18:30:47 kubelet: Liveness probe failed: HTTP probe failed with statuscode: 503
18:30:47 kube-scheduler: Successfully bound staging/ingest-shard-2 to worker-3
18:30:47 argocd: app "ades/api" synced (revision 2ed55f1)
18:30:47 HPA: New size: 6; reason: cpu resource utilization (percentage of request) above target
18:30:47 argocd: app "ades/api" synced (revision 533ee0c)
18:30:47 kubelet: Back-off restarting failed container api in pod monitoring/auth-service-58d6c4cd6f
18:30:47 kube-scheduler: Successfully bound kube-system/billing-worker-9b8c7d5fc to worker-4
18:30:47 coredns: [INFO] 10.0.6.134:46623 - 14745 "A IN api.internal. udp 77 false 512" NOERROR qr,aa,rd 136 0.000390s
{"t":"2026-05-15 18:30:47.493","level":"warn","svc":"auth","msg":"token near expiry","sub":"u_482ca44b","ttl_s":60}
18:30:47 argocd: app "ades/api" synced (revision 266dee8)
18:30:47 ip-10-0-2-44 audit: type=1400 audit(1778869847.493:6771): apparmor="ALLOWED" operation="exec" profile="docker-default"
18:30:47 bastion-01 kernel: [704113.429842] TCP: request_sock_TCP: Possible SYN flooding on port 443. Sending cookies.
18:30:47 HPA: New size: 12; reason: cpu resource utilization (percentage of request) above target
{"t":"2026-05-15 18:30:47.493","level":"info","svc":"api-gateway","msg":"request","method":"GET","path":"/v1/orders","status":200,"dur_ms":382,"req_id":"4419bbc8f85a"}
18:30:47 ip-10-0-2-44 kernel: [288824.535505] TCP: request_sock_TCP: Possible SYN flooding on port 443. Sending cookies.
18:30:47 control-01 kernel: [11241.094742] TCP: request_sock_TCP: Possible SYN flooding on port 443. Sending cookies.
18:30:47 worker-03 audit: type=1400 audit(1778869847.493:7788): apparmor="ALLOWED" operation="exec" profile="docker-default"
18:30:47 cloud-init: finished at 2026-05-15 18:30:47.493. Up 12.66 seconds
18:30:47 ip-10-0-2-44 kernel: [503094.055895] cgroup: new mount of cgroup2 filesystem
18:30:47 worker-03 NetworkManager: <info> [1778869847.493] device (eth0): state change: activated -> deactivating (reason 'connection-removed')
18:30:47 HPA: New size: 5; reason: cpu resource utilization (percentage of request) above target
18:30:47 sentinelone: agent heartbeat ok (70 threats blocked this week)
18:30:47 ip-10-0-4-21 audit: type=1400 audit(1778869847.493:5491): apparmor="ALLOWED" operation="exec" profile="docker-default"
18:30:47 HPA: New size: 2; reason: cpu resource utilization (percentage of request) above target
18:30:47 amazon-ssm-agent: ssm-document-worker - executing command on instance i-015ee39d850b741f
18:30:47 ip-10-0-6-118 systemd[1]: Started Session 1474 of user martin.
18:30:47 dockerd: container 6f7ac0578a07 die (name=auth-service-58d6c4cd6f)
18:30:47 fluent-bit: [output:s3] flushed 781 records to s3://ades-logs/ingress/2026-05-15/
18:30:47 fluent-bit: [output:s3] flushed 743 records to s3://ades-logs/platform/2026-05-15/
18:30:47 ip-10-0-6-118 NetworkManager: <info> [1778869847.493] device (eth0): state change: activated -> deactivating (reason 'connection-removed')
18:30:47 control-01 sshd[16366]: Invalid user admin from 111.251.48.166 port 55025
18:30:47 bastion-01 systemd[1]: Reached target network-online.target.
18:30:47 worker-03 sshd[16252]: Accepted publickey for martin from 107.43.216.179 port 41372 ssh2: ED25519 SHA256:a55248fc140671edc7cd
18:30:47 amazon-ssm-agent: ssm-document-worker - executing command on instance i-0f9797dee86812d6
18:30:47 ip-10-0-4-21 cron[24715]: (martin) CMD (/usr/local/bin/backup.sh --incremental)
18:30:47 ip-10-0-2-44 audit: type=1400 audit(1778869847.493:3273): apparmor="ALLOWED" operation="exec" profile="docker-default"
18:30:47 bastion-01 NetworkManager: <info> [1778869847.493] device (eth0): state change: activated -> deactivating (reason 'connection-removed')
{"t":"2026-05-15 18:30:47.493","level":"error","svc":"billing","msg":"upstream timeout","upstream":"payments","dur_ms":7566,"trace_id":"e896d47a193de7e5"}
18:30:47 amazon-ssm-agent: ssm-document-worker - executing command on instance i-03e745f16cdbc2de
18:30:47 ip-10-0-6-118 systemd[1]: Started Session 3479 of user martin.
18:30:47 control-01 kernel: [99343.055990] cgroup: new mount of cgroup2 filesystem
18:30:47 HPA: New size: 7; reason: cpu resource utilization (percentage of request) above target
18:30:47 ip-10-0-2-44 systemd[1]: Reached target sockets.target.
18:30:47 kube-proxy: Adding new service port "staging/svc:http" at 10.0.7.220:8833/TCP
18:30:47 wazuh: rule 5710 fired - sshd: Attempt to login using a non-existent user from 84.182.18.199
18:30:47 kubelet: pod staging/notif-dispatcher-66cbf9d6f8 ready in 10.5s
18:30:47 ip-10-0-6-118 systemd[1]: Started Session 4926 of user martin.
18:30:47 github-actions: ✓ lint completed in 520s
18:30:47 coredns: [INFO] 10.0.6.120:43905 - 54763 "A IN db.internal. udp 69 false 512" NOERROR qr,aa,rd 148 0.000429s
18:30:47 ip-10-0-2-44 NetworkManager: <info> [1778869847.493] device (eth0): state change: activated -> deactivating (reason 'connection-removed')
18:30:47 cloud-init: finished at 2026-05-15 18:30:47.494. Up 13.19 seconds
18:30:47 amazon-ssm-agent: ssm-document-worker - executing command on instance i-00a246136ac8f05b
18:30:47 bastion-01 kernel: [661335.985606] eth0: link up, 10000Mbps, full-duplex, lpa 0x7800
18:30:47 amazon-ssm-agent: ssm-document-worker - executing command on instance i-053f296ca37a5020
18:30:47 kubelet: pod prod/api-gateway-7c4f6b9d8b ready in 15.3s
18:30:47 worker-03 NetworkManager: <info> [1778869847.494] device (eth0): state change: activated -> deactivating (reason 'connection-removed')
{"t":"2026-05-15 18:30:47.494","level":"warn","svc":"auth","msg":"token near expiry","sub":"u_c2b34f11","ttl_s":40}
I260515 183047 18542 kubelet.go:572] "SyncLoop ADD" source="api" pods=[kube-system/cron-runner-zk2pq]
18:30:47 kubelet: Back-off restarting failed container init in pod kube-system/payments-6c8d97f5b6
18:30:47 worker-03 sshd[29373]: Accepted publickey for martin from 95.222.92.223 port 64977 ssh2: ED25519 SHA256:edefb9962df88f98aa76