00 api-07 app[30511]: INFO worker 27 finished job 3e7c629dcb17571d in 4797 ms 2026-10-09T13:34:57.945449-07:00 bastion app[30387]: INFO order 89986 confirmed for müller in 3736 ms (region eu-west-1, queue invoices) 2026-10-09T13:34:58.143473-07:00 worker-12 haproxy[902]: 192.244.143.118:21822 [52776] http-in app/db-primary 4357/0/859/859/4357 200 29186 - - ---- 689/689/99/99/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:34:58.262656-07:00 web-03 haproxy[944]: 10.70.19.187:32031 [21643] http-in app/edge-fr-1 8731/0/108/108/8731 404 24346 - - ---- 625/625/57/57/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:34:58.294247-07:00 api-08 nginx[1205]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.110.45.6, server: app.example.com, request: "GET /static/app.js HTTP/1.1", upstream: "http://10.0.858.858:8080/static/app.js" 2026-10-09T13:34:58.327473-07:00 web-03 systemd[1]: session-51781.scope: Deactivated successfully. 2026-10-09T13:34:58.333719-07:00 api-07 sshd[10234]: pam_unix(sshd:session): session opened for user françois(uid=6189) by (uid=0) 2026-10-09T13:34:58.506341-07:00 api-07 app[30307]: INFO request_id=10c20e1e1020f697 method=GET path=/wp-login.php status=200 duration=1523ms 2026-10-09T13:34:58.535473-07:00 worker-12 haproxy[905]: 203.152.126.176:29814 [47605] http-in app/cache-3 8597/0/396/396/8597 302 41062 - - ---- 302/302/45/45/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:34:58.578057-07:00 bastion kernel: [70900.814141] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.248.61.237 DST=10.0.944.944 LEN=68 TOS=0x00 PREC=0x00 TTL=68 ID=70900 DF PROTO=TCP SPT=3089 DPT=3089 WINDOW=70900 RES=0x00 SYN URGP=0 2026-10-09T13:34:58.996409-07:00 web-02 systemd[1]: Started Session 58608 of User müller. 2026-10-09T13:34:59.139425-07:00 edge-fr-1 nginx[1209]: 91.92.246.202 - - "GET /api/v2/orders HTTP/1.1" 302 62693 "-" "curl/8.4.0" 2026-10-09T13:34:59.255530-07:00 web-02 postgres[3882]: LOG: duration: 7115.460 ms statement: SELECT * FROM orders WHERE customer_id = 91618 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:34:59.480432-07:00 edge-fr-1 app[30961]: INFO worker 63 picked job 6edfe7d7c380a8d2 from queue invoices 2026-10-09T13:34:59.499912-07:00 db-replica sshd[55932]: Connection closed by 45.75.62.52 port 25915 [preauth] 2026-10-09T13:34:59.681871-07:00 web-03 sshd[51203]: Connection closed by 10.237.45.15 port 39362 [preauth] 2026-10-09T13:34:59.846250-07:00 api-07 app[30091]: INFO worker 97 finished job bd66ee2e491bc97b in 5441 ms 2026-10-09T13:34:59.901887-07:00 web-02 app[30981]: INFO request_id=34d85bbb65e6ce54 method=GET path=/wp-login.php status=502 duration=1071ms 2026-10-09T13:34:59.940102-07:00 edge-fr-1 app[30360]: WARN retrying upstream 45.177.93.161:35749 after timeout (2073 ms), attempt 2 of 3 2026-10-09T13:34:59.941429-07:00 web-01 kernel: [75221.429296] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.148.111.112 DST=10.0.688.688 LEN=45 TOS=0x00 PREC=0x00 TTL=45 ID=75221 DF PROTO=TCP SPT=23160 DPT=23160 WINDOW=75221 RES=0x00 SYN URGP=0 2026-10-09T13:34:59.980175-07:00 db-primary app[30973]: INFO request_id=bc853f7936416d7b method=GET path=/metrics status=204 duration=5115ms 2026-10-09T13:35:00.064209-07:00 edge-fr-1 app[30374]: INFO health check ok: db 353 ms, cache 353 ms, queue depth 30 2026-10-09T13:35:00.467980-07:00 api-08 nginx[1207]: 10.218.116.235 - - "GET /static/main.css HTTP/1.1" 401 8126 "-" "kube-probe/1.31" 2026-10-09T13:35:00.649830-07:00 db-primary app[30493]: INFO request_id=3c7baf90f74ff39b method=GET path=/api/v2/search?q=invoice status=200 duration=1068ms 2026-10-09T13:35:00.668743-07:00 edge-fr-1 app[30334]: INFO request_id=ee88c1f6d3f0d400 method=GET path=/.env status=200 duration=4699ms 2026-10-09T13:35:00.694656-07:00 cache-3 nginx[1209]: 45.16.251.184 - - "GET /api/v2/users HTTP/1.1" 404 55525 "-" "python-requests/2.32.3" 2026-10-09T13:35:00.734320-07:00 cache-3 app[30718]: INFO worker 64 picked job fd22f1c7f60b10c1 from queue invoices 2026-10-09T13:35:00.807926-07:00 db-primary nginx[1204]: 10.140.229.122 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 80663 "-" "curl/8.4.0" 2026-10-09T13:35:00.886772-07:00 edge-fr-1 nginx[1200]: 192.36.134.18 - - "GET /login HTTP/1.1" 200 23510 "-" "curl/8.4.0" 2026-10-09T13:35:00.888489-07:00 web-02 app[30763]: INFO worker 80 picked job f80b7efeaa0602a7 from queue emails 2026-10-09T13:35:00.895060-07:00 web-01 haproxy[931]: 91.39.37.86:61296 [20738] http-in app/web-02 7938/0/164/164/7938 301 14984 - - ---- 725/725/17/17/0 0/0 "GET /metrics HTTP/1.1" 2026-10-09T13:35:01.089589-07:00 edge-fr-1 sshd[5533]: Connection closed by 192.149.81.9 port 1592 [preauth] 2026-10-09T13:35:01.116559-07:00 web-02 app[30331]: INFO request_id=69cc19d7f3f8d150 method=GET path=/wp-login.php status=404 duration=9489ms 2026-10-09T13:35:01.137508-07:00 edge-fr-1 app[30844]: INFO request_id=bf93b97c7c8f1ecc method=GET path=/static/main.css status=500 duration=1869ms 2026-10-09T13:35:01.196894-07:00 api-08 haproxy[938]: 91.64.250.81:45335 [19328] http-in app/web-02 3969/0/717/717/3969 204 28348 - - ---- 787/787/35/35/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:35:01.214865-07:00 cache-3 nginx[1205]: 172.175.150.109 - - "GET /metrics HTTP/1.1" 200 51286 "-" "kube-probe/1.31" 2026-10-09T13:35:01.242811-07:00 api-08 nginx[1206]: 192.62.116.40 - - "GET /wp-login.php HTTP/1.1" 302 63365 "-" "curl/8.4.0" 2026-10-09T13:35:01.311582-07:00 api-07 nginx[1203]: 10.173.230.57 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 44270 "-" "curl/8.4.0" 2026-10-09T13:35:01.322634-07:00 worker-12 app[30113]: INFO request_id=abefb406dc9c3613 method=GET path=/api/v2/search?q=invoice status=200 duration=7233ms 2026-10-09T13:35:01.370581-07:00 web-02 nginx[1209]: 91.140.52.163 - - "GET /static/app.js HTTP/1.1" 502 30263 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:01.689030-07:00 web-01 postgres[6070]: LOG: duration: 1814.810 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:01.726849-07:00 api-08 sshd[42776]: Connection closed by 172.133.76.155 port 7354 [preauth] 2026-10-09T13:35:01.910057-07:00 worker-12 kernel: [52594.262403] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.148.84.176 DST=10.0.918.918 LEN=41 TOS=0x00 PREC=0x00 TTL=41 ID=52594 DF PROTO=TCP SPT=6773 DPT=6773 WINDOW=52594 RES=0x00 SYN URGP=0 2026-10-09T13:35:02.017926-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578102.773:26442): pid=26442 uid=0 auid=7371 ses=164 msg='op=login id=7371 exe="/usr/sbin/sshd" hostname=? addr=192.151.56.42 terminal=/dev/pts/0 res=success' 2026-10-09T13:35:02.364163-07:00 api-07 app[30017]: INFO worker 73 finished job 2bd0be6d48c678dc in 6337 ms 2026-10-09T13:35:02.436318-07:00 bastion haproxy[950]: 91.21.231.245:29454 [33908] http-in app/web-01 8944/0/741/741/8944 204 31277 - - ---- 253/253/91/91/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:35:02.470250-07:00 bastion kernel: [94751.609699] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.234.60.59 DST=10.0.836.836 LEN=42 TOS=0x00 PREC=0x00 TTL=42 ID=94751 DF PROTO=TCP SPT=6412 DPT=6412 WINDOW=94751 RES=0x00 SYN URGP=0 2026-10-09T13:35:02.558453-07:00 cache-3 nginx[1208]: 172.231.93.41 - - "GET /api/v2/orders HTTP/1.1" 502 79474 "-" "kube-probe/1.31" 2026-10-09T13:35:03.204005-07:00 db-primary sshd[35451]: pam_unix(sshd:session): session opened for user sørensen(uid=4753) by (uid=0) 2026-10-09T13:35:03.292867-07:00 db-primary app[30005]: INFO order 69996 confirmed for root in 2728 ms (region eu-west-1, queue invoices) 2026-10-09T13:35:03.524611-07:00 web-02 app[30490]: INFO order 66854 confirmed for françois in 5395 ms (region ap-northeast-1, queue orders) 2026-10-09T13:35:03.547972-07:00 edge-fr-1 app[30117]: INFO worker 92 finished job 6705261722cd4971 in 7158 ms 2026-10-09T13:35:03.689039-07:00 edge-fr-1 sshd[63214]: pam_unix(sshd:session): session opened for user françois(uid=1505) by (uid=0) 2026-10-09T13:35:03.841431-07:00 worker-12 app[30809]: INFO request_id=999b4d5edc02d8db method=GET path=/static/app.js status=200 duration=7041ms 2026-10-09T13:35:03.933720-07:00 cache-3 app[30191]: WARN retrying upstream 91.31.208.167:21965 after timeout (4669 ms), attempt 2 of 3 2026-10-09T13:35:04.215346-07:00 edge-fr-1 postgres[10833]: LOG: duration: 5221.468 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:04.295920-07:00 db-primary app[30499]: INFO worker 28 finished job 1066351eef00f26d in 7512 ms 2026-10-09T13:35:04.307251-07:00 web-03 postgres[17516]: LOG: duration: 1859.677 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:04.446682-07:00 web-02 nginx[1207]: 172.59.176.196 - - "GET /health HTTP/1.1" 500 26804 "-" "python-requests/2.32.3" 2026-10-09T13:35:04.514267-07:00 worker-12 app[30940]: INFO order 39770 confirmed for deploy in 754 ms (region ap-northeast-1, queue emails) 2026-10-09T13:35:04.538677-07:00 web-01 sshd[40729]: Connection closed by 10.224.73.70 port 12525 [preauth] 2026-10-09T13:35:04.614120-07:00 worker-12 nginx[1208]: 10.229.139.150 - - "GET /static/main.css HTTP/1.1" 200 58746 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:04.965712-07:00 api-07 app[30998]: INFO request_id=21f766870d83f176 method=GET path=/.env status=301 duration=2872ms 2026-10-09T13:35:04.998807-07:00 