Ubuntu install vnstat console network traffic monitor

How do I install vnstat is a console-based network traffic monitor on Ubuntu to keep a log of the 5-minute interval, hourly, daily, monthly, and yearly network traffic for the selected interface?

In this guide, you will learn how to install vnstat on Ubuntu Linux version 16.04, 18.04, and 20.04 LTS based desktop or server. It is a free and open-source console-based network traffic monitor tool. It is not a packet sniffer. The vnStat can be used even without root permissions. Let us see how to set up vnstat on Ubuntu box.
Tutorial requirements
Operating system/appUbuntu Linux
Root privileges requiredYes
DifficultyEasy (rss)
Estimated completion time5m
Table of contents

ADVERTISEMENTS

Step 1 – Ubuntu install vnstat using the apt/apt-get

Type the following apt command/apt-get command to update the system:
sudo apt update
sudo apt upgrade

Search for vnstat package, enter:
apt show vnstat
Sample outputs:

Package: vnstat
Version: 2.6-1
Priority: optional
Section: universe/net
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Christian Göttsche <cgzones@googlemail.com>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 310 kB
Pre-Depends: init-system-helpers (>= 1.54~)
Depends: libc6 (>= 2.29), libsqlite3-0 (>= 3.7.6.1), adduser, lsb-base
Suggests: vnstati
Homepage: https://humdi.net/vnstat/
Download-Size: 88.9 kB
APT-Sources: http://mirrors.linode.com/ubuntu focal/universe amd64 Packages
Description: console-based network traffic monitor
 vnStat is a network traffic monitor for Linux. It keeps a log of
 daily network traffic for the selected interface(s). vnStat is not
 a packet sniffer. The traffic information is analyzed from the /proc
 filesystem, so vnStat can be used without root permissions.

Installation

Execute the following command to set up and install vnstat on Ubuntu server:
sudo apt-get install vnstat
OR
sudo apt install vnstat
How to Ubuntu install vnstat using apt-get command

Step 2 – Configure vnstat

The default database directory for each interface located at the following location (use the ls command/cd command):
cd /var/lib/vnstat/
ls -l /var/lib/vnstat/

Sample outputs:

total 4
-rw-r--r-- 1 vnstat vnstat 2792 Apr 23 19:28 eth0

Use the ip command to find out your interface name:
ip l show
ip a show

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 40:9f:38:28:f6:b5 brd ff:ff:ff:ff:ff:ff

Note down the interface name enp0s31f6. We need edit the /etc/vnstat.conf file using a text editor such as nano or vim:
sudo nano /etc/vnstat.conf
Set default interface name to enp0s31f6 (or eth0 on older Ubuntu systems):
Interface "enp0s31f6"
We can customize date output formats as follows:

DayFormat    "%Y-%m-%d"
MonthFormat  "%Y-%m"
TopFormat    "%Y-%m-%d"

Set data retention durations policy (use -1 for unlimited and 0 to disable it)

5MinuteHours   48
HourlyDays      4
DailyDays      62
MonthlyMonths  25
YearlyYears    -1
TopDayEntries  20

Save and close the file.

Step 3 – Enable and start the vnstat service

We are going to use the systemctl command to control the systemd system such as vnstat.service on Ubuntu Linux. The syntax to enable service is as follows:
sudo systemctl enable vnstat.service

Start the vnstat service

sudo systemctl start vnstat.service

Stop the vnstat service

sudo systemctl stop vnstat.service

Restart/reload the vnstat service

After editing the /etc/vnstat.conf, we must restart or reload the service:
sudo systemctl restart vnstat.service
OR
sudo systemctl reload vnstat.service

Find the status of vnstat service

sudo systemctl status vnstat.service
How to install vnstat on Ubuntu Linux

Step 4 – Viewing network traffic graphs

We have two parts here as follows:

  1. vnstatd daemon – Background service that monitors and updates interface database as per /etc/vnstat.conf file.
  2. vnstat command – Command line tool for sysadmins/developers for querying the traffic information stored by the vnstatd daemon. In other words, we need to use the vnstat command.

