# Terminal

**English** · [Português](pt-BR/cli.md)

The `acaua` binary serves both as the CLI command runner and the background daemon.
This page describes the commands available in the engine.

```text
acaua <command> [options]

Commands:
  serve    Start the API and embedded web dashboard
  analyze  Analyze a Zeek log directory
  doctor   Check the local environment
  update   Check for available releases
```

## `acaua serve`

Starts the HTTP API and the embedded web dashboard.

```bash
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
```

| Option | Default | Meaning |
|---|---|---|
| `--bind` | `127.0.0.1:8787` | Listen address |
| `--data-dir` | `.acaua` | Store and runtime files |

The default bind is loopback-only. Exposing the daemon on a network requires a
reverse proxy with authentication. The API is documented in
[architecture.md](architecture.md#api).

## `acaua analyze`

```bash
acaua analyze /var/log/zeek/current
acaua analyze /var/log/zeek/current --json
```

Validates the target directory, ingests `conn.log` traffic into Parquet partitions,
and runs threat detection algorithms.

## `acaua doctor`

```bash
acaua doctor
acaua doctor --json
```

Runs environment checks:
- `zeek`: verifies `zeek --version` or detects containerized execution (`ACAUA_RUNTIME=container`).
- `curl`: confirms HTTP download availability.
- `duckdb`: confirms dynamic linkage against `libduckdb.so` in runtime.
- `research`: verifies that the research workspace remains isolated.

## `acaua update`

```bash
acaua update
```

Queries the Gitea Releases API, compares the latest tag against the running
version, and prints upgrade instructions (`docker compose pull && docker compose up -d`
when running inside a container).

## Exit codes

| Code | Meaning |
|---|---|
| `0` | Success |
| `1` | Runtime error (invalid path, query error, I/O error) |
| `2` | Invalid command-line usage (clap) |

## Environment

| Variable | Meaning |
|---|---|
| `ACAUA_RUNTIME` | Set to `container` inside Docker images to adapt service checks |
| `DUCKDB_LIB_DIR` | Path to directory containing `libduckdb.so` when compiling natively |
| `LD_LIBRARY_PATH` | Shared library load path for `libduckdb.so` outside standard paths |