Splunk-Otel journald/kubelet fails to start

[mustafakarci]

For ore setup we use the journald logs to be read via this config

  # Configuration for collecting journald logs using otel collector
  journald:
    enabled: true
    # Please update directory path for journald if it's different from below default value "/run/log/journal"
    directory: /var/log/journal
    # List of service units to collect journald logs for and configuration for each.
    units:
      - name: kubelet
        priority: info
      - name: docker
        priority: info
      - name: containerd
        priority: info
    # Route journald logs to its own Splunk Index by specifying the index value below, else leave it blank. Please make sure the index exist in Splunk and is configured to receive HEC traffic. Not applicable to Splunk Observability.
    index: ""

  checkpointPath: "/var/addon/splunk/otel_pos"

in the relay.yaml these exist as receivers

    logs/host:
      exporters:
      processors:t
      receivers:
      - journald/kubelet
      - journald/docker
      - journald/containerd

in the pods it self the docker and containerd journald logs are working and the process is started

# ps fuax
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
0              1 19.7  0.7 1986192 490932 ?      Ssl  10:20  12:15 /otelcol --config=/conf/relay.yaml
0             18  0.0  0.1 530628 69504 ?        S    10:20   0:00 journalctl --utc --output=json --follow --unit containerd --priority info --directory /var/log/journal
0             20  0.0  0.1 530620 73864 ?        S    10:20   0:00 journalctl --utc --output=json --follow --unit docker --priority info --directory /var/log/journal

But the pods gives error that " "Failed to read journal: Operation not supported"

026-02-09T10:20:39.287Z info adapter/receiver.go:41 Starting stanza receiver {"resource": {"service.instance.id": "9e43d422-f05a-499f-b99b-e7e04e3909a9", "service.name": "otel-agent", "service.version": "v0.141.0"}, "otelcol.component.id": "journald/kubelet", "otelcol.component.kind": "receiver", "otelcol.signal": "logs"}
2026-02-09T10:20:39.323Z error journald/input.go:163 Received from journalctl stderr {"resource": {"service.instance.id": "9e43d422-f05a-499f-b99b-e7e04e3909a9", "service.name": "otel-agent", "service.version": "v0.141.0"}, "otelcol.component.id": "journald/kubelet", "otelcol.component.kind": "receiver", "otelcol.signal": "logs", "operator_id": "journald_input", "operator_type": "journald_input", "stderr": "Failed to read journal: Operation not supported\n"}
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/operator/input/journald.(*Input).runJournalctl.func1
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.141.0/operator/input/journald/input.go:163
2026-02-09T10:20:39.326Z error journald/input.go:98 journalctl command exited {"resource": {"service.instance.id": "9e43d422-f05a-499f-b99b-e7e04e3909a9", "service.name": "otel-agent", "service.version": "v0.141.0"}, "otelcol.component.id": "journald/kubelet", "otelcol.component.kind": "receiver", "otelcol.signal": "logs", "operator_id": "journald_input", "operator_type": "journald_input", "error": "exit status 1"}
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/operator/input/journald.(*Input).run

What i found is that when i bump towards version 0.144.2 first removed the kubelet and added the kubelet this seems to be working again. Not sure what happend there!