api-08 nginx[1203]: 45.71.182.37 - - "GET /.env HTTP/1.1" 302 78123 "-" "Go-http-client/1.1" 2026-10-09T13:35:05.002352-07:00 api-08 app[30850]: INFO order 78453 confirmed for deploy in 2354 ms (region eu-west-1, queue orders) 2026-10-09T13:35:05.020365-07:00 web-03 systemd[1]: Started Session 90940 of User ci. 2026-10-09T13:35:05.113652-07:00 bastion app[30558]: INFO request_id=dcfc75b3147e7fa7 method=GET path=/metrics status=204 duration=2395ms 2026-10-09T13:35:05.350018-07:00 edge-fr-1 app[30081]: INFO order 87451 confirmed for deploy in 315 ms (region eu-west-1, queue emails) 2026-10-09T13:35:05.436183-07:00 api-08 haproxy[947]: 192.119.157.87:9464 [33352] http-in app/db-replica 2036/0/373/373/2036 502 37432 - - ---- 375/375/58/58/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:05.513927-07:00 web-01 nginx[1205]: 203.12.139.72 - root "POST /api/v2/search?q=invoice HTTP/1.1" 204 53998 "-" "Go-http-client/1.1" 2026-10-09T13:35:05.516801-07:00 web-03 app[30831]: INFO order 85847 confirmed for müller in 8295 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:35:05.786592-07:00 db-replica app[30951]: INFO worker 24 picked job 2a75e2de0232ba3f from queue invoices 2026-10-09T13:35:06.499722-07:00 web-03 nginx[1206]: 45.161.172.198 - - "GET /metrics HTTP/1.1" 404 74533 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:07.043799-07:00 db-replica sshd[25006]: Failed password for invalid user zoë from 203.195.138.161 port 52863 ssh2 2026-10-09T13:35:07.080004-07:00 db-replica app[30663]: INFO worker 32 finished job 4bddd080ec21c08d in 1617 ms 2026-10-09T13:35:07.091308-07:00 cache-3 app[30649]: INFO health check ok: db 280 ms, cache 280 ms, queue depth 13 2026-10-09T13:35:07.095633-07:00 web-02 nginx[1200]: 91.253.88.104 - - "GET /api/v2/search?q=invoice HTTP/1.1" 500 70473 "-" "Go-http-client/1.1" 2026-10-09T13:35:07.216123-07:00 api-08 nginx[1209]: 192.242.138.104 - ci "POST /wp-login.php HTTP/1.1" 200 46053 "-" "kube-probe/1.31" 2026-10-09T13:35:07.219941-07:00 api-07 nginx[1209]: 45.104.53.220 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 76068 "-" "kube-probe/1.31" 2026-10-09T13:35:07.588701-07:00 api-07 haproxy[937]: 172.6.173.3:51218 [55835] http-in app/api-07 3529/0/543/543/3529 200 45584 - - ---- 164/164/42/42/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:35:07.716087-07:00 worker-12 app[30754]: INFO worker 29 picked job 4977636e43395931 from queue orders 2026-10-09T13:35:07.977401-07:00 db-replica app[30828]: INFO worker 46 finished job abe6d4ec060a1961 in 3856 ms 2026-10-09T13:35:08.152915-07:00 db-primary nginx[1207]: 45.183.139.197 - - "GET /.env HTTP/1.1" 200 89800 "-" "kube-probe/1.31" 2026-10-09T13:35:08.318172-07:00 bastion app[30315]: INFO worker 19 picked job 9347d4b38e679a07 from queue webhooks 2026-10-09T13:35:08.398051-07:00 web-01 nginx[1210]: 192.174.12.48 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 45654 "-" "kube-probe/1.31" 2026-10-09T13:35:08.465964-07:00 db-primary nginx[1207]: 172.71.148.128 - - "GET /static/app.js HTTP/1.1" 404 66342 "-" "Go-http-client/1.1" 2026-10-09T13:35:08.493350-07:00 web-01 app[30961]: INFO health check ok: db 370 ms, cache 370 ms, queue depth 38 2026-10-09T13:35:08.549332-07:00 db-primary sshd[21165]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:35:08.659585-07:00 web-03 app[30154]: INFO worker 10 picked job 48f3de8020a14fec from queue orders 2026-10-09T13:35:08.680868-07:00 bastion haproxy[935]: 203.118.84.60:12209 [87485] http-in app/worker-12 4392/0/910/910/4392 404 10896 - - ---- 481/481/65/65/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:35:09.250863-07:00 bastion nginx[1207]: 91.71.59.120 - - "GET /api/v2/orders HTTP/1.1" 200 17061 "-" "kube-probe/1.31" 2026-10-09T13:35:09.450226-07:00 cache-3 app[30517]: INFO order 30933 confirmed for sørensen in 8412 ms (region us-east-1, queue emails) 2026-10-09T13:35:09.552427-07:00 edge-fr-1 nginx[1205]: 45.55.214.83 - - "GET /admin HTTP/1.1" 200 17892 "-" "python-requests/2.32.3" 2026-10-09T13:35:09.674620-07:00 api-08 app[30308]: INFO health check ok: db 84 ms, cache 84 ms, queue depth 83 2026-10-09T13:35:09.723544-07:00 edge-fr-1 haproxy[933]: 172.182.164.222:5084 [54963] http-in app/edge-fr-1 5748/0/564/564/5748 200 64231 - - ---- 969/969/17/17/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:35:09.756018-07:00 web-01 sshd[29996]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:35:09.867163-07:00 bastion app[30968]: INFO health check ok: db 623 ms, cache 623 ms, queue depth 28 2026-10-09T13:35:09.910665-07:00 worker-12 postgres[25003]: LOG: automatic vacuum of table "app.public.events": index scans: 1, pages: 0 removed, 79219 remain, 5236 scanned (97% of total) 2026-10-09T13:35:09.973309-07:00 api-08 app[30404]: ERROR cache miss storm: 9223 misses in 5621 ms, key prefix session:akira 2026-10-09T13:35:09.992207-07:00 web-01 nginx[1202]: 91.248.176.179 - priya "POST /api/v2/search?q=invoice HTTP/1.1" 200 70893 "-" "python-requests/2.32.3" 2026-10-09T13:35:10.038120-07:00 edge-fr-1 app[30065]: INFO worker 57 finished job db4f4760f95f2158 in 4540 ms 2026-10-09T13:35:10.197868-07:00 web-02 app[30457]: INFO request_id=0a4e593647c72402 method=GET path=/admin status=204 duration=6132ms 2026-10-09T13:35:10.388596-07:00 cache-3 app[30640]: INFO request_id=64c8acd0f2a6574d method=GET path=/api/v2/orders status=404 duration=34ms 2026-10-09T13:35:10.422476-07:00 bastion systemd[1]: Started Session 64968 of User backup. 2026-10-09T13:35:10.497121-07:00 cache-3 app[30581]: INFO worker 63 picked job 45e890ccc95c33d4 from queue orders 2026-10-09T13:35:10.696712-07:00 edge-fr-1 postgres[11513]: LOG: duration: 6671.27 ms statement: SELECT * FROM orders WHERE customer_id = 20499 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:10.839351-07:00 web-03 dockerd[700]: time="2026-10-09T13:35:10.839351-07:00" level=info msg="Container 7af5e14a66e7052d exited with code 0" 2026-10-09T13:35:11.073296-07:00 bastion app[30645]: INFO request_id=424c49976b64fc3d method=GET path=/.env status=404 duration=6015ms 2026-10-09T13:35:11.094592-07:00 worker-12 app[30308]: INFO order 56654 confirmed for françois in 5516 ms (region us-east-1, queue emails) 2026-10-09T13:35:11.101470-07:00 cache-3 haproxy[931]: 192.32.123.80:13244 [84764] http-in app/web-02 3787/0/487/487/3787 404 32917 - - ---- 641/641/82/82/0 0/0 "GET /static/main.css HTTP/1.1" 2026-10-09T13:35:11.182324-07:00 bastion sshd[12736]: pam_unix(sshd:session): session closed for user zoë 2026-10-09T13:35:11.361010-07:00 db-replica nginx[1209]: 10.236.90.57 - - "GET /api/v2/users HTTP/1.1" 301 29866 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:11.402236-07:00 web-03 postgres[12065]: LOG: duration: 6536.679 ms statement: SELECT * FROM orders WHERE customer_id = 98799 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:11.474899-07:00 api-08 nginx[1206]: 10.53.34.217 - sørensen "POST /wp-login.php HTTP/1.1" 301 47207 "-" "kube-probe/1.31" 2026-10-09T13:35:11.731450-07:00 web-02 app[30477]: DEBUG cache hit ratio 3% over the last minute (18865 lookups) 2026-10-09T13:35:11.738681-07:00 db-primary app[30517]: INFO request_id=27257eff12548573 method=GET path=/login status=502 duration=494ms 2026-10-09T13:35:12.143204-07:00 cache-3 sshd[26385]: Accepted publickey for deploy from 172.57.252.21 port 40464 ssh2: ED25519 SHA256:8e8e6f4dee1d5ff5 2026-10-09T13:35:12.215177-07:00 api-07 sshd[27238]: Invalid user françois from 10.142.208.128 port 51093 2026-10-09T13:35:12.226958-07:00 web-03 nginx[1206]: 10.214.46.234 - - "GET /favicon.ico HTTP/1.1" 200 60693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:12.238955-07:00 web-02 haproxy[950]: 10.46.209.116:32276 [55193] http-in app/web-01 6759/0/319/319/6759 200 80054 - - ---- 632/632/88/88/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:12.419977-07:00 api-08 app[30594]: INFO order 68881 confirmed for root in 9504 ms (region eu-west-1, queue invoices) 2026-10-09T13:35:12.552632-07:00 api-08 nginx[1206]: 172.155.34.198 - - "GET /wp-login.php HTTP/1.1" 200 15395 "-" "curl/8.4.0" 2026-10-09T13:35:12.654439-07:00 bastion app[30666]: INFO request_id=b261acc9704d2aa6 method=GET path=/favicon.ico status=200 duration=4172ms 2026-10-09T13:35:12.763765-07:00 web-02 sshd[23944]: Connection closed by 45.251.38.98 port 22777 [preauth] 2026-10-09T13:35:12.777107-07:00 web-03 nginx[1200]: 91.2.254.29 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 29703 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:13.001901-07:00 db-primary app[30927]: INFO request_id=f0918d6eca9b86a6 method=GET path=/admin status=200 duration=1868ms 2026-10-09T13:35:13.025979-07:00 api-08 nginx[1200]: 172.55.99.59 - - "GET /wp-login.php HTTP/1.1" 401 83918 "-" "python-requests/2.32.3" 2026-10-09T13:35:13.105856-07:00 edge-fr-1 app[30713]: INFO worker 27 finished job fca113413aac9f6f in 4165 ms 2026-10-09T13:35:13.140336-07:00 cache-3 nginx[1201]: 172.107.20.50 - root "POST /login HTTP/1.1" 301 24114 "-" "Go-http-client/1.1" 2026-10-09T13:35:13.149689-07:00 edge-fr-1 haproxy[947]: 91.65.166.112:13395 [70532] http-in app/db-replica 8735/0/633/633/8735 204 14975 - - ---- 314/314/20/20/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:35:13.216674-07:00 web-02 postgres[23809]: LOG: duration: 3360.239 ms statement: SELECT * FROM orders WHERE customer_id = 63231 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:13.254039-07:00 web-01 app[30136]: DEBUG cache hit ratio 73% over the last minute (60239 lookups) 2026-10-09T13:35:13.297851-07:00 edge-fr-1 systemd[1]: Started Session 92231 of User müller. 