Skip to main content

Documentation

Frequently Asked Questions

We don't have a formal FAQ, as many sites do, as it takes time to develop and maintain. Most questions regarding argus is dealt with on the developers mailing list or in the argus wiki. The list that is presented here is the historical FAQ with corrections. If you have any information that you would like added, please send email to the developers mailing list.

General Questions

1.1 What is an Argus?

Argus is a mythological Greek god with hundreds of eyes. There are a few stories that involve Argus, but the most appropriate is where Hera commanded Argus to watch over what seemed to be cow, suspecting that it was more than a member of one of Zeus's flock. It indeed was Io, one of Zeus's girlfriends.

Argus is a Real Time Flow Monitor that is designed to perform comprehensive data network traffic auditing.

ARGUS stands for Audit Record Generation and Usage System.

1.2 What is the plural of Argus?

Argi.

 

Mailing List

2.1 Where is the Argus mailing list?

This email address is being protected from spambots. You need JavaScript enabled to view it.

2.2 How do I join the Argus mailing list?

Send "subscribe argus-info" in the body of a piece of mail to This email address is being protected from spambots. You need JavaScript enabled to view it.

2.3 Is there a mailing list archive?

http://news.gmane.org/gmane.network.argus

 

Source Code

3.1 What is the current version of Argus?

Argus-3.0.0

3.2 Where can I get Argus-3.0?

ftp://qosient.com/argus/argus-2.0.1.tar.gz

3.3 Who owns Argus?

All rights to Argus are owned by QoSient, LLC, a Delaware corporation that is located in New York, New York.

3.4 Is Argus an open source project?

Yes. The Argus project is intended to be "open source" in the sense defined by the Open Source Initiative. Please see http://www.opensource.org for details.

3.5 What type of license is Argus distributed under?

Argus is distributed under the GNU Public License.

3.6 Can I get involved in Argus development?

Absolutely! Argus source is available for download. Join the mailing list to get all the details.

 

Bug Reporting

4.1 How do I report bugs?

Use the tool ./bin/argusbug to send your bug report to the Argus mailing list. Argusbug will present you with a bug reporting form, that includes some system information. If you are unhappy providing the information supplied by Argusbug, you are free to delete it.

Send any comments/fixes/opinions/whatever to the mailing list. Someone will should a reply.

 

History

5.1 Where did Argus start?

Argus got its official start at Carnegie Mellon's Software Engineering Institute (SEI), and was released into the public domain as Argus-1.5, in early 1996.

5.2 How many versions of Argus are there?

There have been many, many releases of Argus. We're currently on Argus-3.0.

5.3 Is Argus-3.0 a significant change to Argus?

Yes!!! Although the basic concepts are the same, Argus-3.0 is not compatible with previous versions of Argus. Please see the CHANGES document that is found in ./docs/CHANGES for details.

 

Portability

6.1 What platforms does Argus run on?

Argus is now developed on Mac OS X, and tested extensively on Linux, FreeBSD, OpenBSD, NetBSD and Solaris.7. It has been ported to Cygwin, Windows NT, IRIX, AIX, UNICOS, and OpenWRT and should port easily to any Unix operating system.

Because Argus uses libpcap as its packet capture interface, Argus, in its current form, can only be ported to systems that support libpcap.

If you do port Argus to another platform, please send your diffs to the mailing list, and we'll incorporate them into the release.

6.2 What other programs to I need to compile Argus?

Argus requires the GNU programs bison(), and its companion flex(). Argus can use tcp_wrappers and SASL, but these are not required.

 

Building Argus

7.1 How do I compile Argus?

Building specifics for Argus are described in the ./INSTALL file. The quick method is:
% ./configure
% make

 

Installation

8.1 How do I install Argus?

Detailed installation instructions are in the ./INSTALL file.

If you've got the RPM binary version, type "rpm -Uvh Argus*.rpm". This will install everything. The only thing you will need to do is edit /etc/argus.conf for your specific sites needs, and then your ready to go.

