Splunk Technology Add-on
TA-cronbeat
Job heartbeats
Free for personal use ยท commercial license required
System
systemctl and crontab parsing (no deps)
Why TA-cronbeat exists
A job that quietly stopped running is a breach waiting to happen. TA-cronbeat parses schedules, watches for evidence of the run, and alerts the moment a job goes stale.
What it collects
- Cron and systemd timer inventories
- Last-run evidence per job
- Staleness alerts against expected schedule
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: systemctl and crontab parsing (no deps).