# How it works

Argus is a batch pipeline, not a service. A cron job runs a collector for each source, the collectors append counts to plain text files, and a second job draws the charts with gnuplot. No process of Argus stays running between two nights.

## Collection

The collectors are separate scripts, one per source, so the failure of one does not stop the others:

- `collect-ssh.sh` reads `auth.log` or journald and counts SSH attacks;
- `collect-fail2ban.sh` reads the bans of each Fail2Ban jail, when Fail2Ban is installed;
- `collect-crowdsec.sh` reads the alerts of each CrowdSec scenario, when CrowdSec is installed.

`/etc/cron.d/argus` starts the collection at 00:05. A source address becomes an attack when it reaches `ARGUS_SSH_THRESHOLD` failed attempts in one day, 5 by default. The count is kept; the address is not.

## Flat files

The collectors write `$ARGUS_DATA_DIR/<year>/<series>_<year>.txt`, by default under `/srv/argus/`. Each line holds a count and an hourly slice, `<count> <YYYY-MM-DDTHH>`. There is no database and no index to rebuild: a file can be read, copied or compared with a text tool.

A series is the file name without the year, so `ssh_direct_2026.txt` is the series `ssh_direct`. One file per source and per year keeps the history readable after a collector changes.

## Rendering

The chart job starts at 00:15 and calls `chart-daily.sh`, which rebuilds the daily totals from the flat files and draws the image of the year. The `period` and `hourly` views are drawn on demand with `argus-chart`, from the same files. The drawing is done by gnuplot, and each image lands in `<data directory>/<year>/images/`.

At 00:20, `argus-doctor.sh` checks that each collector ran the day before. Each collector writes a heartbeat line every day, even when it counted zero events, so a quiet day and a stopped collector can be told apart.

## No daemon

Argus exposes no service and no web interface, and it keeps no process alive. A server with 1 GB of RAM is enough, and a night without collection leaves the previous files untouched. The charts are read where they are copied, on the desk, with any image viewer.

The scripts, the settings and the file layout are described in the repository: [README](https://github.com/RonanDavalan/Argus/blob/main/README.md), [installation guide](https://github.com/RonanDavalan/Argus/blob/main/docs/install.md).