Ubuntu install vnstat console network traffic monitor

ADVERTISEMENTS



Step 1 – Ubuntu install vnstat using the apt/apt-get

How do I install vnstat is a console-based network traffic monitor on Ubuntu to keep a log of the 5-minute interval, hourly, daily, monthly, and yearly network traffic for the selected interface?In this guide, you will learn how to install vnstat on Ubuntu Linux version 16.04, 18.04, and 20.04 LTS based desktop or server. It is a free and open-source console-based network traffic monitor tool. It is not a packet sniffer. The vnStat can be used even without root permissions. Let us see how to set up vnstat on Ubuntu box.

Type the following apt command/apt-get command to update the system:

sudo apt update

sudo apt upgrade

Search for vnstat package, enter:

apt show vnstat

Sample outputs:

Package: vnstat Version: 2.6 - 1 Priority: optional Section: universe/net Origin: Ubuntu Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com> Original-Maintainer: Christian Göttsche <cgzones@googlemail.com> Bugs: https://bugs.launchpad.net/ubuntu/+filebug Installed-Size: 310 kB Pre-Depends: init-system-helpers ( > = 1.54~ ) Depends: libc6 ( > = 2.29 ) , libsqlite3-0 ( > = 3.7.6.1 ) , adduser, lsb-base Suggests: vnstati Homepage: https://humdi.net/vnstat/ Download-Size: 88.9 kB APT-Sources: http://mirrors.linode.com/ubuntu focal/universe amd64 Packages Description: console-based network traffic monitor vnStat is a network traffic monitor for Linux. It keeps a log of daily network traffic for the selected interface ( s ) . vnStat is not a packet sniffer. The traffic information is analyzed from the /proc filesystem, so vnStat can be used without root permissions. Package: vnstat Version: 2.6-1 Priority: optional Section: universe/net Origin: Ubuntu Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com> Original-Maintainer: Christian Göttsche <cgzones@googlemail.com> Bugs: https://bugs.launchpad.net/ubuntu/+filebug Installed-Size: 310 kB Pre-Depends: init-system-helpers (>= 1.54~) Depends: libc6 (>= 2.29), libsqlite3-0 (>= 3.7.6.1), adduser, lsb-base Suggests: vnstati Homepage: https://humdi.net/vnstat/ Download-Size: 88.9 kB APT-Sources: http://mirrors.linode.com/ubuntu focal/universe amd64 Packages Description: console-based network traffic monitor vnStat is a network traffic monitor for Linux. It keeps a log of daily network traffic for the selected interface(s). vnStat is not a packet sniffer. The traffic information is analyzed from the /proc filesystem, so vnStat can be used without root permissions.

Installation

Execute the following command to set up and install vnstat on Ubuntu server:

sudo apt-get install vnstat

OR

sudo apt install vnstat



Step 2 – Configure vnstat

The default database directory for each interface located at the following location (use the ls command/cd command):

cd /var/lib/vnstat/

ls -l /var/lib/vnstat/

Sample outputs:

total 4 -rw-r--r-- 1 vnstat vnstat 2792 Apr 23 19:28 eth0

Use the ip command to find out your interface name:

ip l show

ip a show

1 : lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2 : enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 40 :9f: 38 : 28 :f6:b5 brd ff:ff:ff:ff:ff:ff 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 40:9f:38:28:f6:b5 brd ff:ff:ff:ff:ff:ff

Note down the interface name enp0s31f6. We need edit the /etc/vnstat.conf file using a text editor such as nano or vim:

sudo nano /etc/vnstat.conf

Set default interface name to enp0s31f6 (or eth0 on older Ubuntu systems):

Interface "enp0s31f6"

We can customize date output formats as follows:

DayFormat "%Y-%m-%d" MonthFormat "%Y-%m" TopFormat "%Y-%m-%d" DayFormat "%Y-%m-%d" MonthFormat "%Y-%m" TopFormat "%Y-%m-%d"

Set data retention durations policy (use -1 for unlimited and 0 to disable it)

5MinuteHours 48 HourlyDays 4 DailyDays 62 MonthlyMonths 25 YearlyYears - 1 TopDayEntries 20 5MinuteHours 48 HourlyDays 4 DailyDays 62 MonthlyMonths 25 YearlyYears -1 TopDayEntries 20

Save and close the file.

Step 3 – Enable and start the vnstat service

We are going to use the systemctl command to control the systemd system such as vnstat.service on Ubuntu Linux. The syntax to enable service is as follows:

sudo systemctl enable vnstat.service

Start the vnstat service

sudo systemctl start vnstat.service

Stop the vnstat service

sudo systemctl stop vnstat.service

Restart/reload the vnstat service

After editing the /etc/vnstat.conf, we must restart or reload the service:

sudo systemctl restart vnstat.service

OR

sudo systemctl reload vnstat.service

Find the status of vnstat service

sudo systemctl status vnstat.service



Step 4 – Viewing network traffic graphs

We have two parts here as follows:

vnstatd daemon – Background service that monitors and updates interface database as per /etc/vnstat.conf file. vnstat command – Command line tool for sysadmins/developers for querying the traffic information stored by the vnstatd daemon. In other words, we need to use the vnstat command.

