# Argus

No permanent service, no database, suited to machines with less than 1 GB of RAM. Argus counts attacks against your servers, SSH by itself and the bans of Fail2Ban and CrowdSec when they are installed, and keeps the history as charts. A cron job works once a night, writes plain text files and draws the images; no process stays up.

## What it counts

Argus reads the SSH authentication logs, and, when the tools are present, the bans of Fail2Ban and the alerts of CrowdSec. An attack is a source address that reaches a minimum number of failed authentication attempts in one day, 5 by default, so one mistyped password does not count.

The series stay separate. SSH, each Fail2Ban jail and each CrowdSec scenario keep their own line and their own colour, and Argus never adds them into a single score.

![Line chart of the number of attacks per day for each protocol, one line per series.](/images/argus-daily-1600.jpg)

*The daily view shows the number of attacks per day for each protocol, one line per series.*


## Three views, one command

`argus-chart` draws the view of a window you choose. `daily` gives the history of a year, one point per day. `period` counts each series over a day, an ISO week, a month, a quarter, a year or a date range. `hourly` counts each series at each hour of the day over the same windows. The [Charts](/charts/index.md) page gives real commands and explains how to read the hour.

## Install on the server, read on the desk

The package goes on the server whose logs Argus reads. Your own computer installs nothing of it and receives the images with `argus-fetch`. This is the reverse of the usual order, and the [Installation](/installation/index.md) and [Desk](/desk/index.md) pages give the two steps.

## A periodic snapshot, not a live service

Grafana is a continuous view of an infrastructure: a service that runs all the time and can be queried live. Argus is a periodic snapshot: one image per night, read when you want. Grafana can also aggregate by week or by year; the difference is the price of a permanent service, a time-series database and a dashboard to build, against one cron job and flat text files. The [How it works](/how-it-works/index.md) page follows one night of collection and rendering.