Installation

Argus is installed on the server whose logs it reads, not on the computer where you look at the charts. The package is a Debian archive, architecture-independent, installed with apt on Debian or Ubuntu. The full procedure is in the repository’s install guide.

Download and install

Download argus_1.0.0-14_all.deb from the releases page of the repository, then run this command on the server:

sudo apt install ./argus_1.0.0-14_all.deb

apt installs the two declared dependencies, gawk and gnuplot-nox. Three jobs enter the cron file: the collection at 00:05, the charts at 00:15 and the health check at 00:20. The first image is written the following night in /srv/argus/<year>/images/.

A server that already holds log history can produce its first files at once, by hand:

sudo /opt/argus/collect-ssh.sh
sudo /opt/argus/chart-daily.sh
ls /srv/argus/2026/images/

What the package installs

• the collectors and chart scripts in /opt/argus/;
• the commands argus-chart and argus-fetch in /usr/bin/;
• the optional settings in /etc/argus/argus.conf, every line commented out;
• the nightly jobs in /etc/cron.d/argus;
• the data and the images in /srv/argus/, readable by every user because they hold only counts.

The data directory keeps one file per series and per year, with one line per hour that saw an attack. Nothing in it is an IP address.

Check the collection

argus-doctor.sh reports the last successful collection of every source:

sudo /opt/argus/argus-doctor.sh

An empty chart has two possible causes: a day without attacks, or a collector that no longer runs. The heartbeat left by each collector separates them. The troubleshooting guide gives the meaning of each line.

Change a setting

/etc/argus/argus.conf is a shell file read by every script. Uncomment only what you need:

# /etc/argus/argus.conf
ARGUS_SSH_THRESHOLD=10            # failures per IP and day
ARGUS_LANG=en                     # chart language
ARGUS_IMG_WIDTH=3840              # size in pixels
ARGUS_IMG_HEIGHT=2160
ARGUS_COULEUR_ssh_direct=orange   # colour of one series

All variables are listed in man argus.

Remove

sudo apt remove argus     # keeps /srv/argus and /etc/argus
sudo apt purge argus      # also removes them

The purge removes the history as well, so copy the images to the desk before running it. The complete procedure, the file layout and the settings are in docs/install.md.

NextDesk →