macOS
Homebrewverified · 100%
brew install arguslocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install argusMacPorts ports tree · net/argus/Portfile · source: api.github.com
brew / rank 10516
Install argus with Homebrew, dnf, MacPorts, Nix, zypper, apt
Audit Record Generation and Utilization System server. Version 5.0.2 via Homebrew; verified 2026-06-25. Also installable with debian: sudo apt install argus-server.
install
Additional install commands
Linux
Fedora dnfverified · 92%
sudo dnf install argusFedora Rawhide package metadata · argus · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#argusnixpkgs package indexes · pkgs/by-name/ar/argus/package.nix · source: api.github.com
openSUSE zypperverified · 92%
sudo zypper install argusopenSUSE Tumbleweed package metadata · argus · source: download.opensuse.org
Debian aptverified · 92%
sudo apt install argus-serverDebian stable package indexes · argus-server · source: deb.debian.org
overview
Package summary
Audit Record Generation and Utilization System server
Project links
Commands and aliases
- argus
- argus-airport
- argus-extip
- argus-ipaddr
- argus-ipmitool
- argus-lsof
- argus-netstat
- argus-snmp
- argus-stumbler
- argus-vmstat
- argusbug
history
Project history and usage
Argus is the sensor and daemon side of OpenArgus, an open-source network activity auditing system that turns packet traffic into rich flow records for operations, security, performance, research, and retrospective analysis.
Project history
OpenArgus describes Argus as the first network flow system, developed by Carter Bullard in the early 1980s at Georgia Tech. It was later adapted for cyber-security incident response at the first CERT at Carnegie Mellon's Software Engineering Institute in the late 1980s.
The project models network activity auditing after telephone call detail records: the goal is to account for network activity in a way that supports many management functions, including security. The site emphasizes that Argus is not limited to IP-only traffic and that it aims to produce rich network flow data from packets on the wire or in captures.
OpenArgus now presents the system as two coordinated packages: `argus`, the packet-processing network flow sensor, and `argus-clients`, the programs that process the generated records. Recent OpenArgus release notes describe Argus 5.x as a major sensor and client release with many commits, contributions, and new flow-record features.
Adoption history
According to OpenArgus, the software has been used operationally by US Government, US DoD, DHS, DOE, large corporations, and university networks worldwide. The site also describes research use in network performance analysis, situational awareness, cyber security, machine learning, and SDN chip-design work.
Its adoption is helped by a classic source-plus-packages distribution model: OpenArgus notes source builds on Mac OS X, Linux, Unix, and Cygwin-enabled Windows, while the input records packages for Homebrew, Debian/Ubuntu, Fedora, MacPorts, Nix, and openSUSE.
How it is used
The `argus` daemon reads live interfaces or packet captures and writes Argus flow records. Operators then pipe or store those records for processing by the client suite. The official site frames this as real-time network awareness, distributed visibility, active cyber defense, and retrospective analysis.
The server configuration is `argus.conf`; the existing curation cites the official manpage for `/etc/argus.conf`, `$ARGUSPATH/argus.conf`, and `$ARGUSHOME/argus.conf`. Credentials are not a primary documented concept for the daemon package, so the credentials location is null.
Why package nerds care
Argus is significant because it predates many flow-monitoring conventions but still packages cleanly as a modern daemon plus CLI ecosystem. It gives Unix users a source-built, scriptable alternative to appliance-style network telemetry.
For Homebrew users, it is also a reminder that some formulae are not just developer tools: installing `argus` can put a packet-capture daemon and network audit pipeline on a workstation or lab host, with the client formula providing the matching analysis commands.
Timeline
- Early 1980s: Carter Bullard develops Argus at Georgia Tech.
- Late 1980s: Argus is adapted for incident response at CERT/SEI.
- 2020s: Development moves to official openargus GitHub repositories.
- 2020s: Argus 5.x becomes the main branch for the sensor and client programs.
