Monitoring agents

Documentation Index

Fetch the complete documentation index at: https://docs.jacobpevans.com/llms.txt

Use this file to discover all available pages before exploring further.

One picture: every collector, what it collects, where it runs, what it forwards to.

The monitoring stack runs across four hosts: the homelab Proxmox cluster, the macOS workstation, the OrbStack K8s cluster on that workstation, and the AWS-side Splunk install. Each tier picks the lowest-overhead path the host OS supports natively. This page maps every collector to a host and a destination.

​

The collectors

​

The Edge → Stream → Splunk invariant

Across every tier, the architectural rule is the same: Edge collects, Stream routes, Splunk indexes. Edge does not talk directly to Splunk anywhere on this stack. Stream is the only component with Splunk egress. On the OrbStack cluster this is enforced by network policies that lock Edge egress to Stream on HEC port 8088 only; on the homelab Proxmox side the rule is operational (single Stream tier, well-known HEC endpoint), reinforced by firewall rules in terraform-proxmox/modules/firewall/.

​

Per-tool Cribl Edge packs

The AI-coding-tool packs sit on top of the OrbStack cluster’s cribl-edge-standalone: The macOS host telemetry pack cc-edge-the-mac-pack targets the native macOS Cribl Edge install (not the OrbStack-deployed one) — its exec inputs call macOS-only binaries that need host access, not a Linux container.

​

REST collectors

REST collectors run on Stream rather than Edge because they’re pull-based jobs against authenticated APIs — closer to the routing layer’s responsibility than the host-side capture layer.

​

OTel collectors

Anything inside the OrbStack cluster that speaks OTLP gets pointed at the in-cluster OTel collector. Anything outside the cluster but on the same Mac (Claude Code, Gemini Antigravity, VS Code) talks to the OTel collector through the NodePort or hands off to the Cribl Edge standalone pack.

​

Heartbeats

Four healthchecks.io CronJobs run in the OrbStack monitoring namespace as dead-man switches: A missed ping is the first signal of a broken pipeline — every other failure mode tends to be silent.

​

Forwarding to AWS DR

The Splunk install behind cribl-stream is the homelab indexer. tf-splunk-aws provisions the AWS-side DR footprint: same data shape, smaller indexer tier, ready to take a failover. Cribl Stream’s output config can be flipped from the homelab Splunk to the AWS HEC endpoint via a routing-rule change; downstream AI-observability dashboards keep working because they target the same indexes regardless of which Splunk tier is live.

​

See also