Let us type the following command on Ubuntu box to query vnstat database:
vnstat
Sample outputs from the newly installed system:

Database updated: 2020-04-23 19:39:00
 
   eth0 since 2020-04-23
 
          rx:  94.30 KiB      tx:  113.71 KiB      total:  208.01 KiB
 
   monthly
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
       2020-04     94.30 KiB |  113.71 KiB |  208.01 KiB |        0 bit/s
     ------------------------+-------------+-------------+---------------
     estimated       --      |     --      |     --      |
 
   daily
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
         today     94.30 KiB |  113.71 KiB |  208.01 KiB |       24 bit/s
     ------------------------+-------------+-------------+---------------
     estimated       114 KiB |     138 KiB |     252 KiB |

We can select interface as follows:
vnstat -i eth0
Want to display traffic summary for a merge of interfaces eth0, eth2 and eth3? Try:
vnstat -i eth0+eth1+eth3
We can output all information about VPN interface tun0 in xml format:
vnstat -i tun0 --xml
How about json format? Try:
vnstat --json
The following two special options can only be used with --json, --xml and list outputs. Pass the -b option to begin the list output with a specific date / time defined by date instead of the begin being selected based on the number of entries to be shown. The date can be in YYYY-MM-DD HH:MM and YYYY-MM-DD formats only. Another option is to pass the -e to set up end date:
vnstat -b {YYYY-MM-DD} -i {interface} --xml
vnstat -e {YYYY-MM-DD} -i {interface} --json

It is possible to remove database entries for interface eth1 and stop monitoring it using the following format:
vnstat -i eth1 --remove

View hourly traffic stats

vnstat -h
vnstat -i eth0 -h

vnstat running on ubuntu and shows hourly traffic

View daily (days) traffic stats

vnstat -d
vnstat -i tun0 -d

Installing and using vnStat on Ubuntu Linux

Show monthly traffic stats

vnstat -m
How to set up vnstat and monitor traffic on Ubuntu

Display yearly traffic stats

vnstat -y

 enp0s31f6  /  yearly
 
         year        rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
          2019    382.24 GiB |   78.11 GiB |  460.35 GiB |  125.39 kbit/s
          2020    834.28 GiB |  345.17 GiB |    1.15 TiB |    1.03 Mbit/s
     ------------------------+-------------+-------------+---------------
     estimated      2.61 TiB |    1.08 TiB |    3.70 TiB |


The above indicate traffic statistics on a yearly basis for the last years.

Show top traffic days

vnstat -t
vnstat -i eth0

vnstat

How to show current transfer rate for the selected interface in real time until interrupted

Another nifty option that shows live network transfer rate and statistics will be shown after interruption if the runtime was more than 10 seconds:
vnstat -l
vnstat -i tun0 -l
vnstat -i eth0 -l

vnstat live traffic

Getting help

Type the following man command:
man vnstat
vnstat --help
vnstat --longhelp

vnStat 2.6 by Teemu Toivola <tst at iki dot fi>
 
      -5,  --fiveminutes [limit]   show 5 minutes
      -h,  --hours [limit]         show hours
      -hg, --hoursgraph            show hours graph
      -d,  --days [limit]          show days
      -m,  --months [limit]        show months
      -y,  --years [limit]         show years
      -t,  --top [limit]           show top days
 
      -b, --begin <date>           set list begin date
      -e, --end <date>             set list end date
 
      --oneline [mode]             show simple parsable format
      --json [mode] [limit]        show database in json format
      --xml [mode] [limit]         show database in xml format
 
      -tr, --traffic [time]        calculate traffic
      -l,  --live [mode]           show transfer rate in real time
      -i,  --iface <interface>     select interface

Conclusion

You learned how to set up and install vnstat to get detailed stats about your network traffic. I find this tool very useful to keep track of traffic, and any sudden surge can be further investigated for DoS/DDoS or bot activity on web servers. I also install it on pfSense or Linux based home router to keep track of my bandwidth usage espcially when connected vi 5G/4G/LTE dongle. See vnstat project home page for more information.

This entry is 5 of 5 in the vnStat Monitor and Log Network Traffic Tutorial series. Keep reading the rest of the series:
  1. How to install vnstat on a CentOS/RHEL/Fedora Linux
  2. View Vnstat Graphs Using PHP Web Interface Frontend
  3. How to install vnstat on FreeBSD Unix server
  4. Fedora Linux install vnstat network traffic monitor
  5. Ubuntu install vnstat console network traffic monitor
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallCentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNCentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
0 comments… add one

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.