2026-10-09T13:35:13.299735-07:00 bastion postgres[20374]: LOG: duration: 530.173 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:13.426587-07:00 web-01 app[30882]: INFO order 67367 confirmed for ci in 786 ms (region eu-west-1, queue emails) 2026-10-09T13:35:13.432292-07:00 edge-fr-1 sshd[54580]: Failed password for invalid user sørensen from 203.168.27.80 port 4353 ssh2 2026-10-09T13:35:13.668605-07:00 web-03 app[30565]: INFO worker 33 picked job 88ba030295220d30 from queue invoices 2026-10-09T13:35:13.751709-07:00 db-primary app[30237]: ERROR cache miss storm: 6108 misses in 4257 ms, key prefix session:akira 2026-10-09T13:35:13.922110-07:00 edge-fr-1 sshd[27744]: Invalid user sørensen from 10.154.103.184 port 40645 2026-10-09T13:35:14.091744-07:00 edge-fr-1 nginx[1203]: upstream timed out (110: Connection timed out) while reading response header from upstream, client: 203.166.159.166, server: app.example.com, request: "GET /api/v2/orders/8841 HTTP/1.1", upstream: "http://10.0.699.699:8080/api/v2/orders/8841" 2026-10-09T13:35:14.452946-07:00 api-08 ntpd[300]: kernel reports TIME_ERROR: 0x41: Clock Unsynchronized 2026-10-09T13:35:14.493316-07:00 edge-fr-1 app[30362]: INFO request_id=c24562ab3b2324ed method=GET path=/api/v2/orders status=200 duration=1345ms 2026-10-09T13:35:14.564634-07:00 cache-3 app[30073]: INFO worker 91 finished job b80eef0a31c67355 in 9560 ms 2026-10-09T13:35:14.588668-07:00 db-replica app[30838]: INFO order 67708 confirmed for sørensen in 3969 ms (region eu-west-1, queue orders) 2026-10-09T13:35:14.704443-07:00 api-08 app[30272]: INFO order 16188 confirmed for deploy in 7326 ms (region ap-northeast-1, queue emails) 2026-10-09T13:35:14.786393-07:00 cache-3 sshd[19290]: Received disconnect from 203.110.188.155 port 59811:11: Bye Bye [preauth] 2026-10-09T13:35:14.837900-07:00 api-07 systemd[1]: Starting Cleanup of Temporary Directories... 2026-10-09T13:35:14.913241-07:00 web-01 app[30734]: INFO worker 62 picked job 1993b63ece306269 from queue emails 2026-10-09T13:35:15.242952-07:00 db-replica app[30164]: INFO request_id=4a22638a54776da9 method=GET path=/.env status=404 duration=4920ms 2026-10-09T13:35:15.307123-07:00 db-replica sshd[12037]: pam_unix(sshd:session): session closed for user backup 2026-10-09T13:35:15.442553-07:00 cache-3 sshd[42732]: Invalid user root from 172.81.239.137 port 48831 2026-10-09T13:35:15.632992-07:00 bastion postgres[13006]: LOG: duration: 1963.939 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:15.928468-07:00 cache-3 app[30517]: INFO order 75364 confirmed for ci in 9313 ms (region ap-northeast-1, queue orders) 2026-10-09T13:35:15.941227-07:00 api-07 systemd[1]: session-43496.scope: Deactivated successfully. 2026-10-09T13:35:15.980368-07:00 db-replica nginx[1203]: 172.39.51.167 - - "GET /wp-login.php HTTP/1.1" 404 33519 "-" "kube-probe/1.31" 2026-10-09T13:35:16.166330-07:00 api-08 sshd[40928]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:35:16.492656-07:00 edge-fr-1 app[30972]: INFO worker 16 picked job effbdfe289e0b5ce from queue webhooks 2026-10-09T13:35:16.524432-07:00 cache-3 app[30435]: INFO request_id=bc6fecd278b0f061 method=GET path=/admin status=200 duration=9353ms 2026-10-09T13:35:16.552683-07:00 db-primary sshd[44458]: pam_unix(sshd:session): session opened for user müller(uid=8749) by (uid=0) 2026-10-09T13:35:16.763359-07:00 worker-12 sshd[2766]: Received disconnect from 172.241.81.168 port 14495:11: Bye Bye [preauth] 2026-10-09T13:35:16.847518-07:00 worker-12 sshd[53035]: Failed password for invalid user zoë from 172.121.92.118 port 50363 ssh2 2026-10-09T13:35:16.904969-07:00 bastion sshd[29779]: Connection closed by 203.29.91.20 port 6380 [preauth] 2026-10-09T13:35:16.925778-07:00 cache-3 systemd[1]: session-49521.scope: Deactivated successfully. 2026-10-09T13:35:16.931630-07:00 worker-12 nginx[1200]: 45.237.185.208 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 68078 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:17.171631-07:00 bastion nginx[1208]: 10.70.253.168 - - "GET /admin HTTP/1.1" 404 29855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:17.173720-07:00 web-03 app[30328]: INFO order 58290 confirmed for müller in 7304 ms (region us-east-1, queue invoices) 2026-10-09T13:35:17.369285-07:00 db-replica sshd[54311]: Failed password for invalid user ci from 192.97.133.126 port 8537 ssh2 2026-10-09T13:35:17.393071-07:00 web-01 haproxy[929]: 203.75.153.121:46274 [51666] http-in app/web-03 287/0/975/975/287 200 69875 - - ---- 584/584/38/38/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:35:17.440837-07:00 db-replica nginx[1209]: 192.24.147.32 - zoë "POST /api/v2/orders/8841 HTTP/1.1" 200 29962 "-" "curl/8.4.0" 2026-10-09T13:35:17.723113-07:00 bastion nginx[1208]: 203.202.102.221 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 39471 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:17.808461-07:00 web-02 app[30140]: INFO request_id=4151d8129d6709a2 method=GET path=/metrics status=404 duration=5260ms 2026-10-09T13:35:17.954243-07:00 cache-3 sshd[46595]: Connection closed by 203.69.66.252 port 57989 [preauth] 2026-10-09T13:35:17.979081-07:00 web-03 sshd[47400]: Received disconnect from 172.175.126.34 port 51044:11: Bye Bye [preauth] 2026-10-09T13:35:18.038177-07:00 web-02 app[30679]: INFO worker 80 finished job 9e3c968588a89266 in 1605 ms 2026-10-09T13:35:18.156282-07:00 web-01 sshd[5326]: Connection closed by 91.172.22.237 port 31999 [preauth] 2026-10-09T13:35:18.765784-07:00 api-08 sshd[64103]: Failed password for invalid user root from 91.219.71.151 port 46310 ssh2 2026-10-09T13:35:18.899625-07:00 db-replica nginx[1205]: 192.240.54.79 - priya "POST /api/v2/orders HTTP/1.1" 200 60802 "-" "curl/8.4.0" 2026-10-09T13:35:18.976557-07:00 db-primary kernel: [68369.394302] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.180.84.210 DST=10.0.932.932 LEN=31 TOS=0x00 PREC=0x00 TTL=31 ID=68369 DF PROTO=TCP SPT=15390 DPT=15390 WINDOW=68369 RES=0x00 SYN URGP=0 2026-10-09T13:35:18.983383-07:00 bastion nginx[1206]: 45.43.187.246 - backup "POST /favicon.ico HTTP/1.1" 200 88163 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:18.993825-07:00 db-replica nginx[1209]: 91.214.36.253 - - "GET /favicon.ico HTTP/1.1" 200 24873 "-" "Go-http-client/1.1" 2026-10-09T13:35:19.151873-07:00 api-08 haproxy[912]: 91.69.135.12:41886 [69182] http-in app/edge-fr-1 9218/0/545/545/9218 200 78126 - - ---- 510/510/17/17/0 0/0 "GET /favicon.ico HTTP/1.1" 2026-10-09T13:35:19.273923-07:00 db-replica app[30335]: INFO request_id=fdd0df07908aec6f method=GET path=/admin status=200 duration=75ms 2026-10-09T13:35:19.283374-07:00 cache-3 postgres[21722]: LOG: duration: 8206.584 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:19.463086-07:00 worker-12 sshd[45324]: Accepted publickey for root from 10.99.208.94 port 19126 ssh2: ED25519 SHA256:a3cbc2d40b8db062 2026-10-09T13:35:19.489498-07:00 web-02 postgres[17557]: LOG: duration: 2343.228 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:19.489675-07:00 web-01 sshd[23341]: pam_unix(sshd:session): session closed for user sørensen 2026-10-09T13:35:19.676095-07:00 api-07 app[30521]: INFO request_id=e6052128b55c800d method=GET path=/metrics status=200 duration=8372ms 2026-10-09T13:35:19.690447-07:00 api-07 cron[58890]: (backup) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:35:19.827738-07:00 worker-12 kernel: [49070.395389] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=91.118.135.177 DST=10.0.158.158 LEN=96 TOS=0x00 PREC=0x00 TTL=96 ID=49070 DF PROTO=TCP SPT=4302 DPT=4302 WINDOW=49070 RES=0x00 SYN URGP=0 2026-10-09T13:35:19.968667-07:00 cache-3 app[30350]: INFO request_id=8e0510cbbab638cf method=GET path=/admin status=200 duration=1507ms 2026-10-09T13:35:20.162262-07:00 api-08 haproxy[937]: 192.130.98.229:28259 [35139] http-in app/db-replica 880/0/659/659/880 200 56648 - - ---- 490/490/84/84/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:20.477195-07:00 cache-3 nginx[1207]: 172.32.180.48 - - "GET /.env HTTP/1.1" 404 16107 "-" "Go-http-client/1.1" 2026-10-09T13:35:20.601206-07:00 web-01 app[30346]: INFO request_id=d5079ae5a2aaaa2c method=GET path=/wp-login.php status=302 duration=6545ms 2026-10-09T13:35:20.667798-07:00 edge-fr-1 app[30757]: INFO worker 81 finished job 2d940eaa768b1796 in 1485 ms 2026-10-09T13:35:20.687382-07:00 api-08 app[30877]: INFO request_id=1388a8d06e7f438f method=GET path=/favicon.ico status=301 duration=7462ms 2026-10-09T13:35:20.758384-07:00 cache-3 postgres[23068]: LOG: duration: 857.259 ms statement: SELECT * FROM orders WHERE customer_id = 30862 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:20.784621-07:00 web-01 cron[24108]: (zoë) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:35:20.851588-07:00 web-02 sshd[19091]: Invalid user sørensen from 10.80.110.166 port 63635 2026-10-09T13:35:21.013926-07:00 db-primary sshd[40516]: Accepted publickey for deploy from 10.53.83.11 port 6080 ssh2: ED25519 SHA256:4654137b74ebaebf 2026-10-09T13:35:21.050914-07:00 edge-fr-1 app[30196]: INFO worker 83 finished job 6275c7ffd076ddb4 in 1306 ms 2026-10-09T13:35:21.249275-07:00 worker-12 kernel: [39652.961591] TCP: request_sock_TCP: Possible SYN flooding on port 4478. Sending cookies. Check SNMP counters. 