CLI Reference

CLI Reference

All flags of process_analyzer_allinone.py. Run --help for the authoritative, up-to-date list.

Core options

Option	Default	Description
--html-output PATH	process_graph_3d.html	Path of the interactive 3D HTML (generated by default)
--no-html	—	Disables 3D graph generation (not recommended, it is the only default output)
--png	—	Also generates a static PNG
--output PATH	process_graph.png	Path of the PNG, used only with --png
--json-export PATH	—	Exports the collected/enriched/risk data as JSON
--csv-export PATH	—	Exports as CSV, one line per process
--report PATH	—	Writes a Markdown summary report
--model NAME	llama3.2 (llama3.2:1b on Android)	Ollama model to use
--ollama-host URL	http://localhost:11434	Ollama API URL
--enrich-limit N	25	Max AI-enriched processes, sorted by CPU+RAM activity
--enrich-all	—	Enriches every collected process
--no-enrich	—	Disables the Ollama call entirely (rule-based risk stays active)
--min-score N	0	Minimum score (cpu%+mem%) to include a process
--max-processes N	no limit	Max processes in the graph (keeps the most active)
--max-conn-per-process N	20	Max raw network connections collected per process
--max-conn-total N	300	Max connection edges drawn in total
--max-workers N	2	Parallelism of Ollama calls
--timeout N	120	Timeout per Ollama call, in seconds
-v, --verbose	—	DEBUG-level logs

Execution modes

Option	Default	Description
--watch	—	Continuous monitoring: periodic re-collection (rules only, never Ollama in a loop), per-cycle diffs, HTML regenerated. Ctrl+C to stop
--interval N	60	Seconds between two --watch cycles (minimum 5)
--pid N	—	Forensic analysis of one process: detailed text report + analysis restricted to its subtree
--compare [PATH]	—	Compares to a snapshot: no value = previous run from history; path = a --json-export file
--history-file PATH	outputs/history.json	Automatic history (50 snapshots kept)
--no-history	—	Disables automatic snapshot recording
--sandbox PATH	—	Reads processes from a JSON file instead of the real system
--preload-model	—	Downloads/prepares the Ollama model then exits

Analysis and enrichment

Option	Default	Description
--config PATH	—	Whitelist/blacklist (YAML or JSON) — see Risk Engine
--check-integrity	—	SHA256 of each executable vs a reference database; a changed fingerprint = "high" signal
--integrity-db PATH	outputs/integrity.json	Fingerprint reference database
--baseline	—	CPU/RAM baseline per process name; >2σ deviations become anomaly signals (from 3 samples)
--baseline-file PATH	outputs/baseline.json	Baseline file
--cache	—	SQLite cache of Ollama enrichments (identical processes served without an LLM call)
--cache-file PATH	outputs/enrich_cache.sqlite3	Cache file
--cache-ttl-days N	7	Cache entry validity
--retry-failed N	0	Retries transiently failed enrichments (exponential backoff 1s/2s/4s)
--plugin PATH	—	Python plugin enrich(process_info: dict) -> dict applied to each process
--csv-edges PATH	—	Exports graph relationships as CSV (Gephi/Neo4j-ready)

Scheduled (cron) example

python3 process_analyzer_allinone.py \
  --no-enrich \
  --html-output "/var/log/process_graph/graph_$(date +%Y%m%d_%H%M).html" \
  --report "/var/log/process_graph/report_$(date +%Y%m%d_%H%M).md" \
  --csv-export "/var/log/process_graph/data_$(date +%Y%m%d_%H%M).csv"