Monitor Linux Network Interfaces With vnStat
With its small footprint and a focus on monitoring Linux network interfaces via data coming from the kernel, vnStat provides a simple and effective networking tool.
Getting network stats on a Linux machine is not particularly difficult. With tools like sar, Iperf, and vnStat available for nearly every distribution, command-line aficionados can get the low-down on their network with just a few useful commands.
Take, for instance, vnStat, a popular network traffic logger. vnStat is different from a network sniffer like Wireshark since it polls the network interface stats going to and from the kernel. Wireshark, on the other hand, actually monitors packets coming in and out of your machine.
As useful as vnStat is, it is still predominantly a command-line application, which can make it tricky to visualize what's going on with your machine's network interface. But there does exist a useful PHP-based front-end for vnStat that can generate useful reports from vnStat logs.
In this article, you'll see how to use vnStat, and then learn how to install the Web-based GUI to see your data, not just read it. For this article, we'll be using the tools in Ubuntu Desktop 10.10.
Installing vnStat is simple, no matter what distro you're using. Your favorite package manager should be able to pull down the vnstat package and install it quickly. In Ubuntu's console, simply run sudo apt-get install vnstat
and you're on your way. Don't worry about the "zero database" error message that might appear: that's just because you haven't set it up yet. In order to operate, vnStat will run a cron job that will obtain reports from the network interface you choose and then store that information in a database file. But before you can start this process, you need to set the database up.
Actually, simply running vnstat will give you an error message with all the information you need, including the interfaces currently available on your machine:
No database found, nothing to do. Use --help for help.
A new database can be created with the following command:
vnstat -u -i eth0
Replace 'eth0' with the interface that should be monitored.
The following interfaces are currently available:
lo eth0 vmnet1 vmnet8
This pretty much tells me everything I need to know, as it lists my Ethernet card and the two VMware interfaces that are configured on my computer. Since I want to track the main card for now, I can oblige vnStat and run the recommended command, though with a catch: you need to have admin privileges to create the database file, which in Ubuntu means sudo.
sudo vnstat -u -i eth0
Since vnStat takes a little time to gather data (the cron job runs every five minutes by default), you may need to wait a bit so some useful datapoints can be gathered. If you're impatient, run
This parameter will report live data every 10 seconds until you press Ctrl+C to halt the process.
Sometimes, due to an error in the configuration file, vnStat may not run correctly in the background and you won't get any data reports from the regular five-minute cron job. Luckily, this is not too hard to fix. As a superuser, use your favorite text editor to open the /etc/init.d/vnstat file.
If you find a line that looks something like:
change the line to read
to fix the error. Now all you need to do is start the vnStat daemon and reinitialize the vnStat database.
$ sudo vnstatd -d -s
$ sudo vnstat -u -i eth0
After five minutes, vnStat will start churning out data. To view it, type vnstat in the command line. The data provided by vnStat is pretty straightforward, even on the console:
Database updated: Thu Nov 18 13:32:00 2010
eth0 since 11/18/10
rx: 5.98 MiB tx: 3.41 MiB total: 9.39 MiB
rx | tx | total | avg. rate
Nov '10 5.98 MiB | 3.41 MiB | 9.39 MiB | 0.05 kbit/s
estimated 8 MiB | 5 MiB | 13 MiB |
rx | tx | total | avg. rate
today 5.98 MiB | 3.41 MiB | 9.39 MiB | 1.58 kbit/s
estimated 8 MiB | 5 MiB | 13 MiB |
The first two columns represent received and transmitted information, followed by total throughput and the average rate. This information alone is very useful for snapshot information, but for information over time, a graphical interface is much more suitable. For this, PHP developer Bjorge Dijkstra has developed a very useful utility.
Installing the GUI
In order for the Web-based vnStat application to run, you will need a full LAMP server (with PHP and the GD image libraries) running on your system. You may have such a web server running already, but if you don't, installing LAMP on Ubuntu is rather simple, thanks to a package manager called tasksel. Tasksel enables users to download, install, and configure whole groups of software, all in one activity, making it ideal to install a LAMP web server. Ubuntu Desktop may not have tasksel, but that's an easy enough thing to correct, using the command line.
sudo apt-get install tasksel
After tasksel is on board, just type sudo tasksel install lamp-server to begin the LAMP installation process. You will see a text-based installation window that will walk you through the setup process, including providing a root password for the PHP component, should you need to configure it later (though for this exercise, you won't).
When the LAMP system is completely installed, type "localhost" in your browser's location bar and you should see a simple welcome page.
There is one final thing to do so LAMP is running everything you need. The GD image libraries will be installed in the LAMP install steps, but your PHP classes need to be installed, too. Run this command to get these classes where they need to be: sudo apt-get install php5-gd.
Now you can install the GUI front-end. First, download and save the tarball file to a preferred location on your machine (I like the Downloads directory in my Home partition). Now enter the following commands:
$ sudo tar -xzvf ~/Downloads/vnstat_php_frontend-1.5.1.tar.gz -C /var/www/
$ sudo mv /var/www/vnstat_php_frontend-1.5.1/ /var/www/vnstat/
$ sudo chown -R www-data.www-data /var/www/vnstat/
The first command is the standard uncompress command for tarballs, which will put the contents of this archive file into the /var/www/vnstat_php_frontend-1.5.1/ directory. That's a little long to type as a Web address, so I use the second command to shorten the name of the directory to /var/www/vnstat/. Finally, the third command changes the group and owner of everything in the /var/www/vnstat/ directory to "www-data," which is necessary to let PHP run.
Now, you can get to the interface by typing http://localhost/vnstat, after you will see... a whole lot of Dutch, which is the language to which version 1.5.1 of Dijkstra's tool defaults. This is all well and good for those who speak Dutch, but English speakers may have a bit of trouble.
To change this, use your favorite editor as root to edit the /var/www/vnstat/config.php file. Modify the language line:
$language = 'nl';
$language = 'en';
(or, for Czech users, substitute 'cs';)
Save the file and refresh the page in your browser and the language you selected will appear.
Because vnStat is very light on resources, running it full-time in the background will not affect your system's performance at all. Of course, running a Web server will, so you will need to weigh the benefits of having a nifty GUI for the traffic data.
Brian Proffitt is a Linux, Open Source, and technology expert who writes for a number of online publications. Formerly the Community Manager for Linux.com and the Linux Foundation, he is the author of 20 technical/consumer books, including the recent Take Your iPad to Work. Follow him on Twitter @TheTechScribe.