2026-10-09T13:35:21.259824-07:00 worker-12 app[30887]: INFO request_id=b9485ca57aa6222a method=GET path=/api/v2/search?q=invoice status=200 duration=2690ms 2026-10-09T13:35:21.436010-07:00 worker-12 sshd[35744]: Accepted publickey for backup from 172.203.191.212 port 42411 ssh2: ED25519 SHA256:8e8db5904e344071 2026-10-09T13:35:21.442473-07:00 web-03 app[30698]: INFO order 92597 confirmed for sørensen in 6236 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:35:21.553565-07:00 api-08 app[30869]: INFO worker 49 picked job e39a1577218c3512 from queue orders 2026-10-09T13:35:21.583155-07:00 db-primary app[30784]: INFO request_id=603042ede5ffaae2 method=GET path=/favicon.ico status=200 duration=8123ms 2026-10-09T13:35:21.637238-07:00 edge-fr-1 app[30743]: INFO request_id=38c7b7af9d2eb3df method=GET path=/admin status=204 duration=2691ms 2026-10-09T13:35:21.674975-07:00 web-02 nginx[1202]: 91.245.144.94 - - "GET /wp-login.php HTTP/1.1" 404 15279 "-" "Go-http-client/1.1" 2026-10-09T13:35:22.082093-07:00 cache-3 nginx[1207]: 45.61.203.91 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 21091 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:22.131953-07:00 web-01 sshd[12825]: pam_unix(sshd:session): session opened for user root(uid=8831) by (uid=0) 2026-10-09T13:35:22.276015-07:00 worker-12 nginx[1208]: 45.209.182.49 - priya "POST /admin HTTP/1.1" 404 74296 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:22.343298-07:00 api-08 nginx[1206]: 172.19.73.153 - - "GET /admin HTTP/1.1" 200 25103 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:22.482724-07:00 db-replica audit: type=USER_LOGIN msg=audit(1791578122.925:45149): pid=45149 uid=0 auid=2965 ses=343 msg='op=login id=2965 exe="/usr/sbin/sshd" hostname=? addr=172.82.75.213 terminal=/dev/pts/0 res=success' 2026-10-09T13:35:22.520377-07:00 web-01 postgres[6642]: LOG: duration: 6273.621 ms statement: SELECT * FROM orders WHERE customer_id = 26446 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:22.622624-07:00 cache-3 nginx[1204]: 203.60.137.68 - - "GET /api/v2/users HTTP/1.1" 404 19555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:22.801921-07:00 bastion sshd[53018]: Connection closed by 10.2.34.201 port 42911 [preauth] 2026-10-09T13:35:22.946099-07:00 web-01 kubelet[800]: E1009 13:35:22.099240 6469 pod_workers.go:6469] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"api\" with CrashLoopBackOff" pod="default/api-9cd685c7c38466f2" 2026-10-09T13:35:22.969717-07:00 web-01 sshd[48455]: Connection closed by 10.86.151.58 port 31963 [preauth] 2026-10-09T13:35:23.071277-07:00 edge-fr-1 sshd[61226]: Accepted publickey for deploy from 91.133.202.217 port 45181 ssh2: ED25519 SHA256:f53f53889d24823a 2026-10-09T13:35:23.088857-07:00 api-08 app[30952]: INFO health check ok: db 243 ms, cache 243 ms, queue depth 49 2026-10-09T13:35:23.243660-07:00 web-02 postgres[23450]: LOG: duration: 8799.89 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:23.335967-07:00 worker-12 app[30889]: INFO worker 85 picked job 926b4f8940423ab4 from queue orders 2026-10-09T13:35:23.644528-07:00 api-08 kernel: [35370.818068] TCP: request_sock_TCP: Possible SYN flooding on port 12844. Sending cookies. Check SNMP counters. 2026-10-09T13:35:23.872134-07:00 api-07 haproxy[918]: 10.26.14.212:15446 [85687] http-in app/web-02 8351/0/666/666/8351 200 82964 - - ---- 881/881/46/46/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:35:23.925821-07:00 web-03 app[30156]: INFO worker 46 finished job 985b89663cad2d1d in 7318 ms 2026-10-09T13:35:23.939193-07:00 web-02 kernel: [82790.519726] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=192.152.249.23 DST=10.0.753.753 LEN=92 TOS=0x00 PREC=0x00 TTL=92 ID=82790 DF PROTO=TCP SPT=35051 DPT=35051 WINDOW=82790 RES=0x00 SYN URGP=0 2026-10-09T13:35:24.147404-07:00 edge-fr-1 haproxy[918]: 10.19.41.63:25942 [63549] http-in app/worker-12 6934/0/866/866/6934 404 36961 - - ---- 326/326/63/63/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:35:24.196068-07:00 web-03 nginx[1200]: 172.61.59.218 - - "GET /wp-login.php HTTP/1.1" 301 79074 "-" "python-requests/2.32.3" 2026-10-09T13:35:24.374673-07:00 cache-3 app[30472]: INFO worker 63 picked job 08f24b349bf60422 from queue emails 2026-10-09T13:35:24.473488-07:00 db-primary sshd[8395]: Failed password for invalid user zoë from 45.243.211.117 port 8848 ssh2 2026-10-09T13:35:24.560452-07:00 edge-fr-1 sshd[12082]: Connection closed by 91.2.130.196 port 62611 [preauth] 2026-10-09T13:35:24.715150-07:00 db-replica nginx[1201]: 203.162.11.140 - sørensen "POST /health HTTP/1.1" 301 75677 "-" "python-requests/2.32.3" 2026-10-09T13:35:24.887011-07:00 web-02 nginx[1201]: 45.74.54.54 - - "GET /api/v2/orders/8841 HTTP/1.1" 200 29800 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:25.115106-07:00 db-replica nginx[1202]: 91.233.59.37 - ci "POST /api/v2/orders HTTP/1.1" 301 37982 "-" "Go-http-client/1.1" 2026-10-09T13:35:25.203846-07:00 api-08 nginx[1208]: 91.234.191.30 - - "GET /api/v2/search?q=invoice HTTP/1.1" 401 21948 "-" "kube-probe/1.31" 2026-10-09T13:35:25.217371-07:00 web-03 app[30742]: INFO worker 22 picked job 5406e0996a0d3eb1 from queue webhooks 2026-10-09T13:35:25.376111-07:00 edge-fr-1 app[30666]: INFO health check ok: db 974 ms, cache 974 ms, queue depth 57 2026-10-09T13:35:25.394715-07:00 web-03 audit: type=USER_LOGIN msg=audit(1791578125.800:46060): pid=46060 uid=0 auid=2932 ses=154 msg='op=login id=2932 exe="/usr/sbin/sshd" hostname=? addr=91.124.206.204 terminal=/dev/pts/0 res=success' 2026-10-09T13:35:25.434609-07:00 web-03 app[30934]: INFO request_id=4c68a283c8f04ec1 method=GET path=/api/v2/orders status=401 duration=7434ms 2026-10-09T13:35:25.644681-07:00 bastion app[30657]: INFO order 72253 confirmed for sørensen in 3174 ms (region eu-west-1, queue invoices) 2026-10-09T13:35:25.719579-07:00 web-02 app[30441]: INFO worker 94 finished job 07e8c6f89dd59f7c in 3146 ms 2026-10-09T13:35:25.837749-07:00 bastion nginx[1207]: 45.188.96.136 - - "GET /login HTTP/1.1" 302 31383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:25.909528-07:00 cache-3 app[30313]: INFO order 62578 confirmed for ci in 5720 ms (region eu-west-1, queue invoices) 2026-10-09T13:35:26.136490-07:00 db-replica sshd[50518]: pam_unix(sshd:session): session opened for user deploy(uid=3953) by (uid=0) 2026-10-09T13:35:26.157624-07:00 web-01 app[30358]: INFO order 91043 confirmed for root in 292 ms (region ap-northeast-1, queue emails) 2026-10-09T13:35:26.256251-07:00 web-03 nginx[1210]: 172.116.244.185 - - "GET /static/main.css HTTP/1.1" 404 56227 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:26.312371-07:00 api-07 app[30271]: INFO order 98362 confirmed for müller in 9049 ms (region eu-west-1, queue invoices) 2026-10-09T13:35:26.359141-07:00 edge-fr-1 systemd[1]: session-98414.scope: Deactivated successfully. 2026-10-09T13:35:26.416435-07:00 web-02 postgres[13040]: ERROR: deadlock detected 2026-10-09T13:35:26.747048-07:00 web-01 systemd[1]: session-53615.scope: Deactivated successfully. 2026-10-09T13:35:26.943515-07:00 worker-12 sshd[48319]: Failed password for invalid user root from 91.50.189.200 port 30770 ssh2 2026-10-09T13:35:26.956772-07:00 web-02 app[30376]: INFO worker 90 picked job a099444bfea041db from queue emails 2026-10-09T13:35:27.170440-07:00 worker-12 nginx[1200]: 45.26.127.153 - françois "POST /favicon.ico HTTP/1.1" 404 64070 "-" "curl/8.4.0" 2026-10-09T13:35:27.173929-07:00 web-02 kubelet[800]: I1009 13:35:27.104156 2487 kubelet.go:2487] "Pod is terminating, skipping pod status update" pod="default/api-53a28c541ddba9ca" 2026-10-09T13:35:27.192237-07:00 web-03 app[30748]: INFO request_id=dcee21c975aff180 method=GET path=/admin status=502 duration=6451ms 2026-10-09T13:35:27.211698-07:00 cache-3 haproxy[906]: 203.41.76.245:56123 [76797] http-in app/web-03 4942/0/150/150/4942 502 64650 - - ---- 244/244/28/28/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:35:27.237448-07:00 cache-3 systemd[1]: session-35949.scope: Deactivated successfully. 