Let us type the following command on Ubuntu box to query vnstat database:

vnstat

Sample outputs from the newly installed system:

Database updated: 2020 -04- 23 19 : 39 :00 eth0 since 2020 -04- 23 rx: 94.30 KiB tx: 113.71 KiB total: 208.01 KiB monthly rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 2020 -04 94.30 KiB | 113.71 KiB | 208.01 KiB | 0 bit/s ------------------------+-------------+-------------+--------------- estimated -- | -- | -- | daily rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- today 94.30 KiB | 113.71 KiB | 208.01 KiB | 24 bit/s ------------------------+-------------+-------------+--------------- estimated 114 KiB | 138 KiB | 252 KiB | Database updated: 2020-04-23 19:39:00 eth0 since 2020-04-23 rx: 94.30 KiB tx: 113.71 KiB total: 208.01 KiB monthly rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 2020-04 94.30 KiB | 113.71 KiB | 208.01 KiB | 0 bit/s ------------------------+-------------+-------------+--------------- estimated -- | -- | -- | daily rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- today 94.30 KiB | 113.71 KiB | 208.01 KiB | 24 bit/s ------------------------+-------------+-------------+--------------- estimated 114 KiB | 138 KiB | 252 KiB |

We can select interface as follows:

vnstat -i eth0

Want to display traffic summary for a merge of interfaces eth0, eth2 and eth3? Try:

vnstat -i eth0+eth1+eth3

We can output all information about VPN interface tun0 in xml format:

vnstat -i tun0 --xml

How about json format? Try:

vnstat --json

The following two special options can only be used with --json , --xml and list outputs. Pass the -b option to begin the list output with a specific date / time defined by date instead of the begin being selected based on the number of entries to be shown. The date can be in YYYY-MM-DD HH:MM and YYYY-MM-DD formats only. Another option is to pass the -e to set up end date:

vnstat -b {YYYY-MM-DD} -i {interface} --xml

vnstat -e {YYYY-MM-DD} -i {interface} --json

It is possible to remove database entries for interface eth1 and stop monitoring it using the following format:

vnstat -i eth1 --remove

View hourly traffic stats

vnstat -h

vnstat -i eth0 -h



View daily (days) traffic stats

vnstat -d

vnstat -i tun0 -d



Show monthly traffic stats

vnstat -m



Display yearly traffic stats

vnstat -y



enp0s31f6 / yearly year rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 2019 382.24 GiB | 78.11 GiB | 460.35 GiB | 125.39 kbit/s 2020 834.28 GiB | 345.17 GiB | 1.15 TiB | 1.03 Mbit/s ------------------------+-------------+-------------+--------------- estimated 2.61 TiB | 1.08 TiB | 3.70 TiB | enp0s31f6 / yearly year rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 2019 382.24 GiB | 78.11 GiB | 460.35 GiB | 125.39 kbit/s 2020 834.28 GiB | 345.17 GiB | 1.15 TiB | 1.03 Mbit/s ------------------------+-------------+-------------+--------------- estimated 2.61 TiB | 1.08 TiB | 3.70 TiB |



The above indicate traffic statistics on a yearly basis for the last years.

Show top traffic days

vnstat -t

vnstat -i eth0



How to show current transfer rate for the selected interface in real time until interrupted

Another nifty option that shows live network transfer rate and statistics will be shown after interruption if the runtime was more than 10 seconds:

vnstat -l

vnstat -i tun0 -l

vnstat -i eth0 -l



Getting help

Type the following man command:

man vnstat

vnstat --help

vnstat --longhelp

vnStat 2.6 by Teemu Toivola <tst at iki dot fi> - 5 , --fiveminutes [ limit ] show 5 minutes -h, --hours [ limit ] show hours -hg, --hoursgraph show hours graph -d, --days [ limit ] show days -m, --months [ limit ] show months -y, --years [ limit ] show years -t, --top [ limit ] show top days -b, --begin <date> set list begin date -e, --end <date> set list end date --oneline [ mode ] show simple parsable format --json [ mode ] [ limit ] show database in json format --xml [ mode ] [ limit ] show database in xml format -tr, --traffic [ time ] calculate traffic -l, --live [ mode ] show transfer rate in real time -i, --iface <interface> select interface vnStat 2.6 by Teemu Toivola <tst at iki dot fi> -5, --fiveminutes [limit] show 5 minutes -h, --hours [limit] show hours -hg, --hoursgraph show hours graph -d, --days [limit] show days -m, --months [limit] show months -y, --years [limit] show years -t, --top [limit] show top days -b, --begin <date> set list begin date -e, --end <date> set list end date --oneline [mode] show simple parsable format --json [mode] [limit] show database in json format --xml [mode] [limit] show database in xml format -tr, --traffic [time] calculate traffic -l, --live [mode] show transfer rate in real time -i, --iface <interface> select interface

Conclusion

You learned how to set up and install vnstat to get detailed stats about your network traffic. I find this tool very useful to keep track of traffic, and any sudden surge can be further investigated for DoS/DDoS or bot activity on web servers. I also install it on pfSense or Linux based home router to keep track of my bandwidth usage espcially when connected vi 5G/4G/LTE dongle. See vnstat project home page for more information.

