Charts
On this page
argus-chart draws the chart of a window you choose: one day, one ISO week, one month, one quarter, one year or a range. It has three views, daily, period and hourly, and runs on the server, where the data files are. Each command writes a PNG in /srv/argus/<year>/images/.
The three views
argus-chart daily [YEAR]draws the history of one year, one point per day, the current year by default.argus-chart period [window]counts each series over a window, one line per series.argus-chart hourly [window]counts each series at each hour of the day, 00 to 23, added up over a window.
period and hourly accept the same windows: --day YYYY-MM-DD, --week YYYY-Www for an ISO week from Monday to Sunday, --month YYYY-MM, --quarter YYYY-Qn, --year YYYY, or --from YYYY-MM-DD --to YYYY-MM-DD. Without a window, they use the current year. A window that spans two years reads the files of both.
Three commands
argus-chart period --day 2026-10-30
argus-chart period --month 2026-10 --split week
argus-chart hourly --week 2026-W44
The first draws one day, with one point per hour. The second draws one image per ISO week of October. The third draws 24 positions per series for the week, which shows the hours at which you are attacked, not the days.
An ordinary user cannot write in /srv/argus/; add --out DIR to write in a home directory. When a window holds at most 31 points, the value is printed beside each point.
The hour of observation, not the hour of the attack
Each slice carries the server’s local clock, written by the collector at the moment the log recorded the attempt. That timestamp can be later than the moment the attempt started; the chart title says “local server time” so the reader does not take it for the beginning of the attack. Daylight saving time shifts one day by an hour, an effect that fades over a full week.
Series are overlaid, never summed
Each line of the image is a series: ssh_direct for SSH, ip_ban_<jail> for each Fail2Ban jail, ip_ban_<scenario> for each CrowdSec scenario. Its name is the file name with the year removed, so ssh_direct_2026.txt belongs to ssh_direct.
Argus does not invent one score from different tools. Each series keeps the same colour from year to year, set with ARGUS_COULEUR_<series> or taken from a hash of the name.
argus-chart period --week 2026-W44 --list-series
argus-chart period --week 2026-W44 --series ssh_direct
argus-chart hourly --month 2026-10 --series ssh_direct,ip_ban_sshd --out ~/argus-out
Read the numbers instead of the picture
--print-data gives the numbers instead of the image, as a tab-separated table on standard output:
argus-chart period --week 2026-W44 --print-data
argus-chart hourly --day 2026-10-30 --print-data
Older daily data in the hourly view
A line of a data file reads <count> <date>T<hour>, for example 492 2026-10-30T14. Older files, written when collection was still daily, hold one line per day with hour 00. Such a series carries no usable hour, so the hourly view excludes it and names it in the chart title rather than stacking a single bar at midnight. period and daily still draw it as daily points.
The windows, the split, the options and the T00 rule are detailed in docs/charts.md.