2026-10-09T13:35:27.310093-07:00 db-replica nginx[1206]: 45.89.88.43 - - "GET /favicon.ico HTTP/1.1" 200 14299 "-" "python-requests/2.32.3" 2026-10-09T13:35:27.628118-07:00 api-08 app[30500]: INFO worker 52 picked job 890d1795efce7380 from queue webhooks 2026-10-09T13:35:27.664687-07:00 cache-3 app[30498]: INFO request_id=ec9ef087f9f070ab method=GET path=/static/app.js status=500 duration=4146ms 2026-10-09T13:35:27.851591-07:00 web-01 sshd[24089]: Accepted publickey for sørensen from 91.24.221.213 port 64969 ssh2: ED25519 SHA256:73b626805cb0551b 2026-10-09T13:35:27.879938-07:00 web-03 app[30015]: INFO worker 27 picked job 7546fbb0810d52a4 from queue emails 2026-10-09T13:35:27.953293-07:00 worker-12 app[30836]: INFO worker 13 finished job fe81a656dc3aae87 in 9390 ms 2026-10-09T13:35:27.960367-07:00 edge-fr-1 sshd[6962]: Accepted publickey for root from 172.225.28.230 port 35461 ssh2: ED25519 SHA256:6e137fa19c859e61 2026-10-09T13:35:27.994801-07:00 edge-fr-1 app[30767]: INFO worker 82 picked job 9f2fce7d56de1a01 from queue invoices 2026-10-09T13:35:28.104221-07:00 api-08 nginx[1205]: 172.55.62.109 - - "GET /favicon.ico HTTP/1.1" 401 7403 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:28.104406-07:00 worker-12 sshd[48827]: pam_unix(sshd:session): session closed for user ci 2026-10-09T13:35:28.310892-07:00 edge-fr-1 app[30307]: INFO worker 99 finished job 2513c5094379ea16 in 1323 ms 2026-10-09T13:35:28.477308-07:00 db-primary nginx[1204]: 172.176.122.228 - - "GET /api/v2/orders HTTP/1.1" 204 72872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:28.512276-07:00 web-02 app[30841]: INFO order 44409 confirmed for deploy in 1764 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:35:28.528522-07:00 worker-12 nginx[1201]: 45.216.13.49 - - "GET /login HTTP/1.1" 200 45073 "-" "kube-probe/1.31" 2026-10-09T13:35:28.586418-07:00 db-replica app[30457]: INFO worker 73 finished job ab0b91161c327613 in 5094 ms 2026-10-09T13:35:28.655807-07:00 cache-3 sshd[8364]: pam_unix(sshd:session): session opened for user root(uid=9342) by (uid=0) 2026-10-09T13:35:28.741697-07:00 db-replica app[30469]: INFO request_id=f4e7ddc1ea90f829 method=GET path=/static/app.js status=204 duration=3371ms 2026-10-09T13:35:28.757696-07:00 edge-fr-1 app[30277]: INFO worker 85 picked job bea8f782f2780c20 from queue emails 2026-10-09T13:35:28.892734-07:00 db-primary app[30208]: INFO request_id=ee682ac903bf4fb4 method=GET path=/static/app.js status=401 duration=4236ms 2026-10-09T13:35:29.372677-07:00 cache-3 postgres[12121]: LOG: duration: 9223.132 ms statement: SELECT * FROM orders WHERE customer_id = 74429 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:29.398879-07:00 cache-3 sshd[8754]: Failed password for invalid user müller from 172.189.185.8 port 12252 ssh2 2026-10-09T13:35:29.618079-07:00 cache-3 nginx[1208]: 192.113.209.84 - - "GET /api/v2/search?q=invoice HTTP/1.1" 200 57167 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:29.724185-07:00 web-02 sshd[16349]: pam_unix(sshd:session): session closed for user müller 2026-10-09T13:35:29.873978-07:00 worker-12 app[30882]: INFO worker 83 picked job ab14473841518f3f from queue webhooks 2026-10-09T13:35:29.956179-07:00 db-primary nginx[1200]: 10.56.255.36 - - "GET /admin HTTP/1.1" 502 49645 "-" "Go-http-client/1.1" 2026-10-09T13:35:30.273449-07:00 web-02 postgres[31892]: LOG: duration: 4043.941 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:30.274607-07:00 web-01 sshd[16233]: Connection closed by 10.122.215.246 port 5895 [preauth] 2026-10-09T13:35:30.413399-07:00 api-07 app[30242]: INFO request_id=f344ec2a14daef9b method=GET path=/.env status=200 duration=9463ms 2026-10-09T13:35:30.420766-07:00 web-02 nginx[1207]: 45.0.159.175 - root "POST /static/app.js HTTP/1.1" 204 7670 "-" "Go-http-client/1.1" 2026-10-09T13:35:30.528970-07:00 edge-fr-1 app[30923]: INFO order 52236 confirmed for müller in 5033 ms (region eu-west-1, queue webhooks) 2026-10-09T13:35:30.540355-07:00 api-07 app[30322]: INFO worker 79 finished job 6d0576def5970045 in 9788 ms 2026-10-09T13:35:30.644778-07:00 db-replica app[30335]: WARN retrying upstream 91.62.235.10:16629 after timeout (1249 ms), attempt 1 of 3 2026-10-09T13:35:30.840215-07:00 bastion haproxy[912]: 192.129.30.236:35611 [66975] http-in app/worker-12 3209/0/451/451/3209 200 74955 - - ---- 604/604/91/91/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:35:31.721309-07:00 api-08 sshd[24819]: Connection closed by 192.211.14.204 port 53455 [preauth] 2026-10-09T13:35:31.735073-07:00 api-07 sshd[35519]: Connection closed by 172.214.56.196 port 17795 [preauth] 2026-10-09T13:35:31.763850-07:00 api-08 sshd[36593]: Accepted publickey for backup from 192.165.149.140 port 13161 ssh2: ED25519 SHA256:04df1354e8fe263e 2026-10-09T13:35:31.779042-07:00 bastion app[30842]: INFO worker 46 finished job 77f346ea4e55d856 in 679 ms 2026-10-09T13:35:31.906588-07:00 bastion sshd[27767]: pam_unix(sshd:session): session opened for user akira(uid=1861) by (uid=0) 2026-10-09T13:35:32.043985-07:00 api-07 app[30001]: INFO request_id=b3f913b28e077846 method=GET path=/api/v2/orders status=302 duration=3985ms 2026-10-09T13:35:32.109833-07:00 web-03 app[30181]: INFO worker 87 picked job 6b0d49f502131e9d from queue orders 2026-10-09T13:35:32.349753-07:00 db-replica nginx[1203]: 45.210.214.6 - backup "POST /favicon.ico HTTP/1.1" 200 47003 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:32.401898-07:00 api-07 kernel: [89457.130612] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.142.14.124 DST=10.0.556.556 LEN=57 TOS=0x00 PREC=0x00 TTL=57 ID=89457 DF PROTO=TCP SPT=36064 DPT=36064 WINDOW=89457 RES=0x00 SYN URGP=0 2026-10-09T13:35:32.747386-07:00 db-primary postgres[5821]: LOG: duration: 4996.965 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:32.932747-07:00 db-primary app[30731]: INFO request_id=74910abf56fe101c method=GET path=/api/v2/orders/8841 status=204 duration=5608ms 2026-10-09T13:35:32.986295-07:00 web-03 app[30907]: INFO worker 78 finished job 4eb75c69ff6faf7d in 373 ms 2026-10-09T13:35:33.046722-07:00 cache-3 nginx[1209]: 203.74.35.40 - - "GET /.env HTTP/1.1" 204 5868 "-" "Go-http-client/1.1" 2026-10-09T13:35:33.066412-07:00 api-07 app[30530]: INFO request_id=9eae3664e574e4fc method=GET path=/health status=401 duration=4576ms 2026-10-09T13:35:33.166787-07:00 db-replica app[30974]: INFO worker 81 finished job e25da079fc2ee630 in 5203 ms 2026-10-09T13:35:33.178284-07:00 web-01 nginx[1208]: 203.5.171.87 - - "GET /wp-login.php HTTP/1.1" 200 8884 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:33.387334-07:00 api-07 sshd[17815]: Accepted publickey for root from 45.86.209.104 port 33297 ssh2: ED25519 SHA256:f14d7807268dcf41 2026-10-09T13:35:33.431839-07:00 web-02 sshd[16646]: Failed password for invalid user akira from 172.227.101.229 port 44604 ssh2 2026-10-09T13:35:33.463632-07:00 worker-12 sshd[5330]: Failed password for invalid user ci from 203.247.194.112 port 50051 ssh2 2026-10-09T13:35:33.618392-07:00 web-01 systemd[1]: Started Session 47898 of User akira. 2026-10-09T13:35:33.725305-07:00 bastion app[30025]: WARN retrying upstream 192.245.97.240:31858 after timeout (9316 ms), attempt 2 of 3 2026-10-09T13:35:34.009417-07:00 web-03 nginx[1205]: 91.56.229.206 - - "GET /.env HTTP/1.1" 500 74238 "-" "python-requests/2.32.3" 2026-10-09T13:35:34.530941-07:00 web-02 app[30463]: INFO request_id=983f7912796d0f54 method=GET path=/wp-login.php status=502 duration=1748ms 2026-10-09T13:35:34.644017-07:00 db-primary systemd[1]: Started Session 77761 of User backup. 2026-10-09T13:35:34.730662-07:00 bastion nginx[1210]: 45.251.135.215 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 9443 "-" "python-requests/2.32.3" 2026-10-09T13:35:34.794048-07:00 db-primary kernel: [98961.213445] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.136.158.160 DST=10.0.575.575 LEN=56 TOS=0x00 PREC=0x00 TTL=56 ID=98961 DF PROTO=TCP SPT=43214 DPT=43214 WINDOW=98961 RES=0x00 SYN URGP=0 2026-10-09T13:35:35.035974-07:00 web-03 haproxy[938]: 192.172.43.67:32333 [51946] http-in app/db-replica 6347/0/609/609/6347 502 14920 - - ---- 537/537/72/72/0 0/0 "GET /admin HTTP/1.1" 2026-10-09T13:35:35.045820-07:00 api-07 app[30794]: INFO worker 28 picked job 5144fa7427c0c82f from queue emails 2026-10-09T13:35:35.140820-07:00 api-08 sshd[41610]: Accepted publickey for deploy from 192.22.207.108 port 50408 ssh2: ED25519 SHA256:3ef1f0c140b0e46e 2026-10-09T13:35:35.186273-07:00 db-primary cron[2888]: (akira) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:35:35.257615-07:00 web-01 app[30328]: INFO health check ok: db 426 ms, cache 426 ms, queue depth 38 2026-10-09T13:35:35.271330-07:00 web-02 app[30208]: INFO worker 98 picked job 217a7d2f3ceed881 from queue orders 2026-10-09T13:35:35.505140-07:00 web-03 sshd[62404]: Invalid user ci from 45.215.84.34 port 42007 2026-10-09T13:35:35.572638-07:00 cache-3 postgres[24809]: LOG: duration: 1561.462 ms statement: SELECT * FROM orders WHERE customer_id = 22108 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:35.595849-07:00 cache-3 nginx[1204]: 172.94.77.104 - - "GET /api/v2/orders HTTP/1.1" 302 85310 "-" "curl/8.4.0" 2026-10-09T13:35:35.748278-07:00 web-03 sshd[61344]: pam_unix(sshd:session): session opened for user zoë(uid=4653) by (uid=0) 2026-10-09T13:35:35.774785-07:00 web-02 app[30990]: INFO order 37268 confirmed for ci in 2732 ms (region eu-west-1, queue emails) 2026-10-09T13:35:36.125274-07:00 api-07 postgres[10165]: LOG: duration: 9032.867 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:36.208924-07:00 db-primary nginx[1205]: 10.112.150.246 - backup "POST /metrics HTTP/1.1" 200 85633 "-" "kube-probe/1.31" 2026-10-09T13:35:36.247108-07:00 db-primary nginx[1206]: 192.88.145.85 - - "GET /api/v2/orders/8841 HTTP/1.1" 502 86155 "-" "python-requests/2.32.3" 2026-10-09T13:35:36.442274-07:00 edge-fr-1 sshd[63342]: Accepted publickey for ci from 172.240.72.175 port 37066 ssh2: ED25519 SHA256:4fc5ec021cc3a88e 2026-10-09T13:35:36.477641-07:00 cache-3 nginx[1201]: 45.60.113.31 - - "GET /wp-login.php HTTP/1.1" 404 36110 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:36.497287-07:00 web-01 app[30528]: INFO request_id=c8ddad34b655515d method=GET path=/metrics status=200 duration=3764ms 2026-10-09T13:35:36.680999-07:00 db-primary haproxy[948]: 172.112.89.130:2458 [37400] http-in app/web-01 8937/0/360/360/8937 200 77364 - - ---- 465/465/88/88/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:35:36.850644-07:00 db-primary app[30948]: INFO order 34085 confirmed for sørensen in 1639 ms (region ap-northeast-1, queue emails) 2026-10-09T13:35:36.891366-07:00 web-02 systemd[1]: session-24610.scope: Deactivated successfully. 