VNSTAT
Section: User Manuals (1)
Updated: APRIL 2019
Page Index
NAME
vnstat - a console-based network traffic monitor
SYNOPSIS
vnstat
[-5bDedhlmqrstvwy?]
[--add]
[--begin
date]
[--config
file]
[--days
[count]]
[--dbdir
[directory]]
[--debug]
[--end
date]
[--fiveminutes
[count]]
[--help]
[-hg]
[--hours
[count]]
[--hoursgraph]
[-i
interface]
[--iface
interface]
[--iflist]
[--json
[mode]
[limit]]
[--live
[mode]]
[--locale
locale]
[--longhelp]
[--months
[count]]
[--oneline
[mode]]
[--query]
[--rateunit
[mode]]
[--remove]
[-ru
[mode]]
[--setalias
alias]
[--short]
[--showconfig]
[--style
number]
[--top
[count]]
[-tr
[time]]
[--traffic
[time]]
[--version]
[--xml
[mode]
[limit]]
[--years
[count]]
DESCRIPTION
vnStat
is a console-based network traffic monitor. It keeps a log of 5 minute interval,
hourly, daily, monthly and yearly network traffic for the selected interface(s).
However, it isn't a packet sniffer. The traffic information is read from the
proc(5)
or
sys
filesystems depending on availability resulting in light use of system resources
regardless of network traffic rate. That way vnStat can be used even
without root permissions on most systems.
The implementation is divided into two commands. The purpose of the
vnstat
command is to provide an interface for querying the traffic information stored
in the database whereas the daemon
vnstatd(1)
is responsible for data retrieval, caching and storage. Although the daemon
process is constantly running as a service, it is actually spending most of its
time sleeping between data updates.
OPTIONS
- --add
-
Create database entry for interface specified with
-i
or
--iface
option.
- -b, --begin date
-
Begin the list output with a specific date / time defined by
date
instead of the begin being selected based on the number of entries to be shown.
If
date
isn't available in the database then the closest later date will be used.
date
supports the following formats: YYYY-MM-DD HH:MM and YYYY-MM-DD.
This option can only be used with
--json
,
--xml
and list outputs.
- --config file
-
Use
file
as configuration file instead of using automatic configuration file search
functionality.
- -d, --days [count]
-
Show traffic statistics on a daily basis for the last days. The length of the list
will default to 30 entries unless configured otherwise or unless the optional
count
parameter is used. All entries stored in the database will be shown if
count
is set to 0.
- --dbdir directory
-
Use
directory
as database directory instead of using the directory specified in the configuration
file or the hardcoded default if no configuration file is available.
- -D, --debug
-
Show additional debug output.
- -e, --end date
-
End the list output with a specific date / time defined by
date
instead of the latest date / time in the database. If
date
isn't available in the database then the closest earlier date will be used.
date
supports the following formats: YYYY-MM-DD HH:MM and YYYY-MM-DD.
This option can only be used with
--json
,
--xml
and list outputs. The top list also requires
--begin
to be used at the same time with this option.
- -5, --fiveminutes [count]
-
Show traffic statistics with a 5 minute resolution for the last hours. The length of the list
will default to 24 entries unless configured otherwise or unless the optional
count
parameter is used. All entries stored in the database will be shown if
count
is set to 0.
- -h, --hours [count]
-
Show traffic statistics on a hourly basis. The length of the list will default
to 24 entries unless configured otherwise or unless the optional
count
parameter is used. All entries store in the database will be shown if the
count
is set to 0.
- -hg, --hoursgraph
-
Show traffic statistics on a hourly basis for the last 24 hours using a bar graph
followed by a table representing the numerical data.
- -i, --iface interface
-
Select one specific
interface
and apply actions to only it. For queries, it is possible to merge the
information of two or more interfaces using the
interface1+interface2+...
syntax. All provided interfaces must be unique and must exist in the database
when the merge syntax is used.
- --iflist
-
Show list of currently available interfaces.
- --json [mode] [limit]
-
Show database content for selected interface or all interfaces in json format. All
traffic values in the output are in bytes. An optional
mode
parameter can be used for limiting the output to only selected information.
Everything is shown by default. Setting
mode
to 'f' will output only 5 minute resolution entries, 'h' hours, 'd' days, 'm' months, 'y'
years and 't' the top days. An optional
limit
parameter can be used to limit the number results to a given number of most recent
entries. The
--json
option can be used in combination with
-l, --live
and
-tr
options without
mode
having any effect to the output. The
jsonversion
field in the output contains the API version information. It will be changed only when the
names or structures of previously existing content gets changed. In comparison, the
vnstatversion
field exists mainly as extra information.
- -l, --live [mode]
-
Display current transfer rate for the selected interface in real time
until interrupted. Statistics will be shown after interruption if the runtime
was more than 10 seconds. An optional
mode
parameter can be used to select between the displaying of packets per
second (mode 0) and transfer counters (mode 1) during execution.
--style
can also be used to affect the layout of the output. The output will be in json
format if used in combination with
--json
option.
- --locale locale
-
Use
locale
instead of using the locale setting specified in the configuration file or the system
default if no configuration file is available.
- --longhelp
-
Show complete options list.
- -m, --months [count]
-
Show traffic statistics on a monthly basis for the last months. The length of the list
will default to 12 entries unless configured otherwise or unless the optional
count
parameter is used. All entries stored in the database will be shown if
count
is set to 0.
