# sample-incident-raw.log — SYNTHETIC incident evidence for the "Safe AI Incident
# Triage" walkthrough on devopsaitoolkit.com. Every value here is FAKE. The secrets
# are well-known documentation examples or obvious dummies. Do not treat as real.
#
# Scenario: at ~14:02 UTC the shop API began returning 500s. Below is the raw,
# un-triaged evidence someone might paste into an AI assistant — including things
# that should never leave your environment.

===== haproxy.log (edge) =====
2026-09-16T14:02:11Z haproxy[2114]: 203.0.113.44:51922 [16/Sep/2026:14:02:11.004] fe_https be_api/prod-api-03 0/0/1/-1/30001 503 212 - - sQ-- 180/180/24/8/0 0/0 "GET /api/v1/checkout HTTP/1.1"
2026-09-16T14:02:12Z haproxy[2114]: 203.0.113.44:51930 [16/Sep/2026:14:02:12.101] fe_https be_api/prod-api-01 0/0/0/-1/30001 503 212 - - sQ-- 181/181/25/9/0 0/0 "POST /api/v1/orders HTTP/1.1"

===== nginx access (prod-api-03.internal.example.net) =====
10.20.3.9 - - [16/Sep/2026:14:02:11 +0000] "GET /api/v1/checkout HTTP/1.1" 500 73 "-" "checkout-worker/2.3" upstream_response_time=30.001 request_id=req_7c1f9a
10.20.3.9 - - [16/Sep/2026:14:02:12 +0000] "POST /api/v1/orders HTTP/1.1" 500 73 "-" "checkout-worker/2.3" upstream_response_time=30.001 request_id=req_7c1fa0

===== docker logs shopdemo-api (prod-api-03) =====
2026-09-16T14:02:10Z api ERROR db: connection failed: could not connect to server: Connection timed out
2026-09-16T14:02:10Z api DEBUG db: dsn=postgres://shopapi:Hunter2-NOT-REAL@10.20.3.14:5432/shop?sslmode=require
2026-09-16T14:02:10Z api ERROR order failed for customer cust_8f21aa (jane.doe@acme-customer.example): upstream db timeout
2026-09-16T14:02:10Z api INFO  retrying with pool=primary host=10.20.3.14

===== env dump captured during triage (DANGER: contains secrets) =====
NODE_ENV=production
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
DATABASE_URL=postgres://shopapi:Hunter2-NOT-REAL@10.20.3.14:5432/shop
INTERNAL_API_TOKEN=Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzdmMtY2hlY2tvdXQiLCJleHAiOjE5MDB9.9x-FAKE-signature-do-not-use-abcDEF123456
OPENAI_API_KEY=sk-proj-FAKE0000000000000000000000000000000000000000000

===== journalctl -u nova-compute (openstack controller) =====
2026-09-16T14:01:58Z prod-cc-02 nova-compute[3021]: WARNING nova.virt.libvirt.driver messaging timed out waiting for reply to db-sync on rabbit@prod-mq-01
2026-09-16T14:02:05Z prod-cc-02 nova-compute[3021]: ERROR oslo.messaging MessagingTimeout: Timed out waiting for a reply to message ID 4b1c

===== on-call note =====
Paged oncall+alerts@example.com at 14:03. DB host 10.20.3.14 not responding on 5432; suspect network partition between api subnet 10.20.3.0/24 and db.