2026-10-09T13:35:37.108436-07:00 worker-12 sshd[25557]: pam_unix(sshd:session): session closed for user root 2026-10-09T13:35:37.202812-07:00 db-replica app[30859]: INFO request_id=f31c7248659611bf method=GET path=/.env status=200 duration=3334ms 2026-10-09T13:35:37.245145-07:00 cache-3 nginx[1202]: 172.66.226.8 - sørensen "POST /wp-login.php HTTP/1.1" 401 48040 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:37.527958-07:00 bastion sshd[11770]: Failed password for invalid user priya from 45.188.182.242 port 28090 ssh2 2026-10-09T13:35:37.624771-07:00 web-03 app[30765]: INFO order 54311 confirmed for backup in 7639 ms (region eu-west-1, queue orders) 2026-10-09T13:35:37.677669-07:00 web-03 nginx[1210]: 10.158.18.151 - - "GET /health HTTP/1.1" 404 41614 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:37.700440-07:00 api-08 app[30539]: INFO order 38963 confirmed for müller in 9104 ms (region eu-west-1, queue webhooks) 2026-10-09T13:35:37.740964-07:00 cache-3 app[30923]: INFO request_id=7e50921c8fce3d2a method=GET path=/static/app.js status=502 duration=7401ms 2026-10-09T13:35:37.853710-07:00 web-02 nginx[1209]: 10.240.159.134 - - "GET /static/app.js HTTP/1.1" 204 1005 "-" "Go-http-client/1.1" 2026-10-09T13:35:38.067786-07:00 web-02 app[30602]: INFO worker 25 finished job 9d43acbf0b6c244a in 3035 ms 2026-10-09T13:35:38.103321-07:00 web-02 app[30798]: INFO order 10045 confirmed for akira in 5958 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:35:38.329179-07:00 web-01 systemd[1]: Started Session 12391 of User priya. 2026-10-09T13:35:38.475117-07:00 bastion dockerd[700]: time="2026-10-09T13:35:38.475117-07:00" level=info msg="Container a7520298ba35f4c7 exited with code 0" 2026-10-09T13:35:38.487738-07:00 web-02 app[30749]: DEBUG cache hit ratio 58% over the last minute (32424 lookups) 2026-10-09T13:35:38.581613-07:00 worker-12 app[30640]: INFO order 40047 confirmed for françois in 2933 ms (region ap-northeast-1, queue webhooks) 2026-10-09T13:35:38.617420-07:00 bastion kernel: [91019.566722] TCP: request_sock_TCP: Possible SYN flooding on port 27481. Sending cookies. Check SNMP counters. 2026-10-09T13:35:38.885829-07:00 db-replica app[30887]: INFO health check ok: db 785 ms, cache 785 ms, queue depth 69 2026-10-09T13:35:38.998038-07:00 web-03 cron[57060]: (deploy) CMD (/usr/lib/sysstat/sa1 1 1) 2026-10-09T13:35:39.165520-07:00 worker-12 app[30991]: INFO order 68272 confirmed for françois in 6704 ms (region ap-northeast-1, queue invoices) 2026-10-09T13:35:39.210713-07:00 db-primary app[30969]: INFO request_id=7b2fa6a021ca8bcf method=GET path=/api/v2/users status=200 duration=9066ms 2026-10-09T13:35:39.537788-07:00 web-03 haproxy[904]: 192.251.57.130:43765 [80637] http-in app/web-03 7467/0/152/152/7467 204 6170 - - ---- 220/220/92/92/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:39.649558-07:00 web-03 haproxy[926]: 91.221.23.150:49457 [23242] http-in app/web-02 7240/0/663/663/7240 200 51524 - - ---- 702/702/59/59/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:35:39.700952-07:00 web-03 app[30053]: INFO order 21607 confirmed for müller in 8265 ms (region us-east-1, queue invoices) 2026-10-09T13:35:40.035679-07:00 bastion app[30317]: INFO worker 87 finished job c4e073e1595d328a in 7801 ms 2026-10-09T13:35:40.080542-07:00 edge-fr-1 app[30021]: INFO worker 64 picked job 0ec3d5691f2e54ec from queue invoices 2026-10-09T13:35:40.206431-07:00 edge-fr-1 app[30353]: INFO request_id=4fce82c6c536c465 method=GET path=/static/main.css status=301 duration=6044ms 2026-10-09T13:35:40.345313-07:00 api-07 cron[37606]: (akira) CMD (/usr/bin/backup --quiet --target /srv/akira) 2026-10-09T13:35:40.453392-07:00 web-02 nginx[1205]: 91.234.201.159 - müller "POST /health HTTP/1.1" 301 33600 "-" "curl/8.4.0" 2026-10-09T13:35:40.483386-07:00 api-08 systemd[1]: session-43517.scope: Deactivated successfully. 2026-10-09T13:35:40.539443-07:00 worker-12 audit: type=USER_LOGIN msg=audit(1791578140.95:93981): pid=93981 uid=0 auid=8845 ses=854 msg='op=login id=8845 exe="/usr/sbin/sshd" hostname=? addr=203.149.110.240 terminal=/dev/pts/0 res=success' 2026-10-09T13:35:40.581710-07:00 bastion app[30027]: INFO worker 98 finished job 97c65ee2a2391694 in 3048 ms 2026-10-09T13:35:40.711381-07:00 worker-12 systemd[1]: session-59297.scope: Deactivated successfully. 2026-10-09T13:35:40.728565-07:00 web-03 sshd[19880]: Invalid user deploy from 91.54.50.71 port 21202 2026-10-09T13:35:40.749335-07:00 api-08 app[30041]: DEBUG cache hit ratio 46% over the last minute (47666 lookups) 2026-10-09T13:35:40.913129-07:00 api-08 haproxy[924]: 10.184.134.242:54688 [69387] http-in app/edge-fr-1 1940/0/715/715/1940 404 52814 - - ---- 778/778/30/30/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:40.937145-07:00 worker-12 sshd[2325]: Connection closed by 172.170.223.55 port 35516 [preauth] 2026-10-09T13:35:41.029887-07:00 web-02 haproxy[947]: 45.185.189.169:54365 [67192] http-in app/worker-12 6334/0/28/28/6334 200 39361 - - ---- 638/638/49/49/0 0/0 "GET /api/v2/orders HTTP/1.1" 2026-10-09T13:35:41.346025-07:00 bastion nginx[1207]: 172.66.97.111 - - "GET /static/main.css HTTP/1.1" 502 75321 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:41.459139-07:00 web-02 systemd[1]: Started Session 51710 of User zoë. 2026-10-09T13:35:41.859114-07:00 api-08 sshd[12584]: Failed password for invalid user sørensen from 91.214.34.63 port 46606 ssh2 2026-10-09T13:35:41.960521-07:00 cache-3 postgres[10273]: LOG: duration: 9329.688 ms statement: SELECT * FROM orders WHERE customer_id = 91832 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:41.987724-07:00 web-02 app[30816]: INFO health check ok: db 524 ms, cache 524 ms, queue depth 18 2026-10-09T13:35:42.006005-07:00 db-replica nginx[1208]: 192.67.233.213 - - "GET /admin HTTP/1.1" 204 59766 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:42.442304-07:00 web-01 nginx[1208]: 172.93.221.238 - - "GET /login HTTP/1.1" 200 34540 "-" "kube-probe/1.31" 2026-10-09T13:35:42.495634-07:00 db-replica kernel: [58215.531256] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.231.60.97 DST=10.0.598.598 LEN=58 TOS=0x00 PREC=0x00 TTL=58 ID=58215 DF PROTO=TCP SPT=9198 DPT=9198 WINDOW=58215 RES=0x00 SYN URGP=0 2026-10-09T13:35:42.525392-07:00 cache-3 sshd[63866]: Received disconnect from 172.125.160.168 port 15936:11: Bye Bye [preauth] 2026-10-09T13:35:42.881491-07:00 bastion cron[39440]: (müller) CMD (/usr/bin/backup --quiet --target /srv/müller) 2026-10-09T13:35:43.237157-07:00 worker-12 app[30950]: INFO request_id=c8258a76a4ca56c7 method=GET path=/static/main.css status=301 duration=2480ms 2026-10-09T13:35:43.343929-07:00 db-replica sshd[39710]: Connection closed by 172.92.200.203 port 28839 [preauth] 2026-10-09T13:35:43.350410-07:00 worker-12 app[30964]: WARN retrying upstream 45.34.162.151:27697 after timeout (9757 ms), attempt 1 of 3 2026-10-09T13:35:43.691796-07:00 api-07 nginx[1204]: 10.58.1.18 - - "GET /api/v2/users HTTP/1.1" 204 12062 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:43.771645-07:00 web-02 nginx[1200]: 45.138.159.99 - - "GET /wp-login.php HTTP/1.1" 200 7536 "-" "kube-probe/1.31" 2026-10-09T13:35:43.794648-07:00 db-replica nginx[1205]: 45.99.35.143 - - "GET /static/main.css HTTP/1.1" 401 54322 "-" "python-requests/2.32.3" 2026-10-09T13:35:43.830145-07:00 api-07 nginx[1202]: 172.76.116.69 - - "GET /api/v2/orders HTTP/1.1" 204 10251 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:43.837242-07:00 api-08 app[30235]: WARN slow query (2617 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '30 minutes' 2026-10-09T13:35:43.954501-07:00 edge-fr-1 postgres[13844]: LOG: duration: 9538.634 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:43.986202-07:00 worker-12 app[30631]: INFO request_id=8ba875861c9c2711 method=GET path=/api/v2/users status=204 duration=5997ms 2026-10-09T13:35:44.235710-07:00 api-07 app[30371]: DEBUG cache hit ratio 53% over the last minute (85298 lookups) 2026-10-09T13:35:44.330920-07:00 edge-fr-1 sshd[64146]: Invalid user akira from 192.126.231.158 port 54680 2026-10-09T13:35:44.473779-07:00 api-07 nginx[1205]: 10.206.162.224 - - "GET /.env HTTP/1.1" 302 20711 "-" "kube-probe/1.31" 2026-10-09T13:35:44.549634-07:00 edge-fr-1 sshd[31628]: Connection closed by 172.238.143.187 port 8199 [preauth] 2026-10-09T13:35:44.768708-07:00 db-replica app[30888]: DEBUG cache hit ratio 14% over the last minute (57615 lookups) 2026-10-09T13:35:44.945928-07:00 web-01 app[30689]: INFO health check ok: db 179 ms, cache 179 ms, queue depth 37 2026-10-09T13:35:44.983016-07:00 web-01 nginx[1200]: 203.176.249.43 - müller "POST /.env HTTP/1.1" 302 35683 "-" "curl/8.4.0" 2026-10-09T13:35:45.027099-07:00 edge-fr-1 app[30307]: WARN slow query (23 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '95 minutes' 2026-10-09T13:35:45.741481-07:00 bastion audit: type=USER_LOGIN msg=audit(1791578145.505:40882): pid=40882 uid=0 auid=4140 ses=764 msg='op=login id=4140 exe="/usr/sbin/sshd" hostname=? addr=91.106.179.38 terminal=/dev/pts/0 res=success' 2026-10-09T13:35:46.438093-07:00 api-08 app[30177]: INFO request_id=eb9a7ebedd8e1800 method=GET path=/login status=200 duration=8432ms 2026-10-09T13:35:46.645023-07:00 web-02 app[30227]: INFO order 71476 confirmed for priya in 5359 ms (region eu-west-1, queue webhooks) 2026-10-09T13:35:46.901689-07:00 db-primary haproxy[938]: 203.6.174.96:63879 [58705] http-in app/web-01 832/0/608/608/832 200 29667 - - ---- 901/901/45/45/0 0/0 "GET /api/v2/orders/8841 HTTP/1.1" 2026-10-09T13:35:47.045070-07:00 edge-fr-1 sshd[56118]: pam_unix(sshd:session): session opened for user françois(uid=7391) by (uid=0) 2026-10-09T13:35:47.172440-07:00 db-primary app[30309]: INFO request_id=e3da56bb01fa7594 method=GET path=/api/v2/users status=502 duration=6144ms 2026-10-09T13:35:47.245418-07:00 cache-3 app[30221]: INFO request_id=6e8a9fb272f6e10a method=GET path=/admin status=404 duration=1139ms 2026-10-09T13:35:47.359410-07:00 db-primary nginx[1201]: 203.179.184.95 - - "GET /health HTTP/1.1" 200 19552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:47.422181-07:00 worker-12 app[30905]: INFO health check ok: db 461 ms, cache 461 ms, queue depth 87 2026-10-09T13:35:47.433550-07:00 cache-3 app[30208]: INFO health check ok: db 422 ms, cache 422 ms, queue depth 48 2026-10-09T13:35:47.488989-07:00 web-01 nginx[1204]: 91.19.180.78 - - "GET /health HTTP/1.1" 200 59268 "-" "python-requests/2.32.3" 2026-10-09T13:35:47.585668-07:00 web-03 haproxy[941]: 91.96.169.221:34766 [96147] http-in app/worker-12 8651/0/839/839/8651 204 60872 - - ---- 521/521/81/81/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:35:47.635294-07:00 worker-12 app[30620]: INFO health check ok: db 640 ms, cache 640 ms, queue depth 84 2026-10-09T13:35:47.657814-07:00 web-03 haproxy[925]: 172.174.254.31:1133 [90941] http-in app/web-02 8609/0/774/774/8609 200 85891 - - ---- 699/699/81/81/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:47.730583-07:00 bastion haproxy[934]: 172.180.218.249:6567 [68789] http-in app/cache-3 8513/0/94/94/8513 502 29920 - - ---- 674/674/61/61/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:35:47.736183-07:00 edge-fr-1 nginx[1209]: 192.194.178.71 - - "GET /wp-login.php HTTP/1.1" 200 18115 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:47.931315-07:00 worker-12 app[30349]: INFO health check ok: db 835 ms, cache 835 ms, queue depth 95 2026-10-09T13:35:47.942048-07:00 web-03 postgres[6340]: LOG: duration: 4446.765 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:48.156961-07:00 edge-fr-1 nginx[1202]: 91.169.92.23 - - "GET /.env HTTP/1.1" 200 40462 "-" "Go-http-client/1.1" 2026-10-09T13:35:48.159118-07:00 worker-12 systemd[1]: session-39939.scope: Deactivated successfully. 2026-10-09T13:35:48.268632-07:00 db-primary systemd[1]: Started Session 12595 of User deploy. 2026-10-09T13:35:48.469597-07:00 bastion sshd[2743]: Connection closed by 172.20.111.252 port 47219 [preauth] 2026-10-09T13:35:48.719612-07:00 db-primary app[30677]: INFO request_id=3698cb94c1173293 method=GET path=/health status=500 duration=3228ms 2026-10-09T13:35:48.779714-07:00 cache-3 app[30562]: INFO order 18946 confirmed for sørensen in 7015 ms (region ap-northeast-1, queue orders) 2026-10-09T13:35:48.810299-07:00 web-03 haproxy[904]: 45.120.54.3:52859 [53452] http-in app/edge-fr-1 8643/0/383/383/8643 204 45075 - - ---- 581/581/65/65/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:48.829227-07:00 api-08 app[30359]: INFO order 89369 confirmed for akira in 7759 ms (region ap-northeast-1, queue orders) 2026-10-09T13:35:49.005266-07:00 edge-fr-1 app[30234]: INFO request_id=8c69ddb303787a28 method=GET path=/favicon.ico status=200 duration=2153ms 2026-10-09T13:35:49.018247-07:00 cache-3 sshd[10417]: Failed password for invalid user backup from 10.33.94.210 port 35820 ssh2 2026-10-09T13:35:49.203447-07:00 worker-12 nginx[1209]: 10.238.13.123 - - "GET /admin HTTP/1.1" 302 49300 "-" "curl/8.4.0" 2026-10-09T13:35:49.342268-07:00 cache-3 app[30993]: INFO worker 66 picked job 01a3a61d358fa6b9 from queue emails 2026-10-09T13:35:49.621169-07:00 bastion nginx[1204]: 192.249.117.214 - - "GET /static/main.css HTTP/1.1" 502 2909 "-" "Go-http-client/1.1" 2026-10-09T13:35:49.685540-07:00 bastion nginx[1208]: 10.7.81.70 - - "GET /wp-login.php HTTP/1.1" 500 35808 "-" "python-requests/2.32.3" 2026-10-09T13:35:49.805090-07:00 db-primary app[30242]: INFO worker 14 finished job 2b6663f7681b2587 in 301 ms 2026-10-09T13:35:50.029286-07:00 api-07 app[30491]: WARN retrying upstream 10.21.154.93:11372 after timeout (4561 ms), attempt 3 of 3 2026-10-09T13:35:50.279248-07:00 edge-fr-1 sshd[24304]: Accepted publickey for sørensen from 172.21.151.199 port 46290 ssh2: ED25519 SHA256:4c4366e7f554d7bf 2026-10-09T13:35:50.351447-07:00 web-02 sshd[42883]: Connection closed by 10.28.16.160 port 17366 [preauth] 2026-10-09T13:35:50.355480-07:00 api-08 nginx[1204]: 91.164.129.66 - backup "POST /login HTTP/1.1" 502 5085 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:50.468720-07:00 db-primary kernel: [36287.394686] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.122.207.2 DST=10.0.423.423 LEN=88 TOS=0x00 PREC=0x00 TTL=88 ID=36287 DF PROTO=TCP SPT=15046 DPT=15046 WINDOW=36287 RES=0x00 SYN URGP=0 2026-10-09T13:35:50.474348-07:00 db-primary app[30858]: INFO worker 37 picked job c7af5463f809b9a7 from queue orders 2026-10-09T13:35:50.514314-07:00 cache-3 nginx[1205]: 192.122.76.31 - françois "POST /admin HTTP/1.1" 200 57038 "-" "curl/8.4.0" 2026-10-09T13:35:50.664465-07:00 web-02 app[30243]: INFO health check ok: db 195 ms, cache 195 ms, queue depth 30 2026-10-09T13:35:50.828315-07:00 db-primary cron[48938]: (müller) CMD (/usr/bin/backup --quiet --target /srv/müller) 2026-10-09T13:35:50.942431-07:00 bastion app[30792]: INFO request_id=66c83ab6b0be39ab method=GET path=/api/v2/orders status=401 duration=7489ms 2026-10-09T13:35:50.964401-07:00 api-07 app[30157]: INFO worker 40 picked job e9ed3d19ca16e157 from queue emails 2026-10-09T13:35:51.158345-07:00 web-01 app[30683]: INFO health check ok: db 552 ms, cache 552 ms, queue depth 54 2026-10-09T13:35:51.172707-07:00 api-08 app[30759]: INFO worker 32 picked job c925478624bc2358 from queue webhooks 2026-10-09T13:35:51.208031-07:00 api-07 nginx[1206]: 192.79.160.104 - - "GET /health HTTP/1.1" 502 37448 "-" "curl/8.4.0" 2026-10-09T13:35:51.249288-07:00 web-03 app[30229]: WARN slow query (5247 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '27 minutes' 2026-10-09T13:35:51.251639-07:00 worker-12 nginx[1202]: 172.195.163.8 - zoë "POST /admin HTTP/1.1" 502 35052 "-" "Go-http-client/1.1" 2026-10-09T13:35:51.322038-07:00 api-07 sshd[20239]: Accepted publickey for root from 192.77.60.215 port 41394 ssh2: ED25519 SHA256:756c94c27205ce27 2026-10-09T13:35:51.328541-07:00 cache-3 kernel: [81657.512379] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.29.1.86 DST=10.0.692.692 LEN=30 TOS=0x00 PREC=0x00 TTL=30 ID=81657 DF PROTO=TCP SPT=54247 DPT=54247 WINDOW=81657 RES=0x00 SYN URGP=0 2026-10-09T13:35:51.540179-07:00 edge-fr-1 app[30195]: INFO order 74896 confirmed for akira in 6166 ms (region us-east-1, queue webhooks) 2026-10-09T13:35:51.678904-07:00 web-03 postgres[31958]: LOG: duration: 5058.114 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:51.724410-07:00 web-03 haproxy[944]: 10.35.197.206:45043 [14627] http-in app/api-08 9311/0/352/352/9311 200 87837 - - ---- 395/395/69/69/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:35:51.917981-07:00 web-03 dockerd[700]: time="2026-10-09T13:35:51.917981-07:00" level=info msg="Container 5020204a7f1e7f8b exited with code 0" 2026-10-09T13:35:51.949549-07:00 edge-fr-1 haproxy[904]: 10.29.118.229:8326 [54669] http-in app/web-03 5508/0/321/321/5508 200 60588 - - ---- 162/162/20/20/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:51.952610-07:00 cache-3 haproxy[935]: 91.224.252.229:53468 [96307] http-in app/db-replica 8531/0/436/436/8531 200 17545 - - ---- 745/745/40/40/0 0/0 "GET /api/v2/users HTTP/1.1" 2026-10-09T13:35:51.963148-07:00 web-03 app[30935]: INFO request_id=52d6adc4adb16450 method=GET path=/.env status=500 duration=1039ms 2026-10-09T13:35:52.303581-07:00 cache-3 app[30823]: INFO order 77673 confirmed for backup in 1536 ms (region us-east-1, queue emails) 2026-10-09T13:35:52.319030-07:00 edge-fr-1 sshd[28173]: Failed password for invalid user root from 45.77.248.240 port 33689 ssh2 2026-10-09T13:35:52.515626-07:00 bastion app[30001]: INFO worker 96 picked job dba8c701a26333af from queue webhooks 2026-10-09T13:35:52.546399-07:00 cache-3 haproxy[943]: 10.23.209.194:10688 [26921] http-in app/worker-12 6428/0/261/261/6428 500 19364 - - ---- 334/334/16/16/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:52.733427-07:00 web-03 kernel: [98978.163922] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.110.178.140 DST=10.0.252.252 LEN=29 TOS=0x00 PREC=0x00 TTL=29 ID=98978 DF PROTO=TCP SPT=36406 DPT=36406 WINDOW=98978 RES=0x00 SYN URGP=0 