Getting Started

Once you’ve installed CaudalGhost, it’s already measuring: the daemon runs as a system service (systemd) and starts logging traffic automatically.

Check that the daemon is running

systemctl status caudalghostd

You should see active (running). The service starts on its own whenever the machine boots.

Open the GUI (Desktop edition)

Look for CaudalGhost in your application menu and open it. It connects to the daemon on its own (auto-detecting the socket); you don’t need sudo or to pass in any path.

The GUI has two modes, Live and Historical, plus a breakdown by Hosts. See the GUI Guide.

Use the CLI (any edition)

From the terminal, no sudo required:

# Traffic right now, by interface:
caudalghost now

# Cumulative totals:
caudalghost total

# Top apps by usage:
caudalghost top

# Historical series over a range (e.g., the last hour):
caudalghost serie 1h

# Interactive live dashboard (in the terminal):
caudalghost live

# Remote servers (hostnames) with traffic:
caudalghost hosts

In caudalghost live: press q to quit, p to pause, a to include lo (loopback), u to switch units.

Most commands support options to tweak the output: format with -o (json, csv, ndjson), units with -u, row limit with -n/--limit, sort order with --sort, and --watch to repeat the query at set intervals. Full details on every option in the CLI Guide.

What about the data?

Everything it logs is stored in SQLite, on your own machine, under /var/lib/caudalghost. Nothing gets transmitted anywhere. See Privacy and Data.