Install argus-clients with Homebrew, apt, dnf, MacPorts, Nix

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• argusclientbug
• ra
• rabins
• racluster
• racount
• radium
• ramanage
• ranonymize
• rasort
• rastream

Project history

OpenArgus describes Argus as the first network flow system, developed by Carter Bullard in the early 1980s at Georgia Tech and adapted for cyber-security incident response at the first CERT at Carnegie Mellon's Software Engineering Institute in the late 1980s.

The modern project is split into two packages: `argus`, the packet-processing sensor that generates flow data, and `argus-clients`, the programs that process that data. The OpenArgus site says development moved to GitHub, with official repositories for both the sensor and client programs.

Adoption history

OpenArgus says Argus has been used operationally by US Government, US DoD, DHS, DOE, large corporations, and university networks worldwide, and that it is used in research for performance analysis, situational awareness, cyber security, machine learning, and SDN-related work.

The client package is central to that adoption because Argus records become useful through CLI pipelines: `ra`-style readers, aggregators, anonymizers, sorters, stream processors, and reporting tools can be composed into real-time or retrospective workflows.

How it is used

The Homebrew package exposes many client commands, including `ra`, `rabins`, `racluster`, `racount`, `radium`, `ranonymize`, `rasort`, and `rastream`. OpenArgus describes the clients as tools for data distribution, collection, filtering, aggregation, binning, minimization, and analytics.

The `rarc` file is the client configuration surface. The existing curation cites official manpage documentation for `~/rarc` and `$ARGUSHOME/rarc`, and because client configuration can include access and transport settings, the same file is treated as the credentials location when credentials are configured.

Why package nerds care

Argus Clients is the sort of Unix package that rewards people who like composable command-line data plumbing. It is not a single dashboard; it is a suite of small programs for turning binary flow records into filtered, sorted, joined, aggregated, anonymized, and streamed outputs.

It also carries a long-lived network-operations lineage into modern package managers: an early flow-auditing ecosystem with its own record format, config files, and tool vocabulary, still installable as a contemporary Homebrew formula.

Timeline

• Early 1980s: Carter Bullard develops Argus at Georgia Tech.
• Late 1980s: Argus is adapted for incident response at CERT/SEI.
• 2020s: OpenArgus moves argus and argus-clients development to GitHub.
• Current: Argus 5.x client programs are released in sync with the sensor to read new flow-record features.

Related projects

• The `argus` sensor package generates the flow records consumed by argus-clients.
• OpenArgus compares Argus data with NetFlow, Jflow, Qflow, Kflow, IPFIX, and historical flow-tools.

Sources

• https://openargus.org/
• https://openargus.org/documentation
• https://openargus.org/getting-argus
• https://openargus.org/using-argus