Monitor Network Traffic with vnStat on Ubuntu 20.04

vnStat is a free, open-source and console-based network traffic monitoring tool for Linux operating system. With vnStat, you can monitor network statistics over various time periods. It is simple, lightweight and consumes a small portion of your system resources. vnStat allow you to generate the network traffic data in an hour, day, month, week and day.

In this tutorial, we will show you how to install and use vnStat to monitor network traffic.

Prerequisites

• A server running Ubuntu 20.04.
• A root password is configured the server.

Install vnStat

By default, the latest version of vnStat is not available in the Ubuntu default repository. So you will need to compile it from the source.

First, install all the dependencies required to compile vnStat with the following command:

apt-get install build-essential gcc make libsqlite3-dev -y

Once all the dependencies are installed, download the latest version of the vnStat source with the following command:

wget https://humdi.net/vnstat/vnstat-2.6.tar.gz

Once the download is completed, extract the downloaded file with the following command:

tar -xvzf vnstat-2.6.tar.gz

Next, change the directory to the extracted directory and configure it with the following command:

cd vnstat-2.6
./configure --prefix=/usr --sysconfdir=/etc

Next, install the vnStat by running the following command:

make
make install

Once vnStat is installed, you can verify the installed version of vnStat with the following command:

vnstat -v

You should get the following output:

vnStat 2.6 by Teemu Toivola 

Once you are finished, you can proceed to the next step.

Manage vnStat Service

Next, you will need to copy vnStat systemd service file from the vnStat source to the /etc/systemd/system/ directory:

cp -v vnstat-2.6/examples/systemd/vnstat.service /etc/systemd/system/

Next, enable the vnStat service and start it with the following command:

systemctl enable vnstat
systemctl start vnstat

You can also verify the status of vnStat service using the following command:

systemctl status vnstat

You should get the following output:

? vnstat.service - vnStat network traffic monitor
   Loaded: loaded (/etc/systemd/system/vnstat.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-11-12 06:24:01 UTC; 11s ago
     Docs: man:vnstatd(8)
           man:vnstat(1)
           man:vnstat.conf(5)
 Main PID: 20989 (vnstatd)
    Tasks: 1 (limit: 4701)
   Memory: 1.5M
   CGroup: /system.slice/vnstat.service
           ??20989 /usr/sbin/vnstatd -n

Nov 12 06:24:01 Ubuntu systemd[1]: Started vnStat network traffic monitor.
Nov 12 06:24:01 Ubuntu vnstatd[20989]: No interfaces found in database, adding available interfaces...
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Interface "ens3" added with 1000 Mbit bandwidth limit.
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Interface "ens4" added with 1000 Mbit bandwidth limit.
Nov 12 06:24:01 Ubuntu vnstatd[20989]: -> 2 new interfaces found.
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Limits can be modified using the configuration file. See "man vnstat.conf".
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Unwanted interfaces can be removed from monitoring with "vnstat --remove".
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Info: vnStat daemon 2.6 started. (pid:20989 uid:0 gid:0 64-bit)
Nov 12 06:24:01 Ubuntu vnstatd[20989]: Info: Monitoring (2): ens4 (1000 Mbit) ens3 (1000 Mbit)

Once you are finished, you can proceed to the next step.

Working with vnStat

vnStat comes with several options that help you to monitor the network traffic. You can list all available options with the following command:

vnstat --help

You should get the following output:

vnStat 2.6 by Teemu Toivola 

      -5,  --fiveminutes [limit]   show 5 minutes
      -h,  --hours [limit]         show hours
      -hg, --hoursgraph            show hours graph
      -d,  --days [limit]          show days
      -m,  --months [limit]        show months
      -y,  --years [limit]         show years
      -t,  --top [limit]           show top days

      -b, --begin            set list begin date
      -e, --end              set list end date

      --oneline [mode]             show simple parsable format
      --json [mode] [limit]        show database in json format
      --xml [mode] [limit]         show database in xml format

      -tr, --traffic [time]        calculate traffic
      -l,  --live [mode]           show transfer rate in real time
      -i,  --iface      select interface

Use "--longhelp" or "man vnstat" for complete list of options.

