Splunk Technology Add-on
TA-memwatch
Leak early warning
Free for personal use · commercial license required
Performance
None (/proc/slabinfo) · slabtop optional
Why TA-memwatch exists
Out-of-memory incidents announce themselves hours early if you watch the right counters. TA-memwatch trends slab growth, swap thrash and zram ratio into a single OOM-readiness score.
What it collects
- Slab allocation growth per cache
- Swap-in rates and thrash signals
- zram compression ratio creep
Runs on stock tools
No daemons, no agents, no exotic collectors - it shells out to well-known CLIs or reads sysfs, and parses the result into Splunk events.
External tools used: None (/proc/slabinfo) · slabtop optional.