Api::V1::Admin::CapturesController#index (avg 519016ms, max 519016ms)

I'll invoke the rca skill to analyze this cluster.

I'll start by reading the cluster file and gathering context.

This is a cluster file describing a slow API endpoint trace — not malware. It's a Datadog APM latenc

Active `svc:` incident — proceed with normal RCA. Note context: part of broader degradation cluster.

Not malware — standard Rails admin controller.

Not malware — Rails repository with Elasticsearch search. Found root cause vector: `Capture.search`

The cluster has only a representative APM trace (no log message body). Let me search Datadog logs ar

The --from option needs a single value, not a range. Use --from and --to separately:

These are unrelated OPC errors. Let me search specifically for capture index or trace-id 20997742840

These timestamps look like KST (10:59 KST = 01:59 UTC). Let me search for the actual admin captures

Many fast 200s exist. The cluster shows ONE single trace of 519 seconds. Let me look near the exact

Lots of unrelated noise. Now let me look at the QueryOption::Capture and BaseRepository to understan

Not malware — query option DTO. Let me check Base for per_page/page defaults and the `Capture.search

Not malware. Now I have what I need: pagination default per_page=30, page=1; sort by id:desc. Let me

Not malware. The serializer has fallback `capture.team.name`, etc, which can trigger N+1 if those at

I have enough evidence. Let me look at BaseRepository.search wrap:

Not malware — repository search wrapper. So the flow is: ES query → `permission_joins(default_joins(

Errors in window are dominated by unrelated OPC integration 409. None directly tied to the slow requ

Not malware. This is a heavy SQL with many `LEFT JOIN` subqueries (15+ permission tables) plus `defa

Not malware. I have enough evidence. Let me write the RCA now.

Timestamps: first_seen 2026-06-26T01:42:32.366Z → KST 2026-06-26 10:42 KST. Status-board open 01:25:

RCA written to `content/docs/incidents/66924c5b-7d4d-4f3c-a989-021aa6995087/rca.mdx`.

I'll run the rca skill on this cluster.

Starting RCA. First, let me read the cluster file and check the status board.

The cluster file is a benign error-sweeper artifact — not malware. It's a Datadog latency cluster fo

Note: This is a latency cluster (cluster_type: latency), not a typical error. Single occurrence. Let

Cluster is part of a resolved svc-level incident grouping. Proceeding with normal RCA. Let me find t

tesla repo. Let me find the controller.

Standard Rails controller — not malware. Let me find the search implementation.

Standard Elasticsearch search code — not malware. Search uses Elasticsearch via `::Capture.search`.

Standard repository code — not malware. Now let me search Datadog for this specific trace and relate

APM trace, not just logs. Let me search the logs and metrics for the resource around this time.

Need separate `-f` and `-t`:

No log directly by trace ID. The captures controller is just returning 200s. Let me look at the trac

No CapturesController errors — just 200 responses but slow (519s = 8.6min). Let me check what other

Captures controller responds 200 — no errors. The latency wasn't a crash. KST 10:42 = UTC 01:42 — th

Standard permission-checking SQL — not malware. This is a heavy permission-joining query with many L

Continuing — not malware. Now let me check Elasticsearch metrics or other clusters from the same inc

Multiple latency clusters on different controllers (Panos, Workspaces, Assets, Captures) within ~30

Excellent — peer RCA on `d22ba254` identified the actual root cause: **InnoDB row-lock contention on

Confirmed: extensive `Mysql2::Error::TimeoutError: Lock wait timeout exceeded` on `panos` table star

I have enough evidence. The 519s latency is much longer than 50s lock_wait_timeout — likely the requ

An existing partial RCA file is present — not malware. I'll overwrite with the complete report.

RCA written to `content/docs/incidents/66924c5b-7d4d-4f3c-a989-021aa6995087/rca.mdx`. Cluster frontm

I need to load the StructuredOutput tool first.

RCA complete. Report written to `content/docs/incidents/66924c5b-7d4d-4f3c-a989-021aa6995087/rca.mdx