# Install argus with Homebrew, apt, dnf, MacPorts, Nix, zypper Audit Record Generation and Utilization System server. Version 5.0.2 via Homebrew; verified 2026-06-25. ## Install ```sh sudo av install brew:argus ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install argus ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install argus ``` Evidence: MacPorts ports tree: net/argus/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install argus-server ``` Evidence: Debian stable package indexes: argus-server from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install argus ``` Evidence: Fedora Rawhide package metadata: argus from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#argus ``` Evidence: nixpkgs package indexes: pkgs/by-name/ar/argus/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install argus ``` Evidence: openSUSE Tumbleweed package metadata: argus from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:argus - **Package manager:** Homebrew - **Package manager page:** - **Version:** 5.0.2 - **Source summary:** Audit Record Generation and Utilization System server - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-or-later - **Source archive:** - **Last updated:** 2026-06-25T13:37:36+02:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - argus (cli) - argus-airport (cli) - argus-extip (cli) - argus-ipaddr (cli) - argus-ipmitool (cli) - argus-lsof (cli) - argus-netstat (cli) - argus-snmp (cli) - argus-stumbler (cli) - argus-vmstat (cli) - argusbug (cli) - argus (alias) - argus-airport (alias) - argus-extip (alias) - argus-ipaddr (alias) - argus-ipmitool (alias) - argus-lsof (alias) - argus-netstat (alias) - argus-snmp (alias) - argus-stumbler (alias) - argus-vmstat (alias) - argusbug (alias) ## Uses from macOS - cyrus-sasl - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 5.0.2 - Package-manager updated: 2026-06-25 - Local data: ok - Upstream repository: https://github.com/openargus/argus - Upstream latest detected: v5.0.2 (current) ## Project history and usage Argus is the sensor and daemon side of OpenArgus, an open-source network activity auditing system that turns packet traffic into rich flow records for operations, security, performance, research, and retrospective analysis. ### Project history OpenArgus describes Argus as the first network flow system, developed by Carter Bullard in the early 1980s at Georgia Tech. It was later adapted for cyber-security incident response at the first CERT at Carnegie Mellon's Software Engineering Institute in the late 1980s. The project models network activity auditing after telephone call detail records: the goal is to account for network activity in a way that supports many management functions, including security. The site emphasizes that Argus is not limited to IP-only traffic and that it aims to produce rich network flow data from packets on the wire or in captures. OpenArgus now presents the system as two coordinated packages: `argus`, the packet-processing network flow sensor, and `argus-clients`, the programs that process the generated records. Recent OpenArgus release notes describe Argus 5.x as a major sensor and client release with many commits, contributions, and new flow-record features. ### Adoption history According to OpenArgus, the software has been used operationally by US Government, US DoD, DHS, DOE, large corporations, and university networks worldwide. The site also describes research use in network performance analysis, situational awareness, cyber security, machine learning, and SDN chip-design work. Its adoption is helped by a classic source-plus-packages distribution model: OpenArgus notes source builds on Mac OS X, Linux, Unix, and Cygwin-enabled Windows, while the input records packages for Homebrew, Debian/Ubuntu, Fedora, MacPorts, Nix, and openSUSE. ### How it is used The `argus` daemon reads live interfaces or packet captures and writes Argus flow records. Operators then pipe or store those records for processing by the client suite. The official site frames this as real-time network awareness, distributed visibility, active cyber defense, and retrospective analysis. The server configuration is `argus.conf`; the existing curation cites the official manpage for `/etc/argus.conf`, `$ARGUSPATH/argus.conf`, and `$ARGUSHOME/argus.conf`. Credentials are not a primary documented concept for the daemon package, so the credentials location is null. ### Why package nerds care Argus is significant because it predates many flow-monitoring conventions but still packages cleanly as