If you've got the source tarball, then "make install" will do most everything for you. If you are concerned about how Argus will install itself, read on. v Argus does not have any installation retrictions, so you can install Argus anywhere. The makefile that is generated by ./configure supports "make install". To review where this will install argus: 
make -n install

If these are cool, then let the Makefile do the installation. On most systems the binaries will go into /usr/local/[s]bin, and the man pages will go in /usr/local/man. The docs will go in /usr/share/docs, if the system supports it, if not they will not be installed.

If you plan on running Argus as a system daemon, then you should install an argus configuration file as /etc/argus.conf. This provides a single point of configuration for argus as a system daemon. A sample is provided in ./support/Config/argus.conf.

# cp ./support/Config/argus.conf /etc/argus.conf 
# chmod 600 /etc/argus.conf

 

After this you will need to modify the sample configuration in order to activate the collection of audit records. You should uncomment the entry #ARGUS_OUTPUT_FILE="/usr/argus/data/argus.out". And, of course, if you prefer, definitely modify the value for the destination filname for your installation.

This should handle the basic installation.

 

Configuration

9.1 How do I configure Argus?

For most uses, Argus requires only a few simple configuration variables to do its work. For the custom minded, Argus supports a large number of options.

Argus accepts configuration options on the command line, but Argus is generally configured using the argus.conf file that is normally found in either /etc or $ARGUSHOME. The variables that are set by this file can be overriden by the use of command line switches. And on the command line you can specify an alternative configuration file that is specified using the "-F configfile" option.

You can also eliminate any configuration directives in the /etc/argus.conf file by using the -X option on the commandline, so you have a lot of flexibility.

To setup a /etc/argus.conf file, copy the example configuration to /etc and modify its values accordingly.

9.2 Are there sample configurations?

Yes, ./support/Config/argus.conf is the best sample configuration file, and it provides extensive descriptions of the options and their default settings. This sample file sets most of the common options needed to run Argus as a system daemon. Look at the values and set them according to your specific needs. Guidelines are provided in the text of the sample file.

9.3 Can I configure argus to write output to more than one file?

Yes, Argus supports writing to up to 5 outputs, mixed between output files and remote sockets. And each file can have its own independant filter. If you want all TCP transaction audits to go into a TCP output file, and all other records to go to another file, no problem.

argus -w tcp.file "tcp" -w nottcp.file "not tcp"

In the argus.conf file, you can have upto 5 ARGUS_OUTPUT_FILE entries.

9.4 What do I need to configure?

Minimally, the only thing you need to configure is is "where do you want Argus to send its output?" For most sites the default values for all options will be fine.

Argus can either write its output to a file, or to offer remote access via a socket, or both. Most sites will want to write Argus output to a file, some will want to offer access to Argus data via the network. Security issues abound here, so turn on remote access with some caution.

 

Running Argus

10.1 How do I run Argus?

Argus is run either as a persistant daemon, reading live packets from a network interface, or as a user program, reading packets from a packet capture file. The default, i.e. when it is run without any configuration, is to run as a daemon.

If everything is installed properly, and the /etc/argus.conf file is configured correctly, all you need to run argus is:

# argus

This will cause Argus to look for a configuration file in /etc/argus.conf or in the $ARGUSPATH, or $ARGUSHOME directory, parse it and then open the network interface to begin reading packets. Argus will write its output to whatever outputfile is specified in the /etc/argus.conf file.

If you intend to remotely attach to this Argus, you'll need to tell Argus what port to put a listen down on. The default port for clients is port 561. We recommend using this port number. 

# argus -P 561 -w outputfile

In order to configure Argus to read packets from a packet capture file, use the "-r" option.

% argus -r ./packetfile

Argus has a large number of options, which can be set through an .Argusrc file, the use of command line options, or through a separate configuration file that is specifed at run time. These options are designed to specify things like, what type of information Argus should capture, how often it should generate output records, whether it should put the network interface in promiscuous mode when run, should it create a pid file, etc... The complete list is described in the argus.8 man page.

10.2 Do I need to be root to run Argus?

When run as a user program, if you intend to read packets from a live interface, you will need to have root privledges to either open the device, or to put the interface in promiscuous mode.

To have Argus read packet capture files and generate flow transaction report records, no you do not need to be root.

10.3 Can I have Argus start at boot time?

Most installations will want to start Argus as a daemon at boot time, and the ./support/Startup/argus file is designed to help support this. This needs to be configured by a Unix system administrator, using tools such as chkconfig.

See the README file in ./support/Startup for instructions for doing this.

10.4 What are some simple examples to show me how to run Argus?

To read packets from a file and to pipe the binary output to standard out. 

% argus -r filename -w -

To capture 64 bytes of User data for each transaction. 

% argus -U 64

To specify a particular interface (eth1) for packet capture. 

# argus -i eth1

To tell Argus to include the MAC addresses in each network flow transaction report.

% argus -m

To assign an IP address as the probes ID. 

% argus -e 128.64.1.2

To cause Argus to generate response time data network flows. This will generate more audit records per flow for flows like ICMP echo request/response flows. 

% argus -R

To have Argus generate status records for active network flows every 10 seconds, which may be useful for some flow analysis techniques. 

% argus -S 10

10.5 How do you run Argus on your systems?

argus -e `hostname` -P 561 -U256 -mRS 5

and then we collect the data using radium().

 

Security Considerations

11.1 Is there any type of access control for a remote Argus?

Argus can use two types of access control. The first is provided by tcp_wrappers() and the other is provided by SASL.

tcp_wrappers() provides a mechanism where you can specify what hosts can access the Argus. This is an excellent utility, and should be a part of any system. ./configure will find a tcp_wrappers directory if one is available in the configure path, so inclusion of tcp_wrappers access control in automatic.

SASL provides authentication and authorization when accessing argi. This is very important stuff when accessing remote real-time Argus data.

11.2. Where can I get tcp-wrappers()?

ftp://ftp.porcupine.org/pub/security/tcp_wrappers_7.6.tar.gz

11.3. Is there any confidentiality protection for Argus data on the wire?

When you access remote real-time Argus data, there may be a need to encrypt the data. Argus data does provide a rich source of information for the network administrator, but it will also provide a good source of information for the would-be intruder.

On the wire confidendiality is provided by the SASL package. ./configure is designed to find SASL and enable it automatically.

11.4. Where can I get SASL?

ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.24rc1.tar.gz

 

Sample Client Programs

12.1 What is ra()?

ra (read Argus), is the principal program for reading and printing Argus data. All other ra* programs share the same options and run time behavior as ra(). 12.2 What is racount()?

12.2 What is racount()?

racount will read Argus data and print out an accounting of the records and the data they contain. This is a pretty minimal program, but it is very handy for checking that Argus and its client programs are accurate in the packet and byte counts that are reported.

12.3 What is rasort()?

rasort() sorts Argus data records, based on a large number of sorting criteria. The criteria are:

startime, lasttime, duration, srcaddr, dstaddr, proto, sport, dport, stos, dtos, sttl, dttl, bytes, srcbytes, dstbytes, packets, srcpackets and dstpackets.

rasort sorts based on the order of selection criteria on the command line, which defines the sorting precedence.

rasort -s dstaddr -s dport -s packets -r Argus.file - tcp

This will sort the tcp based transaction records that are in Argus.file based on destination address, and if the addresses are equal, it will sort based on the destination port number, and when both of these criteria are equal, it will futher sort based on the number of packets seen in the transaction.

12.4 What is raxml()?

raxml() prints the contents of Argus records as XML data.

12.5 What is ramon()?

ramon() is designed to support the two primary groups of an RMON2 probe. Thus the name RaMON(). These groups are the TopN and the Matrix group. The RMON TopN provides a table of the the top "talking" IP addresses with packet and bytes counts, and the Matrix group provides a table fo the top "talking" pairs of IP addresses.

ramon() supports 'TopN' and 'Matrix" modes of operation, which give you the top talker (TopN) and top pair of talkers (Matrix). Ramon reads Argus data, and aggregates the data based on the group being supported, and outputs modified Argus data, so other ra*() programs can operate on the output.

ramon() sorts its output based on byte count. If you would rather have any other sorting basis, use rasort() on the ramon() output to sort it however you like.

Use the '-N' option to specify how many talkers you want. Zero (0) will give you all of them.

To see the TopN 25 talkers, based on byte count, on a link between 2pm and 2:15 pm, getting Argus data from the file .

ramon -TopN -N 25 -t 2-2:15 -r

To see the TopN 25 clients based on on source packet count,

ramon -w - -TopN -r Argusfile | rasort -N 25 -s srcpackets

To see the TopN 10 talkers if you removed host from the network

ramon -TopN -N 10 -r Argusfile - not host

12.6 What is rapath?

/* Answers in progress */ 

12.7 What is ragator?

 /* Answers in progress */

 

Archiving

14.1. Can I compress Argus log files?

All ra* based clients can read compressed (.gz, .bz2 or .Z) Argus data files. This allows you to store your Argus data files using gzip(1), bzip2(1) or compress(1).

This provides in general 3-4:1 compression.

Also, all ra* based clients can read data from stdin, using the "-r -" option, so you can pipe the output of uncompress utilities directly into ra* programs. This should allow for flexibility in the type of compression to use.

14.2. Can I process/archive the Argus output file while Argus is running?

Argus allows for removing its output file, "on the fly". Argus will recover by recreating its output file, accordingly. This allows you to "pull" the data file away from an Argus daemon for processing, archiving, whatever.

The Argus package includes a sample program for managing Argus logs that takes advantage of this behavior. The very simple sh script is ./support/Archive/argusarchive. This program will simply rename a well known Argus output file, sort and compress its output, and then move to into a calender structured filesystem.

This is just a sample program, but it does do a pretty good job.

The idea is to have cron(8) execute this type of program on a time basis.

There is a sample crontab entry for this in the ./support/System directory, that calls argusarchive every hour.

14.3. Can you suggest a daily log reporting configuration?

 /* Answers in progress */

14.4. What about storing Argus logs in a database?

/* Answers in progress */

3. What does Argus data look like?

Argus is pretty lazy as to when it will print out its records. This is so Argus will have maximum cycles for packet processing, rather than data output. Argus can be easily tuned to be more timely in reporting audit events, but without that tuning, Argus could take as long as 30-120 seconds to print out a particular record, depending on the load of the Argus, the protocol and when the last packet was seen.

Because of this, Argus presents an interesting time map for its data events. I'll try to draw a graph. The Ax are Argus records in output order. The bars are the times that the data covers. The A's on the X axis are the times when the A records are actually reported.

A1 +      +---------+
A2 +                    +---+
A3 +                                      ++
A4 +  +---+
A5 +                             +----+
   |
   +----+----+----+----+----+----+----+----+----+----+
        5    10   15   20   25   30   35   40   45   50
                        secs               A A A A A
                                            1 2 3 4 5

Examples

There are a lot of things you can do with argus data. This list of examples is not comprehensive, by any measure, but should get you past the basics and into some interesting projects. If there is anything that you have done, that you would like included in the list, or if there is something that you would like described, and not sure how to go about it, please send email to the developer's list, and we'll add it !!

The first set of examples are demonstrations for using argus and the argus-client programs. This is a work in progress, so if the example you're looking for is missing, send email to the developer's list.

The second set are examples of how to graph argus data using either ragraph(), gnuplot() or other general purpose graphing programs. Some examples will assume some experience with argus data. Hopefully you will find them useful..

Manuals

Man page documentation for argus.

argus generate flow records from packet data
argus.conf argus system configuration file

Man page documentation for radium, the argus data collection and distribution system.

radium argus data collection, analytics and distribution
radium.conf radium system configuration file

Man page documentation for argus data clients.

ra read, filter and print argus data
rarc ra* program configuration file
rabins process argus data into structured 'bins'
racluster aggregate argus data
racluster.conf racluster configuration file
racolor.conf ratop color configuration file
raconvert convert ascii flow data into argus record format
racount tally objects in argus data stream
radecode tshark-like decode of argus user data
radump decode user data buffers using tcpdump decoders
raevent read argus generated events
rafilteraddr high performance argus data filtering
ragraph time series graphing (rrd-tool based)
ragrep regular expression matching from captured user data
rahisto frequency distribution analysis for argus data metrics
ralabel semantic enahancemet / metadata tagging
ralabel.conf ralabel configuration file
ranonymize argus data anonymization
ranonymize.conf ranonymize configuration file
rapath print topology information derived from argus data
rapolicy continuous access control policy verification
rasort sort argus data
rasplit split argus data into structured OS based files
rasql read native argus data from mysql database tables
rasqlinsert insert and read argus data from/to mysql data tables
rasqltimeindex index argus data files by time
rastream argus data stream block processing
rastrip argus data manipulation and compression
ratop display and update sorted network flow data

Copyright

Argus-3.0 is a derivative work of argus-2.0 and uses technology developed for libpcap tcpdump, tcp_wrappers-6.3, and GNU software.

Thanks continue to go to the principle authors of these packages, Steve McCanne (This email address is being protected from spambots. You need JavaScript enabled to view it.), Craig Leres (This email address is being protected from spambots. You need JavaScript enabled to view it.), Van Jacobson (This email address is being protected from spambots. You need JavaScript enabled to view it.) and Wietse Venema (This email address is being protected from spambots. You need JavaScript enabled to view it.) for their exceptional work, without which, Argus would have had to do a lot more work.

Along with the author contact information, we have included the copyrights and licensing terms that apply to the various components of Argus. Please refer to the individual packages, for specific use and redistribution limitations thsat may apply.

Argus 3.0 
This email address is being protected from spambots. You need JavaScript enabled to view it.

Copyright (c) 2000 - 2011 QoSient, LLC 
All rights reserved.

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of QoSient not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.

QOSIENT, LLC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL QOSIENT, LLC BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Argus 1.5
Carnegie Mellon University
This email address is being protected from spambots. You need JavaScript enabled to view it.

Copyright (c) 1993, 1994, 1995 Carnegie Mellon University.
All rights reserved.

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of CMU not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.

CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.


LIBPCAP 0.4
Lawrence Berkeley National Laboratory
Network Research Group
This email address is being protected from spambots. You need JavaScript enabled to view it.
ftp://ftp.ee.lbl.gov/libpcap.tar.Z
- Steve McCanne (This email address is being protected from spambots. You need JavaScript enabled to view it.)
- Craig Leres (This email address is being protected from spambots. You need JavaScript enabled to view it.)
- Van Jacobson (This email address is being protected from spambots. You need JavaScript enabled to view it.)

TCPDUMP 3.4
Lawrence Berkeley Laboratory
Network Research Group
This email address is being protected from spambots. You need JavaScript enabled to view it.
ftp://ftp.ee.lbl.gov/tcpdump-.tar.Z
- Steve McCanne (This email address is being protected from spambots. You need JavaScript enabled to view it.)
- Craig Leres (This email address is being protected from spambots. You need JavaScript enabled to view it.)
- Van Jacobson (This email address is being protected from spambots. You need JavaScript enabled to view it.)

Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
The Regents of the University of California.
All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement:

This product includes software developed by the Computer Systems Engineering Group at Lawrence Berkeley Laboratory.

4. Neither the name of the University nor of the Laboratory may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.v /

tcp_wrappers-7.6
ftp://ftp.win.tue.nl/pub/security
ftp://info.cert.org/pub/tools
Wietse Venema (This email address is being protected from spambots. You need JavaScript enabled to view it.)
Department of Mathematics and Computing Science
Eindhoven University of Technology
P.O. Box 513
5600 MB Eindhoven
The Netherlands

No copyright available.

CMU libsasl
Tim Martin
Rob Earhart

Copyright (c) 2000 Carnegie Mellon University. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. The name "Carnegie Mellon University" must not be used to endorse or promote products derived from this software without prior written permission. For permission or any other legal details, please contact

Office of Technology Transfer
Carnegie Mellon University
5000 Forbes Avenue
Pittsburgh, PA 15213-3890
(412) 268-4387, fax: (412) 268-7395
This email address is being protected from spambots. You need JavaScript enabled to view it.

4. Redistributions of any form whatsoever must retain the following acknowledgment:

"This product includes software developed by Computing Services at Carnegie Mellon University (http://www.cmu.edu/computing/)."

CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. /

Changes

The argus and argus-clients package have changed quite a bit from argus-2.x and argus-3.0.4 releases. Here is the list of modifications from argus-3.0.x to argus-3.0.8.