procmond [OPTIONS]

### Configuration
procmond is orchestrated by daemoneye-agent; collectors do not consume component-specific configuration files. When the binary is launched directly (for example during development or troubleshooting) it honours the following sources:
1. Command-line flags (highest precedence)
2. Environment variables (`PROCMOND_*` — legacy, maintained for backward compatibility)
3. System DaemonEye configuration file (`/etc/daemoneye/config.toml`)
4. Embedded defaults (lowest precedence)<br>Per-user configuration is not supported for collectors; only the operator-facing CLI honours user-scoped overrides when invoked directly.<br>Operators should configure collection behaviour through the agent, which materialises these settings when spawning the collector.
### Exit Codes
\<table header-row="true"\><br>\<tr\><br>\<td\>**Code**\</td\><br>\<td\>**Description**\</td\><br>\</tr\><br>\<tr\><br>\<td\>0\</td\><br>\<td\>Success\</td\><br>\</tr\><br>\<tr\><br>\<td\>1\</td\><br>\<td\>Unhandled error returned from the runtime (includes configuration, permission, database)\</td\><br>\</tr\><br>\<tr\><br>\<td\>2\</td\><br>\<td\>CLI argument parsing failure reported by clap\</td\><br>\</tr\><br>\</table\>
</table>
## daemoneye-agent
The detection orchestrator that manages procmond lifecycle, executes detection rules, and handles alerting.
### Usage
```javascript
daemoneye-agent [OPTIONS]

### Environment Variables
\<table header-row="true"\><br>\<tr\><br>\<td\>**Variable**\</td\><br>\<td\>**Description**\</td\><br>\</tr\><br>\<tr\><br>\<td\>`DAEMONEYE_AGENT_TEST_MODE`\</td\><br>\<td\>Set to 1 to enable test mode (immediate exit)\</td\><br>\</tr\><br>\</table\>
</table>
### Features
- **Embedded EventBus Broker**: Runs daemoneye-eventbus broker for multi-collector coordination
- **IPC Server**: Provides IPC server for CLI communication via protobuf over Unix sockets/named pipes
- **IPC Client**: Communicates with procmond via protobuf over Unix sockets/named pipes
- **Detection Engine**: Executes SQL-based detection rules against collected data
- **Alert Management**: Multi-channel alert delivery (stdout, syslog, webhooks, email)
- **Graceful Shutdown**: Handles SIGTERM/SIGINT for clean shutdown
### Configuration
daemoneye-agent supports hierarchical configuration loading:
1. Command-line flags (highest precedence)
2. Environment variables (`DAEMONEYE_AGENT_*`)
3. User configuration file (`~/.config/daemoneye/config.toml`)
4. System configuration file (`/etc/daemoneye/config.toml`)
5. Embedded defaults (lowest precedence)
## daemoneye-cli
The command-line interface for querying database statistics, health checks, and system management.
### Usage
```javascript
daemoneye-cli [OPTIONS]

### Output Formats<br>#### Human Format
```javascript
DaemonEye Database Statistics
============================
Processes: 1234
Rules: 5
Alerts: 42
System Info: 1
Scans: 100
Health status: Healthy

{
  "processes": 1234,
  "rules": 5,
  "alerts": 42,
  "system_info": 1,
  "scans": 100,
  "health_status": "Healthy"
}

# Terminal 1: Start the orchestrator
daemoneye-agent --log-level info

# Terminal 2: Monitor database statistics
watch -n 5 'daemoneye-cli --format json'

# Terminal 3: Run procmond directly (optional)
procmond --enhanced-metadata --compute-hashes

# Test procmond collection
procmond --interval 5 --max-processes 10 --log-level debug

# Test agent in test mode
DAEMONEYE_AGENT_TEST_MODE=1 daemoneye-agent

# Check database growth
daemoneye-cli --format json | jq '.processes'

# Start agent as service
systemctl start daemoneye-agent

# Monitor health
daemoneye-cli --format json | jq '.processes, .alerts'

# Check logs
journalctl -u daemoneye-agent -f

# Bash
daemoneye-cli --generate-completion bash > /etc/bash_completion.d/daemoneye-cli

# Zsh
daemoneye-cli --generate-completion zsh > ~/.zsh/completions/_daemoneye-cli

# Fish
daemoneye-cli --generate-completion fish > ~/.config/fish/completions/daemoneye-cli.fish

# PowerShell
daemoneye-cli --generate-completion powershell > DaemonEye.ps1

### Docker Deployment
```docker
FROM rust:1.87-slim as builder
COPY . /app
WORKDIR /app
RUN cargo build --release

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/target/release/daemoneye-agent /usr/local/bin/
COPY --from=builder /app/target/release/daemoneye-cli /usr/local/bin/
COPY --from=builder /app/target/release/procmond /usr/local/bin/
VOLUME ["/data"]
CMD ["daemoneye-agent", "--database", "/data/processes.db"]

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: daemoneye
spec:
  selector:
    matchLabels:
      app: daemoneye
  template:
    metadata:
      labels:
        app: daemoneye
    spec:
      hostPID: true
      containers:
        - name: daemoneye-agent
          image: daemoneye/daemoneye:latest
          securityContext:
            privileged: true
          volumeMounts:
            - name: data
              mountPath: /data
            - name: proc
              mountPath: /host/proc
              readOnly: true
      volumes:
        - name: data
          hostPath:
            path: /var/lib/daemoneye
        - name: proc
          hostPath:
            path: /proc