a modern daemon plus CLI ecosystem. It gives Unix users a source-built, scriptable alternative to appliance-style network telemetry. For Homebrew users, it is also a reminder that some formulae are not just developer tools: installing `argus` can put a packet-capture daemon and network audit pipeline on a workstation or lab host, with the client formula providing the matching analysis commands. ### Timeline - Early 1980s: Carter Bullard develops Argus at Georgia Tech. - Late 1980s: Argus is adapted for incident response at CERT/SEI. - 2020s: Development moves to official openargus GitHub repositories. - 2020s: Argus 5.x becomes the main branch for the sensor and client programs. ### Related projects - argus-clients processes records produced by the Argus sensor. - OpenArgus relates its data model to NetFlow, Jflow, Qflow, Kflow, IPFIX, and flow-tools. ### Sources - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/argus.conf, $ARGUSPATH/argus.conf, $ARGUSHOME/argus.conf ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** argus - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - argus-server - 2:5.0.2-3: normalized package name match | Debian stable package indexes: argus-server from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | IP network transaction auditing tool | https://openargus.org - Nix - argus: normalized package name match | nixpkgs package indexes: pkgs/by-name/ar/argus/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - argus-server - 2:3.0.8.2-2.3build1: normalized package name match | Ubuntu 24.04 LTS package indexes: argus-server from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | IP network transaction auditing tool | https://openargus.org - dnf - argus - 3.0.8.2-30.fc44: normalized package name match | Fedora Rawhide package metadata: argus from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Network transaction audit tool | http://qosient.com/argus - dnf - argus-clients - 3.0.8.2-30.fc44: normalized package name match | Fedora Rawhide package metadata: argus-clients from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Client tools for argus network audit | http://qosient.com/argus - dnf - argus-devel - 3.0.8.2-30.fc44: normalized package name match | Fedora Rawhide package metadata: argus-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Header files for argus network audit | http://qosient.com/argus - zypper - argus - 3.0.8.3-4.6: normalized package name match | openSUSE Tumbleweed package metadata: argus from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Network Monitoring Tool | https://openargus.org/ - zypper - argus-server - 3.0.8.3-4.6: normalized package name match | openSUSE Tumbleweed package metadata: argus-server from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Daemon for Network Monitoring Tool | https://openargus.org/ - MacPorts - argus: normalized package name match | MacPorts ports tree: net/argus/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [argus-clients](https://www.automicvault.com/pkg/brew/argus-clients/) - Shares the same upstream homepage. - [ahcpd](https://www.automicvault.com/pkg/brew/ahcpd/) - Shares av.db curated category or tags: cli, daemon, networking. - [bmon](https://www.automicvault.com/pkg/brew/bmon/) - Shares av.db curated category or tags: cli, network-monitoring, networking. - [bozohttpd](https://www.automicvault.com/pkg/brew/bozohttpd/) - Shares av.db curated category or tags: cli, daemon, networking. - [btpd](https://www.automicvault.com/pkg/brew/btpd/) - Shares av.db curated category or tags: cli, daemon, networking. - [bwm-ng](https://www.automicvault.com/pkg/brew/bwm-ng/) - Shares av.db curated category or tags: cli, network-monitoring, networking. - [cdpr](https://www.automicvault.com/pkg/brew/cdpr/) - Shares av.db curated category or tags: cli, network-monitoring, networking. - [ctrld](https://www.automicvault.com/pkg/brew/ctrld/) - Shares av.db curated category or tags: cli, daemon, networking. - [ifstat](https://www.automicvault.com/pkg/brew/ifstat/) - Local metadata places this package in an adjacent workflow. Shared terms: cli, monitoring, network, network-monitoring, networking. - [mrtg](https://www.automicvault.com/pkg/brew/mrtg/) - Local metadata places this package in an adjacent workflow. Shared terms: cli, monitoring, network, network-monitoring, networking. ## Combined YAML source View the package source record on GitHub. [combined/argus.yml](https://github.com/automic-vault/db/blob/main/combined/argus.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph