This is quickly becoming one of my favourite tools when setting up webservers, after discovering it recently. I have all sorts of monitoring set up and use munin a lot, but vnstat seems to be a very lightweight daemon which gives you insight into the traffic to and from your box. Best of all it integrates well with logwatch, so it will send you a quick report every day so you can see immediately if something is going wrong.
Install it with your regular package manager (yum install vnstat | apt-get install vnstat), and you'll probably have to leave it for a few minutes to gather data. Sometimes the database doesn't initialise correctly and you need to do that manually with vnstat -u -i eth0 , or whatever your main interface is.
After a while you can get information from the command line. This is the default report
server:~$ vnstat Database updated: Mon Apr 15 16:11:49 2013 eth0 since 04/01/13 rx: 8.32 GiB tx: 73.42 GiB total: 81.74 GiB monthly rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- Apr '13 8.32 GiB | 73.42 GiB | 81.74 GiB | 540.80 kbit/s ------------------------+-------------+-------------+--------------- estimated 17.00 GiB | 150.10 GiB | 167.10 GiB | daily rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- yesterday 68.70 MiB | 598.00 MiB | 666.70 MiB | 63.21 kbit/s today 281.40 MiB | 1.96 GiB | 2.23 GiB | 320.85 kbit/s ------------------------+-------------+-------------+--------------- estimated 416 MiB | 2.90 GiB | 3.30 GiB |
You can see what's happening on a daily basis with the -d option:
server:~$ vnstat -d eth0 / daily day rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- 04/01/13 252.62 MiB | 20.25 GiB | 20.50 GiB | 1.99 Mbit/s 04/02/13 521.07 MiB | 18.85 GiB | 19.36 GiB | 1.88 Mbit/s 04/03/13 3.12 GiB | 7.51 GiB | 10.63 GiB | 1.03 Mbit/s 04/04/13 954.60 MiB | 4.32 GiB | 5.25 GiB | 509.55 kbit/s 04/05/13 359.06 MiB | 1.93 GiB | 2.28 GiB | 221.55 kbit/s 04/06/13 86.80 MiB | 638.73 MiB | 725.53 MiB | 68.79 kbit/s 04/07/13 83.53 MiB | 693.19 MiB | 776.72 MiB | 73.64 kbit/s 04/08/13 388.47 MiB | 2.46 GiB | 2.84 GiB | 275.52 kbit/s 04/09/13 256.95 MiB | 1.05 GiB | 1.30 GiB | 126.39 kbit/s 04/10/13 604.52 MiB | 3.78 GiB | 4.37 GiB | 424.35 kbit/s 04/11/13 538.30 MiB | 5.07 GiB | 5.60 GiB | 543.69 kbit/s 04/12/13 840.73 MiB | 3.85 GiB | 4.67 GiB | 453.83 kbit/s 04/13/13 83.94 MiB | 515.66 MiB | 599.59 MiB | 56.85 kbit/s 04/14/13 68.70 MiB | 598.00 MiB | 666.70 MiB | 63.21 kbit/s 04/15/13 281.40 MiB | 1.96 GiB | 2.23 GiB | 320.85 kbit/s ------------------------+-------------+-------------+--------------- estimated 416 MiB | 2.90 GiB | 3.30 GiB |
Or you can see the live traffic with the -l option, and specifying an interface:
server:~$ vnstat -l -i eth0 Monitoring eth0... (press CTRL-C to stop) rx: 20 kbit/s 10 p/s tx: 16 kbit/s 9 p/s^C eth0 / traffic statistics rx | tx --------------------------------------+------------------ bytes 29 KiB | 56 KiB --------------------------------------+------------------ max 68 kbit/s | 176 kbit/s average 12.21 kbit/s | 23.58 kbit/s min 0 kbit/s | 0 kbit/s --------------------------------------+------------------ packets 95 | 118 --------------------------------------+------------------ max 16 p/s | 27 p/s average 5 p/s | 6 p/s min 1 p/s | 1 p/s --------------------------------------+------------------ time 19 seconds
And if you use the hourly option, you get a nice graph thingy:
server:~$ vnstat -h eth0 16:11 ^ t | t | t t | t t t | t t t | t t t t | t t t t t t | t t t t t t t | t t t t t t t t t | t t t t t t t t rt rt -+---------------------------------------------------------------------------> | 17 18 19 20 21 22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 h rx (KiB) tx (KiB) h rx (KiB) tx (KiB) h rx (KiB) tx (KiB) 17 2981 23406 01 7269 17519 09 29747 299265 18 2868 19280 02 1785 15656 10 20231 130942 19 2400 22463 03 5305 37349 11 38899 333468 20 6545 116319 04 1906 11916 12 24145 161426 21 2965 22644 05 2548 16697 13 21857 192777 22 2738 24325 06 3652 25941 14 43473 228094 23 4139 18899 07 8889 83440 15 67263 391769 00 2135 12835 08 6064 63966 16 2989 27320
Great stuff. There are more options, but explore those yourself. To integrate into Logwatch is simplicity itself. In /etc/logwatch/conf/services/vnstat.conf you put these two lines
Title = "vnstat" LogFile = NONE
#!/bin/bash vnstat -d -i eth0