vnstat

Display traffic summary for all interfaces

$ vnstat

$ vnstat [[-i|--iface]] [network_interface]

$ vnstat [[-l|--live]] [[-i|--iface]] [network_interface]

$ vnstat [[-hg|--hoursgraph]]

$ vnstat [[-tr|--traffic]] [30]

vnstat [options]
vnstat [-h | -d | -m | -w | -t | -s | -l | -u] [-i <interface>]
vnstat [--json | --xml] [-h | -d | -m | -w | -t | -s | -l] [-i <interface>]
vnstat [--create | --add | --remove | --enable | --disable] [-i <interface>]
vnstat [--version | --help]

-q, --query
    Activates query mode (default if no other mode option is given).

-h, --hours
    Show hourly traffic statistics for the last 24 hours.

-d, --days
    Show daily traffic statistics for the last 30 days.

-m, --months
    Show monthly traffic statistics for the last 12 months.

-w, --weeks
    Show weekly traffic statistics. Week number changes on Monday.

-t, --top
    Show top 10 traffic days.

-s, --short
    Show a short summary of current traffic stats.

-l, --live
    Show real-time traffic statistics. Press Ctrl+C to exit.

-u, --update
    Update the database for the selected interface. Usually handled by vnstatd.

-i <interface>, --iface <interface>
    Select the network interface to query or modify (e.g., eth0, wlan0).

--json
    Output data in JSON format for programmatic parsing.

--xml
    Output data in XML format for programmatic parsing.

--create
    Create a new database for the specified interface.

--add
    Alias for --create, used to add an interface to monitoring.

--remove
    Remove the database for the specified interface.

--enable <interface>
    Enable data collection for the specified interface.

--disable <interface>
    Disable data collection for the specified interface.

--help
    Display a help message and exit.

--version
    Show version information and exit.

vnstat is a console-based network traffic monitor that keeps a log of network usage for selected interfaces. Unlike real-time tools, vnstat focuses on collecting and aggregating historical data, making it ideal for tracking long-term bandwidth consumption. It gathers statistics directly from the kernel, meaning it consumes minimal system resources and doesn't sniff packets. The data is stored persistently, ensuring that statistics are preserved across reboots.

vnstat provides various views, including hourly, daily, monthly, and yearly summaries of traffic transferred, both incoming and outgoing. It's commonly used by users and administrators to monitor bandwidth usage, identify trends, and manage data caps. A background daemon (vnstatd) is often used to automate data collection, while the vnstat command line tool is used to query and display the collected statistics. Its simplicity and effectiveness make it a popular choice for light to medium network monitoring needs.

Initial setup, such as creating or enabling databases for interfaces, often requires root privileges. vnstat is not a real-time packet sniffer; it reads kernel counters, which might have a slight delay or aggregation. For continuous and accurate data collection, it's highly recommended to run the vnstatd daemon. Data loss can occur if the database file (`/var/lib/vnstat/`) becomes corrupted or is accidentally deleted.

By default, vnstat stores its database files in /var/lib/vnstat/. Each monitored network interface typically has its own database file within this directory, named after the interface (e.g., eth0).

For continuous and automated data collection, the vnstatd daemon is typically used. This daemon runs in the background and periodically updates the vnstat databases. Users generally interact with the vnstat command-line tool primarily to query and display the statistics collected by vnstatd.

vnstat was originally written by Teemu Toivola, with the first version released around 2002. It was designed to be a lightweight and persistent alternative to other network monitoring tools, focusing on long-term data collection rather than real-time sniffing. Its development has been continuous, adapting to new Linux kernel features and user demands, while maintaining its core principle of simplicity and efficiency. It has become a staple tool for monitoring bandwidth on servers and personal machines due to its low resource usage and persistent data storage.

iftop(8), nload(1), bmon(1), netstat(8), ss(8)