- --oneline [mode]
-
Show traffic summary for selected interface using one line with a parsable
format. The output contains 15 fields with ; used as field delimiter. The 1st
field contains the API version information of the output that will only be changed
in future versions if the field content or structure changes. The following
fields in order 2) interface name, 3) timestamp for today, 4) rx for today,
5) tx for today, 6) total for today, 7) average traffic rate for today,
8) timestamp for current month, 9) rx for current month, 10) tx for current
month, 11) total for current month, 12) average traffic rate for current month,
13) all time total rx, 14) all time total tx, 15) all time total traffic.
An optional
mode
parameter can be used to force all fields to output in bytes without the
unit itself shown.
- -q, --query
-
Force database query mode.
- --remove
-
Delete the database entry for the interface specified with
-i
or
--iface
and stop monitoring it.
- -ru, --rateunit [mode]
-
Swap the configured rate unit. If rate has been configured to be shown in
bytes then rate will be shown in bits if this option is present. In the same
way, if rate has been configured to be shown in bits then rate will be shown
in bytes when this option is present. Alternatively,
mode
with either 0 or 1 can be used as parameter for this option in order to
select between bytes (0) and bits (1) regardless of the configuration file setting.
- --setalias alias
-
Set the selected interface
alias
as an alias that will be displayed in queries.
- -s, --short
-
Use short output mode. This mode is also used when more than one interface is
available in the database and no specific interface is selected.
- --showconfig
-
Show current configuration using the same format as the configuration file
itself uses.
- --style number
-
Modify the content and style of outputs. Set
number
to 0 for a narrower output, 1 for enabling bar column, 2
for same as previous but with average traffic rate visible in summary
output and 3 for enabling average traffic rate in all outputs where it is
supported. 4 disables the use of terminal control characters in
-l / --live
mode.
- -t, --top [count]
-
Show all time top traffic days. The length of the list
will default to 10 entries unless configured otherwise or unless the optional
count
parameter is used. All entries stored in the database will be shown if
count
is set to 0. When used with
--begin
and optionally with
--end,
the list will be generated using the daily data instead of separate top entries.
The availability of daily data defines the boundaries the date specific query
can access.
- -tr, --traffic [time]
-
Calculate how much traffic goes through the selected interface during
the given
time
seconds. The
time
will be 5 seconds if a number parameter isn't specified. The output will
be in json format if used in combination with
--json
option. However, in that case, the countdown before results isn't shown.
- -v, --version
-
Show current version.
- --xml [mode] [limit]
-
Show database content for selected interface or all interfaces in xml format. All
traffic values in the output are in bytes. An optional
mode
parameter can be used for limiting the output to only selected information.
Everything is shown by default. Setting
mode
to 'f' will output only 5 minute resolution entries, 'h' hours, 'd' days, 'm' months, 'y'
years and 't' the top days. An optional
limit
parameter can be used to limit the number results to a given number of most recent
entries. The
xmlversion
field in the output contains the API version information. It will be changed only when the
names or structures of previously existing content gets changed. In comparison, the
vnstatversion
field exists mainly as extra information.
- -y, --years [count]
-
Show traffic statistics on a yearly basis for the last years. The list will show all
entries by default unless configured otherwise or unless the optional
count
parameter is used. All entries stored in the database will also be shown if
count
is set to 0.
- -?, --help
-
Show a command option summary.
FILES
- /var/lib/vnstat/
-
Default database directory.
- /etc/vnstat.conf
-
Config file that will be used unless
$HOME/.vnstatrc
exists. See
vnstat.conf(5)
for more information.
EXAMPLES
- vnstat
-
Display traffic summary for the default interface or multiple interfaces
when more than one is monitored.
- vnstat -i eth0+eth1+eth3
-
Display traffic summary for a merge of interfaces eth0, eth1 and eth3.
- vnstat -i eth2 --xml
-
Output all information about interface eth2 in xml format.
- vnstat --json
-
Output all information of all monitored interfaces in json format.
- vnstat -i eth0 --setalias local
-
Give interface eth0 the alias "local". That information will be
later visible as a label when eth0 is queried.
- vnstat -i eth2 --remove
-
Delete database entries for interface eth2 and stop monitoring it.
RESTRICTIONS
Updates need to be executed at least as often as it is possible for the interface
to generate enough traffic to overflow the kernel interface traffic counter. Otherwise,
it is possible that some traffic won't be seen. With 32-bit kernels, the maximum time
between two updates depends on how fast the interface can transfer 4 GiB. Calculated
theoretical times are:
-
| 10 Mbit: 54 minutes |
|
| 100 Mbit: 5 minutes |
|
| 1000 Mbit: 30 seconds |
|
However, for 1000 Mbit interfaces updating once every minute is usually a
usable solution if a shorter update interval can't be used.
Virtual and aliased interfaces cannot be monitored because the kernel doesn't
provide traffic information for that type of interfaces. Such interfaces are
usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is the actual interface
being aliased.
Using long date output formats may cause misalignment in shown columns if the
length of the date exceeds the fixed size allocation.
AUTHOR
Teemu Toivola <tst at iki dot fi>
SEE ALSO
vnstatd(1),
vnstati(1),
vnstat.conf(5),
proc(5),
ifconfig(8),
units(7)