Before using vnStat, you will need to wait for some time to update the vnStat database. After updating database, you can run vnStat without any option as shown below:

vnstat

You should see the following output:

                      rx      /      tx      /     total    /   estimated
 ens3:
       2020-11    164.83 KiB  /  495.17 KiB  /  660.01 KiB  /     --     
         today    164.83 KiB  /  495.17 KiB  /  660.01 KiB  /    2.38 MiB

You can also specify the specific network interface using the -i option as shown below:

vnstat -i ens3

You should get the daily and monthly statistics in the following output:

Database updated: 2020-11-12 06:30:00

   ens3 since 2020-11-12

          rx:  164.83 KiB      tx:  495.17 KiB      total:  660.01 KiB

   monthly
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
       2020-11    164.83 KiB |  495.17 KiB |  660.01 KiB |        5 bit/s
     ------------------------+-------------+-------------+---------------
     estimated       --      |     --      |     --      |

   daily
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
         today    164.83 KiB |  495.17 KiB |  660.01 KiB |      231 bit/s
     ------------------------+-------------+-------------+---------------
     estimated       608 KiB |    1.79 MiB |    2.38 MiB |

To display the hourly statistics, run the following command:

vnstat -h

You should get the following output:

 ens3  /  hourly

         hour        rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
     2020-11-12
         06:00    164.83 KiB |  495.17 KiB |  660.01 KiB |    3.00 kbit/s
     ------------------------+-------------+-------------+---------------

To display the daily statistics, run the following command:

vnstat -d

You should get the following output:

 ens3  /  daily

          day        rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
     2020-11-12   164.83 KiB |  495.17 KiB |  660.01 KiB |      231 bit/s
     ------------------------+-------------+-------------+---------------
     estimated       608 KiB |    1.79 MiB |    2.38 MiB |

You can use the option -t to display the top traffic days:

vnstat -t

You should get the following output:

 ens3  /  top 1

    #      day          rx      |     tx      |    total    |   avg. rate
   -----------------------------+-------------+-------------+---------------
 >  1   2020-11-12   164.83 KiB |  495.17 KiB |  660.01 KiB |       62 bit/s

To display the network traffic statistics in real-time, run the following command:

vnstat -l

You should get the following output:

Monitoring ens3...    (press CTRL-C to stop)

   rx:     1.31 kbit/s     2 p/s          tx:     1.49 kbit/s     1 p/s^C


 ens3  /  traffic statistics

                           rx         |       tx
--------------------------------------+------------------
  bytes                     3.75 KiB  |        5.42 KiB
--------------------------------------+------------------
          max            6.55 kbit/s  |    11.17 kbit/s
      average            1.53 kbit/s  |     2.22 kbit/s
          min              264 bit/s  |       264 bit/s
--------------------------------------+------------------
  packets                         41  |              37
--------------------------------------+------------------
          max                  7 p/s  |           8 p/s
      average                  2 p/s  |           1 p/s
          min                  0 p/s  |           0 p/s
--------------------------------------+------------------
  time                    20 seconds

You can also clear the database entries for interface ens3 and stop monitoring using the following command:

vnstat -i ens3 --remove --force

You should get the following output:

Interface "ens3" removed from database.
The interface will no longer be monitored. Use --add
if monitoring the interface is again needed.

You can also add the removed interface ens3 again by running the following command:

vnstat -i ens3 --add

You should get the following output:

Adding interface "ens3" for monitoring to database...

Restart the vnStat daemon if it is currently running in order to start monitoring "ens3".

Next, restart the vnStat service to apply the changes:

systemctl restart vnstat

Conclusion

In the above guide, you learned how to install vnStat and use it to monitor the network traffic. I hope this tool will help you to analysis, and troubleshooting network related problems. Feel free to ask me if you have any questions.