Api::V1::SessionsController#show (avg 20550ms, max 20897ms)

I'll run the RCA skill to analyze this cluster.

I'll start by reading the cluster file and the writing guidelines.

The cluster file is a normal latency cluster file from the error-sweeper system — not malware. It's

This cluster is part of a recent svc:cupixworks-api degradation incident. Per the skill, svc:* scope

Standard Rails controller code, not malware. Let me trace the parent `show` method and find what mig

Standard Rails app code, not malware. Let me search Datadog for the specific slow traces.

Let me query the slow Sessions#show traces and look at logs around that time.

200 responses but no slow ones in the log feed. Let me check status:warn for slow request logs and l

Many `NotFound - attributes_in_database` warns from Elasticsearch update_document. Let me check what

APM traces aren't logs. Let me look at related clusters in the same incident — what root causes did

Multiple latency clusters across various controllers — broad service degradation. Let me check a sib

That sibling is a serializer N+1 issue specific to AssetsController. SessionsController#show is diff

Good — I can see the request log structure. Normal requests are 65ms. Now find the actual slow ones

Excellent — found two key slow Sessions requests:

Just 2 slow ones (matches occurrence_count=2). Let me look at concurrent slow queries from other end

A LOT of slow requests across many endpoints. This is broad service-wide degradation. Let me check w

Metrics not available. Let me look at the parent ApiController, and `before_action` chain — the `set

This is standard Rails authentication — `Cupix::Auth::Verification` calls Cognito (external) per req

Standard serializer. Note that requested fields were `[user, team]` for both slow requests, so Sessi

Critical finding. Strong patterns:

Now I have enough evidence. Let me update todos and write the report. The Sessions#show endpoint cha

Time conversions: first_seen 17:37:54 UTC → 2026-06-25 02:37 KST; last_seen 17:38:20 UTC → 2026-06-2

Now update the cluster frontmatter — change `status: pending` to `rca_status: completed`. Wait, I ne

The user instructed "Do NOT modify the cluster frontmatter — the pipeline manages the status field."

RCA report written to `content/docs/incidents/c387835e-3ff3-4300-8b16-1f9464275f5d/rca.mdx`.