Splunk Technology Add-on
TA-kernel
Crash readiness
Free for personal use · commercial license required
System
dmesg/journal · kpatch/livepatch CLIs
Why TA-kernel exists
Reboots that "just happen" are kernel oopses and watchdog resets nobody captured. TA-kernel preserves the evidence and tracks livepatch coverage and kernel-version drift across the fleet.
What it collects
- Oops, panic and taint events
- Watchdog reset capture
- Livepatch/livepatch state and kernel-version drift
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: dmesg/journal · kpatch/livepatch CLIs.