vnstat for webservers

This is quickly becoming one of my favourite tools when setting up webservers, after discovering it recently. I have all sorts of monitoring set up and use munin a lot, but vnstat seems to be a very lightweight daemon which gives you insight into the traffic to and from your box. Best of all it integrates well with logwatch, so it will send you a quick report every day so you can see immediately if something is going wrong.

Install it with your regular package manager (yum install vnstat | apt-get install vnstat), and you’ll probably have to leave it for a few minutes to gather data. Sometimes the database doesn’t initialise correctly and you need to do that manually with vnstat -u -i eth0 , or whatever your main interface is.

After a while you can get information from the command line. This is the default report

server:~$ vnstat
Database updated: Mon Apr 15 16:11:49 2013
eth0 since 04/01/13
rx:  8.32 GiB      tx:  73.42 GiB      total:  81.74 GiB
monthly
rx      |     tx      |    total    |   avg. rate
------------------------+-------------+-------------+---------------
Apr '13      8.32 GiB |   73.42 GiB |   81.74 GiB |  540.80 kbit/s
------------------------+-------------+-------------+---------------
estimated     17.00 GiB |  150.10 GiB |  167.10 GiB |

daily
rx      |     tx      |    total    |   avg. rate
------------------------+-------------+-------------+---------------
yesterday     68.70 MiB |  598.00 MiB |  666.70 MiB |   63.21 kbit/s
today    281.40 MiB |    1.96 GiB |    2.23 GiB |  320.85 kbit/s
------------------------+-------------+-------------+---------------
estimated       416 MiB |    2.90 GiB |    3.30 GiB |

You can see what’s happening on a daily basis with the -d option:

server:~$ vnstat -d
eth0  /  daily
day         rx      |     tx      |    total    |   avg. rate
------------------------+-------------+-------------+---------------
04/01/13    252.62 MiB |   20.25 GiB |   20.50 GiB |    1.99 Mbit/s
04/02/13    521.07 MiB |   18.85 GiB |   19.36 GiB |    1.88 Mbit/s
04/03/13      3.12 GiB |    7.51 GiB |   10.63 GiB |    1.03 Mbit/s
04/04/13    954.60 MiB |    4.32 GiB |    5.25 GiB |  509.55 kbit/s
04/05/13    359.06 MiB |    1.93 GiB |    2.28 GiB |  221.55 kbit/s
04/06/13     86.80 MiB |  638.73 MiB |  725.53 MiB |   68.79 kbit/s
04/07/13     83.53 MiB |  693.19 MiB |  776.72 MiB |   73.64 kbit/s
04/08/13    388.47 MiB |    2.46 GiB |    2.84 GiB |  275.52 kbit/s
04/09/13    256.95 MiB |    1.05 GiB |    1.30 GiB |  126.39 kbit/s
04/10/13    604.52 MiB |    3.78 GiB |    4.37 GiB |  424.35 kbit/s
04/11/13    538.30 MiB |    5.07 GiB |    5.60 GiB |  543.69 kbit/s
04/12/13    840.73 MiB |    3.85 GiB |    4.67 GiB |  453.83 kbit/s
04/13/13     83.94 MiB |  515.66 MiB |  599.59 MiB |   56.85 kbit/s
04/14/13     68.70 MiB |  598.00 MiB |  666.70 MiB |   63.21 kbit/s
04/15/13    281.40 MiB |    1.96 GiB |    2.23 GiB |  320.85 kbit/s
------------------------+-------------+-------------+---------------
estimated       416 MiB |    2.90 GiB |    3.30 GiB |

Or you can see the live traffic with the -l option, and specifying an interface:

server:~$ vnstat -l -i eth0
Monitoring eth0...    (press CTRL-C to stop)
rx:       20 kbit/s    10 p/s          tx:       16 kbit/s     9 p/s^C
eth0  /  traffic statistics
rx         |       tx
--------------------------------------+------------------
bytes                       29 KiB  |          56 KiB
--------------------------------------+------------------
max              68 kbit/s  |      176 kbit/s
average           12.21 kbit/s  |    23.58 kbit/s
min               0 kbit/s  |        0 kbit/s
--------------------------------------+------------------
packets                         95  |             118
--------------------------------------+------------------
max                 16 p/s  |          27 p/s
average                  5 p/s  |           6 p/s
min                  1 p/s  |           1 p/s
--------------------------------------+------------------
time                    19 seconds

And if you use the hourly option, you get a nice graph thingy:

server:~$ vnstat -h
eth0                                                                     16:11
^                                                                     t
|                                                                     t
|                                                         t           t
|                                                   t     t           t
|                                                   t     t           t
|                                                   t     t        t  t
|                                                   t     t  t  t  t  t
|                                                   t  t  t  t  t  t  t
|            t                                t     t  t  t  t  t  t  t
|            t                                t  t  t  t  t  t  t rt rt
-+--------------------------------------------------------------------------->
|  17 18 19 20 21 22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16

h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)
17       2981      23406    01       7269      17519    09      29747     299265
18       2868      19280    02       1785      15656    10      20231     130942
19       2400      22463    03       5305      37349    11      38899     333468
20       6545     116319    04       1906      11916    12      24145     161426
21       2965      22644    05       2548      16697    13      21857     192777
22       2738      24325    06       3652      25941    14      43473     228094
23       4139      18899    07       8889      83440    15      67263     391769
00       2135      12835    08       6064      63966    16       2989      27320

Great stuff. There are more options, but explore those yourself. To integrate into Logwatch is simplicity itself. In /etc/logwatch/conf/services/vnstat.conf you put these two lines

Title = "vnstat"
LogFile = NONE
And in /etc/logwatch/scripts/services/vnstat you put your vnstat command eg.
#!/bin/bash
vnstat -d -i eth0
Don’t forget to make this file executable. That’s it, you’re done.

Leave a Comment