# Installation

Argus is installed on the server whose logs it reads, not on the computer where you look at the charts. The package is a Debian archive, architecture-independent, installed with `apt` on Debian or Ubuntu. The full procedure is in the repository's install guide.

## Download and install

Download `argus_1.0.0-14_all.deb` from the releases page of the [repository](https://github.com/RonanDavalan/Argus), then run this command on the server:

```bash
sudo apt install ./argus_1.0.0-14_all.deb
```

`apt` installs the two declared dependencies, `gawk` and `gnuplot-nox`. Three jobs enter the cron file: the collection at 00:05, the charts at 00:15 and the health check at 00:20. The first image is written the following night in `/srv/argus/<year>/images/`.

A server that already holds log history can produce its first files at once, by hand:

```bash
sudo /opt/argus/collect-ssh.sh
sudo /opt/argus/chart-daily.sh
ls /srv/argus/2026/images/
```

## What the package installs

- the collectors and chart scripts in `/opt/argus/`;
- the commands `argus-chart` and `argus-fetch` in `/usr/bin/`;
- the optional settings in `/etc/argus/argus.conf`, every line commented out;
- the nightly jobs in `/etc/cron.d/argus`;
- the data and the images in `/srv/argus/`, readable by every user because they hold only counts.

The data directory keeps one file per series and per year, with one line per hour that saw an attack. Nothing in it is an IP address.

## Check the collection

`argus-doctor.sh` reports the last successful collection of every source:

```bash
sudo /opt/argus/argus-doctor.sh
```

An empty chart has two possible causes: a day without attacks, or a collector that no longer runs. The heartbeat left by each collector separates them. The [troubleshooting guide](https://github.com/RonanDavalan/Argus/blob/main/docs/troubleshooting.md) gives the meaning of each line.

## Change a setting

`/etc/argus/argus.conf` is a shell file read by every script. Uncomment only what you need:

```bash
# /etc/argus/argus.conf
ARGUS_SSH_THRESHOLD=10            # failures per IP and day
ARGUS_LANG=en                     # chart language
ARGUS_IMG_WIDTH=3840              # size in pixels
ARGUS_IMG_HEIGHT=2160
ARGUS_COULEUR_ssh_direct=orange   # colour of one series
```

All variables are listed in `man argus`.

## Remove

```bash
sudo apt remove argus     # keeps /srv/argus and /etc/argus
sudo apt purge argus      # also removes them
```

The purge removes the history as well, so copy the images to the desk before running it. The complete procedure, the file layout and the settings are in [docs/install.md](https://github.com/RonanDavalan/Argus/blob/main/docs/install.md).