2026-10-09T13:35:52.735581-07:00 api-07 nginx[1209]: 192.30.125.166 - - "GET /health HTTP/1.1" 200 27806 "-" "curl/8.4.0" 2026-10-09T13:35:52.836629-07:00 api-08 app[30875]: INFO worker 73 picked job 69e7076b6fa8b2c1 from queue webhooks 2026-10-09T13:35:52.842911-07:00 cache-3 app[30191]: WARN slow query (6348 ms): SELECT count(*) FROM events WHERE created_at > now() - interval '82 minutes' 2026-10-09T13:35:52.930156-07:00 edge-fr-1 postgres[24034]: LOG: duration: 2242.646 ms execute : UPDATE sessions SET last_seen = now() WHERE id = $1 2026-10-09T13:35:52.968546-07:00 web-02 app[30723]: INFO order 65982 confirmed for deploy in 5991 ms (region eu-west-1, queue webhooks) 2026-10-09T13:35:53.059376-07:00 db-primary app[30260]: INFO order 37328 confirmed for françois in 513 ms (region eu-west-1, queue webhooks) 2026-10-09T13:35:53.192327-07:00 web-03 nginx[1200]: 10.211.253.166 - - "GET /api/v2/orders/8841 HTTP/1.1" 404 46685 "-" "Go-http-client/1.1" 2026-10-09T13:35:53.418718-07:00 db-primary app[30279]: INFO worker 23 finished job 732fcd3cd12b039a in 9746 ms 2026-10-09T13:35:54.046650-07:00 web-02 nginx[1206]: 192.67.132.41 - - "GET /health HTTP/1.1" 200 56274 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 Safari/605.1.15" 2026-10-09T13:35:54.570532-07:00 web-02 app[30121]: INFO request_id=2c3f9f1332dff389 method=GET path=/static/main.css status=404 duration=1597ms 2026-10-09T13:35:54.595978-07:00 web-01 postgres[19670]: LOG: duration: 4447.294 ms statement: SELECT * FROM orders WHERE customer_id = 70142 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:54.700651-07:00 web-02 cron[47033]: (priya) CMD (/usr/bin/backup --quiet --target /srv/priya) 2026-10-09T13:35:54.738798-07:00 db-primary kernel: [64760.440447] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=172.186.112.210 DST=10.0.640.640 LEN=93 TOS=0x00 PREC=0x00 TTL=93 ID=64760 DF PROTO=TCP SPT=58668 DPT=58668 WINDOW=64760 RES=0x00 SYN URGP=0 2026-10-09T13:35:54.853763-07:00 worker-12 haproxy[943]: 10.165.87.173:52499 [88698] http-in app/cache-3 5095/0/697/697/5095 404 26492 - - ---- 827/827/44/44/0 0/0 "GET /health HTTP/1.1" 2026-10-09T13:35:54.962624-07:00 web-02 haproxy[915]: 45.229.224.67:26239 [26068] http-in app/worker-12 16/0/767/767/16 200 56211 - - ---- 858/858/10/10/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:54.978530-07:00 web-02 systemd[1]: Started Session 40029 of User root. 2026-10-09T13:35:55.099541-07:00 db-primary app[30047]: INFO request_id=7d92d2c91790a137 method=GET path=/.env status=404 duration=4147ms 2026-10-09T13:35:55.105156-07:00 worker-12 app[30502]: DEBUG cache hit ratio 51% over the last minute (47694 lookups) 2026-10-09T13:35:55.112980-07:00 web-02 kernel: [41812.871775] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=45.36.123.232 DST=10.0.902.902 LEN=38 TOS=0x00 PREC=0x00 TTL=38 ID=41812 DF PROTO=TCP SPT=8384 DPT=8384 WINDOW=41812 RES=0x00 SYN URGP=0 2026-10-09T13:35:55.373716-07:00 api-08 nginx[1209]: 45.137.13.143 - - "GET /.env HTTP/1.1" 301 63796 "-" "kube-probe/1.31" 2026-10-09T13:35:55.400230-07:00 worker-12 sshd[15468]: pam_unix(sshd:session): session closed for user deploy 2026-10-09T13:35:55.473229-07:00 db-primary nginx[1208]: 10.109.41.41 - backup "POST /health HTTP/1.1" 204 67841 "-" "python-requests/2.32.3" 2026-10-09T13:35:55.938732-07:00 db-replica app[30641]: INFO worker 70 finished job f5aeeca56e33d580 in 6163 ms 2026-10-09T13:35:56.012158-07:00 api-07 app[30194]: INFO worker 18 picked job 3eacc406f93eee86 from queue emails 2026-10-09T13:35:56.087540-07:00 worker-12 haproxy[931]: 91.148.31.184:48142 [58657] http-in app/db-primary 496/0/605/605/496 404 48142 - - ---- 823/823/14/14/0 0/0 "GET /static/app.js HTTP/1.1" 2026-10-09T13:35:56.112060-07:00 cache-3 app[30701]: INFO request_id=033b1443bc0b1f05 method=GET path=/static/app.js status=200 duration=5789ms 2026-10-09T13:35:56.263793-07:00 web-03 sshd[54439]: Failed password for invalid user zoë from 203.133.225.22 port 3820 ssh2 2026-10-09T13:35:56.292535-07:00 web-01 app[30289]: INFO worker 82 picked job 5b2eeeb72b45afac from queue orders 2026-10-09T13:35:56.369076-07:00 cache-3 kernel: [63039.052564] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=10.246.220.56 DST=10.0.216.216 LEN=76 TOS=0x00 PREC=0x00 TTL=76 ID=63039 DF PROTO=TCP SPT=59593 DPT=59593 WINDOW=63039 RES=0x00 SYN URGP=0 2026-10-09T13:35:56.634844-07:00 worker-12 haproxy[925]: 203.59.77.214:58945 [34065] http-in app/api-07 2112/0/991/991/2112 200 66862 - - ---- 533/533/47/47/0 0/0 "GET /.env HTTP/1.1" 2026-10-09T13:35:56.826735-07:00 worker-12 systemd[1]: session-67456.scope: Deactivated successfully. 2026-10-09T13:35:56.927695-07:00 edge-fr-1 sshd[4967]: Failed password for invalid user akira from 172.54.16.70 port 50432 ssh2 2026-10-09T13:35:56.976760-07:00 worker-12 nginx[1206]: 45.170.67.121 - - "GET /api/v2/search?q=invoice HTTP/1.1" 404 44434 "-" "Go-http-client/1.1" 2026-10-09T13:35:57.235376-07:00 edge-fr-1 sshd[26924]: Invalid user françois from 10.141.7.236 port 48983 2026-10-09T13:35:57.405142-07:00 web-03 haproxy[925]: 45.106.66.57:49906 [80856] http-in app/api-08 8744/0/971/971/8744 200 21611 - - ---- 751/751/82/82/0 0/0 "GET /api/v2/search?q=invoice HTTP/1.1" 2026-10-09T13:35:57.643919-07:00 api-07 systemd[1]: Started Session 63204 of User root. 2026-10-09T13:35:57.670696-07:00 db-primary sshd[6599]: Accepted publickey for deploy from 91.35.249.10 port 25460 ssh2: ED25519 SHA256:9061249b333c3535 2026-10-09T13:35:57.835726-07:00 cache-3 app[30678]: INFO worker 50 picked job 039c0ebcaba5c6bd from queue webhooks 2026-10-09T13:35:57.891813-07:00 web-03 nginx[1208]: 203.232.162.198 - - "GET /static/app.js HTTP/1.1" 404 43246 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:57.905718-07:00 db-primary haproxy[932]: 192.235.159.159:31604 [80916] http-in app/web-02 4975/0/592/592/4975 502 22242 - - ---- 193/193/64/64/0 0/0 "GET /login HTTP/1.1" 2026-10-09T13:35:58.053602-07:00 api-07 postgres[13336]: LOG: duration: 1463.677 ms statement: SELECT * FROM orders WHERE customer_id = 37801 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:58.254467-07:00 web-02 nginx[1207]: 172.136.229.17 - akira "POST /health HTTP/1.1" 302 22754 "-" "kube-probe/1.31" 2026-10-09T13:35:58.299194-07:00 api-07 postgres[26458]: LOG: checkpoint complete: wrote 1461 buffers (32%); 0 WAL file(s) added, 0 removed, 57 recycled; write=3432.826 s, sync=0.826 s, total=3432.826 s 2026-10-09T13:35:58.373334-07:00 db-primary kernel: [87917.391618] IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:c0:a8:00:01:08:00 SRC=203.207.234.76 DST=10.0.753.753 LEN=71 TOS=0x00 PREC=0x00 TTL=71 ID=87917 DF PROTO=TCP SPT=64859 DPT=64859 WINDOW=87917 RES=0x00 SYN URGP=0 2026-10-09T13:35:58.509224-07:00 bastion sshd[56446]: Invalid user zoë from 172.39.175.174 port 33788 2026-10-09T13:35:58.514539-07:00 web-03 systemd[1]: Started Session 90379 of User priya. 2026-10-09T13:35:58.523022-07:00 web-02 systemd[1]: session-33347.scope: Deactivated successfully. 2026-10-09T13:35:58.538781-07:00 web-03 postgres[3993]: LOG: duration: 9101.934 ms statement: SELECT * FROM orders WHERE customer_id = 27295 ORDER BY created_at DESC LIMIT 50 2026-10-09T13:35:58.783949-07:00 api-08 haproxy[939]: 203.196.99.233:22827 [66068] http-in app/cache-3 7937/0/540/540/7937 301 70613 - - ---- 159/159/71/71/0 0/0 "GET /wp-login.php HTTP/1.1" 2026-10-09T13:35:58.860711-07:00 bastion sshd[27711]: pam_unix(sshd:session): session closed for user priya 2026-10-09T13:35:58.982657-07:00 worker-12 app[30183]: INFO request_id=8c86f86cf40c57f5 method=GET path=/favicon.ico status=200 duration=1365ms 2026-10-09T13:35:59.043996-07:00 cache-3 app[30090]: INFO worker 30 finished job 9c3e957021cb2282 in 9359 ms 2026-10-09T13:35:59.296478-07:00 web-02 systemd[1]: session-30396.scope: Deactivated successfully. 2026-10-09T13:35:59.317879-07:00 db-replica app[30941]: INFO health check ok: db 523 ms, cache 523 ms, queue depth 70 2026-10-09T13:35:59.322640-07:00 web-01 app[30693]: INFO request_id=39ae905f63a70d9e method=GET path=/admin status=200 duration=6270ms 2026-10-09T13:35:59.407711-07:00 web-01 haproxy[914]: Server app/api-07 is UP, reason: Layer7 check passed, code: 200, check duration: 601ms. 61 active and 0 backup servers online. 0 sessions requeued, 0 total in queue. 2026-10-09T13:35:59.463951-07:00 api-08 sshd[37130]: pam_unix(sshd:session): session opened for user akira(uid=5032) by (uid=0) 2026-10-09T13:35:59.527404-07:00 bastion app[30852]: INFO request_id=846d23c262fd3edb method=GET path=/admin status=200 duration=7421ms 2026-10-09T13:35:59.586629-07:00 bastion app[30930]: INFO request_id=1cd2bb8ba52366ad method=GET path=/wp-login.php status=200 duration=1170ms 2026-10-09T13:35:59.645447-07:00 db-primary nginx[1200]: 192.103.80.160 - - "GET /api/v2/users HTTP/1.1" 200 89099 "-" "Go-http-client/1.1" 2026-10-09T13:35:59.686294-07:00 cache-3 app[30081]: DEBUG cache hit ratio 42% over the last minute (74786 lookups) 2026-10-09T13:35:59.885147-07:00 web-02 nginx[1202]: 91.12.183.137 - - "GET /static/app.js HTTP/1.1" 200 30367 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/129.0.0.0 Safari/537.36" 2026-10-09T13:35:59.928219-07:00 edge-fr-1 sshd[30286]: Invalid user françois from 203.117.89.163 port 16698