Related projects
- argus-clients processes records produced by the Argus sensor.
- OpenArgus relates its data model to NetFlow, Jflow, Qflow, Kflow, IPFIX, and flow-tools.
Sources
security posture
Risk level: blue
broad file, network, media, or database tool signal.
Risk classifier
blue risk · medium confidence · tool
Why
- broad file, network, media, or database tool signal
Signals
- text:record,server
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
/etc/argus.conf$ARGUSPATH/argus.conf$ARGUSHOME/argus.conf
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
argus | executable | indexed executable | Discovered from the local executable index. |
argus-airport | executable | indexed executable | Discovered from the local executable index. |
argus-extip | executable | indexed executable | Discovered from the local executable index. |
argus-ipaddr | executable | indexed executable | Discovered from the local executable index. |
argus-ipmitool | executable | indexed executable | Discovered from the local executable index. |
argus-lsof | executable | indexed executable | Discovered from the local executable index. |
argus-netstat | executable | indexed executable | Discovered from the local executable index. |
argus-snmp | executable | indexed executable | Discovered from the local executable index. |
argus-stumbler | executable | indexed executable | Discovered from the local executable index. |
argus-vmstat | executable | indexed executable | Discovered from the local executable index. |
argusbug | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version5.0.2
manager updated2026-06-25
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:argus |
|---|---|
| Version | 5.0.2 |
| Package manager | Homebrew |
| Homepage | https://openargus.org |
| Repository | https://github.com/openargus/argus |
| Last updated | 2026-06-25T13:37:36+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
argus-server 2:5.0.2-3
IP network transaction auditing tool
sudo apt install argus-server- Section: net
- Architecture: amd64
- Source Package: argus
- 7 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Argus
Nix95%
argus
nix profile install nixpkgs#argus- normalized package name match
- Matched by: Argus
Ubuntu apt95%
argus-server 2:3.0.8.2-2.3build1
IP network transaction auditing tool
sudo apt install argus-server- Section: universe/net
- Architecture: amd64
- Source Package: argus
- 7 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Argus
dnf95%
argus 3.0.8.2-31.fc45
Network transaction audit tool
sudo dnf install argus- License: GPL-2.0-or-later
- Category: Unspecified
- Architecture: x86_64
- Source Package: argus
- 14 dependencies
- 2 provides
- normalized package name match
- Matched by: Argus
dnf95%
argus-clients 3.0.8.2-31.fc45
Client tools for argus network audit
sudo dnf install argus-clients- License: GPL-2.0-or-later
- Category: Unspecified
- Architecture: x86_64
- Source Package: argus
- 8 dependencies
- 1 provides
- normalized package name match
- Matched by: Argus
dnf95%
argus-devel 3.0.8.2-31.fc45
Header files for argus network audit
sudo dnf install argus-devel- License: GPL-2.0-or-later
- Category: Unspecified
- Architecture: i686
- Source Package: argus
- 1 provides
- normalized package name match
- Matched by: Argus
zypper95%
argus 3.0.8.3-4.8
Network Monitoring Tool
sudo zypper install argus- License: BSD-3-Clause AND GPL-2.0-only AND LGPL-2.1-only AND MIT
- Category: Productivity/Networking/Diagnostic
- Architecture: x86_64
- Source Package: argus
- 3 dependencies
- 1 provides
- normalized package name match
- Matched by: Argus
zypper95%
argus-server 3.0.8.3-4.8
Daemon for Network Monitoring Tool
sudo zypper install argus-server- License: BSD-3-Clause AND GPL-2.0-only AND LGPL-2.1-only AND MIT
- Category: Productivity/Networking/Diagnostic
- Architecture: x86_64
- Source Package: argus
- 6 dependencies
- 3 provides
- normalized package name match
- Matched by: Argus
MacPorts95%
argus
sudo port install argus- normalized package name match
- Matched by: Argus
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation