How it works
On this page
Argus is a batch pipeline, not a service. A cron job runs a collector for each source, the collectors append counts to plain text files, and a second job draws the charts with gnuplot. No process of Argus stays running between two nights.
Collection
The collectors are separate scripts, one per source, so the failure of one does not stop the others:
collect-ssh.shreadsauth.logor journald and counts SSH attacks;collect-fail2ban.shreads the bans of each Fail2Ban jail, when Fail2Ban is installed;collect-crowdsec.shreads the alerts of each CrowdSec scenario, when CrowdSec is installed.
/etc/cron.d/argus starts the collection at 00:05. A source address becomes an attack when it reaches ARGUS_SSH_THRESHOLD failed attempts in one day, 5 by default. The count is kept; the address is not.
Flat files
The collectors write $ARGUS_DATA_DIR/<year>/<series>_<year>.txt, by default under /srv/argus/. Each line holds a count and an hourly slice, <count> <YYYY-MM-DDTHH>. There is no database and no index to rebuild: a file can be read, copied or compared with a text tool.
A series is the file name without the year, so ssh_direct_2026.txt is the series ssh_direct. One file per source and per year keeps the history readable after a collector changes.
Rendering
The chart job starts at 00:15 and calls chart-daily.sh, which rebuilds the daily totals from the flat files and draws the image of the year. The period and hourly views are drawn on demand with argus-chart, from the same files. The drawing is done by gnuplot, and each image lands in <data directory>/<year>/images/.
At 00:20, argus-doctor.sh checks that each collector ran the day before. Each collector writes a heartbeat line every day, even when it counted zero events, so a quiet day and a stopped collector can be told apart.
No daemon
Argus exposes no service and no web interface, and it keeps no process alive. A server with 1 GB of RAM is enough, and a night without collection leaves the previous files untouched. The charts are read where they are copied, on the desk, with any image viewer.
The scripts, the settings and the file layout are described in the repository: README, installation guide.