Splunk Technology Add-on
TA-journald
Logplane meta
Free for personal use ยท commercial license required
System
journalctl (always present)
Why TA-journald exists
When central logging falls over, journald drops the evidence silently. TA-journald watches journal disk usage, rate-limit discards and storage config drift: the monitors that watch the monitors.
What it collects
- Journal disk usage and quotas
- Rate-limit discard counters
- Storage config drift detection
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: journalctl (always present).