Using VnStat To Monitor Your Network Traffic In Linux

When we consider monitoring tools, we often think about tools that monitor your processes and resource usage such as disk space, memory and CPU load. However, network bandwidth usage of your server is of equal importance. So, in this article we’ll be looking at VnStat – the lightweight command line network monitoring tool.
VnStat is made up of multiple parts:

• The VnStatd daemon: this runs in the background on your server monitoring the network traffic and logging statistics to a database
• The VnStat command: used to analyze the information logged in the database and display the information at the command line. The VnStat command also performs the same tasks as the vnstat command apart from the output being in the form of a .png image rather than a text output to the screen.

Installing VnStat for Server Monitoring

VnStat comes in the standard repositories for Debian and Ubuntu Linux distributions, so installation is simple. On Debian and Ubuntu based distributions this is done using the following commands:
sudo apt-get update
sudo apt-get install vnstat
For CentOS and Red Hat distributions you’ll need to enable the EPEL repositories first with:
sudo yum install epel-release
sudo yum update
Then install with:
sudo yum install vnstat
With the install complete, the VnStatd daemon should start collecting data for the statistics. To confirm that it is running use this command:
sudo systemctl status vnstat
If it isn’t running, then enable and start it with:
sudo systemctl enable vnstat
sudo systemctl start vnstat

Understanding VnStat

VnStat itself has a number of built-in views that it can use to display the statistics. As these are mostly time based, it will take time for the system to build up meaningful statistics for you to examine for a number of the views. The various views can be selected with flags. Running without any flags gives a default overview:
-h Hourly, provides a view of network traffic by hours.
-d Daily, provides a view of network traffic by days.
-w Weekly, provides a view of network traffic by weeks.
-m Monthly, provides a view of network traffic months.
-t Top 10, shows the ten days with the largest network traffic in the logs.
-l Show live traffic data.
-i Used to select which network interface to show traffic for if you have more than one configured.
So for example, the following command would give a breakdown of bandwidth usage on a daily basis for your server:
vnstat -d
Note, if you have more than one network interface on your server, you can choose which with the -i flag. This is demonstrated with the following command which will provide the daily view for the eth0 network interface:
vnstat -d -i eth0
While most of the statistic views offered by vnstat are historical, you can use the -l flag to get a real-time overview of the live system traffic.
The vnstati command works in much the same way as the vnstat command. The only difference is that you need to provide the -o flag with a path to where you want the image to be saved. For example:
vnstati -h -o /var/www/html/vnstat/hourly.png
The above command generates an hourly statistic report and saves the data in the /var/www/html/vnstat/hourly.png file.
VnStat does, however, lack the ability to have regularly updated charts of network traffic automatically created. This can be easily rectified by setting up a BASH script or multiple cron tasks to generate the images for you, and place them somewhere within the webroot directories on your server. This action allows you to easily view the data without having to first log in and run the commands yourself. There are also a number of front-end tools that can be used such as the PHP website front end from Sqweek.com.