Monitor Your Server's Network Usage with vnStat

vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won’t actually be sniffing any traffic and also ensures light use of system resources regardless of network traffic rate.

This program is open source / GPL’ed and can be installed either as root or as a single user.

Find out more on their project website.

While vnStat is console-based, they also offer a “not so pretty” interface using php that we will be installing as well.

What You’ll Need

  • A working instance of Ubuntu 18.04.3
  • A sudo user
  • (For Web) NGINX with a SSL Certificate
  • (For Web) Latest Version of PHP Currently Available. [Not Covered In This Install]

Installing vnStat
vnStat is already available in the standard repositories, so the install is quick and easy.

Copy and paste this command into your console window.

sudo apt install vnstat

Once greeted with a console window of the below, you may continue.

Configuring
By default, it will try to listen to eth0. If your main pipe to the interwebs is not this interface, you will need to modify the config to monitor your existing interface shown when running the command: ifconfig

Here is an example of my eth0 interface acting as the main pipe.

Modify the configuration file by using nano:

sudo nano /etc/vnstat.conf
/* Beginning of File */
# vnStat 1.18 config file
##

# default interface
Interface "eth0"  /* Change Me To Your Main Pipe Interface */

CTRL + X then Y to save.

Check to see if vnStat is already running:

sudo systemctl status vnstat

If you see the result and in says Active: active (running), we need to restart to reload our config.

root@hyperexpert:~# sudo systemctl status vnstat
● vnstat.service - vnStat network traffic monitor
   Loaded: loaded (/lib/systemd/system/vnstat.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2019-11-01 06:46:48 CET; 24min ago
     Docs: man:vnstatd(1)
           man:vnstat(1)
           man:vnstat.conf(5)
 Main PID: 420 (vnstatd)
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/vnstat.service
           └─3398 /usr/sbin/vnstatd -n

If it does not mention being active, you should run the next two commands as well.

sudo systemctl restart vnstat # Restart Our Service
sudo systemctl enable vnstat # Start Service On Boot

Usage
At this point we can run this command to gather our statistics after a little time.

# Show All Stats For All Interfaces
sudo vnstat

#Show Stats For Specific Interface
sudo vnstat -i eth0

sudo vnstat -i docker0

Here’s My Result From Writing This Guide


                      rx      /      tx      /     total    /   estimated
 docker0: Not enough data available yet.
 vetheb85636:
       Nov '19         5 KiB  /      16 KiB  /      21 KiB  /       0 KiB
         today         5 KiB  /      16 KiB  /      21 KiB  /      --

 vethf58acd4: Not enough data available yet.
 vethfa08671:
       Nov '19        18 KiB  /      35 KiB  /      53 KiB  /       0 KiB
         today        18 KiB  /      35 KiB  /      53 KiB  /      --

 vetheae5fdc:
       Nov '19         9 KiB  /       3 KiB  /      12 KiB  /       0 KiB
         today         9 KiB  /       3 KiB  /      12 KiB  /      --

 eth0:
       Nov '19      6.40 MiB  /     181 KiB  /    6.57 MiB  /       0 KiB
         today      6.40 MiB  /     181 KiB  /    6.57 MiB  /      --

 pterodactyl0:
       Nov '19        27 KiB  /      55 KiB  /      82 KiB  /       0 KiB
         today        27 KiB  /      55 KiB  /      82 KiB  /      --

PHP Web Interface
vnStat’s Web Interface is hosted at sqweek.com.

We can navigate to our web root at /var/www in most enviroments and gather our install.

cd /var/www
wget http://www.sqweek.com/sqweek/files/vnstat_php_frontend-1.5.1.tar.gz
tar xvzf vnstat_php_frontend-1.5.1.tar.gz

We can rename our vnstat php folder to something a little nicer…

mv vnstat_php_frontend-1.5.1 vnstat

We can also remove our installation file.

rm vnstat_php_frontend-1.5.1.tar.gz 

We now need to modify some php settings, so that this installation works with us.

sudo nano /var/www/vnstat/config.php

By default, the language is set to nl and since English is my primary language I will be setting it to en.
Also by default, the interfaces shown are the ones you specify. You can modify the iface_list attribute to make those changes, see my example below.
You can change the iface_title and change eth1 to your interface.

Here are my settings:

    //
    // configuration parameters
    //
    // edit these to reflect your particular situation
    //
    $locale = 'en_US.UTF-8';
    $language = 'en';                                                                                                                                                                                
    // list of network interfaces monitored by vnStat
    $iface_list = array('eth0', 'docker0');                                                                                                                                                          
    //
    // optional names for interfaces
    // if there's no name set for an interface then the interface identifier
    // will be displayed instead
    //
    $iface_title['eth0'] = 'Public Waterpipe';
    $iface_title['docker0'] = 'Docker Interface';                                                                                                                                                    

Intergrating with NGINX
A little known fact about me is that I reuse NGINX Config Files. I will take them and duplicate them for php situations. I got these from one of my recent projects :wink: .

Don’t Forget To Put Your Domain There.

sudo nano /etc/nginx/sites-available/vnstat.conf
The configs were too large for this post, so I uploaded them to my github website.
If your using SSL, use: https://randomsh.moe/vnstat/vnstat-ssl.conf
If not, use: https://randomsh.moe/vnstat/vnstat-nonssl.conf
sudo ln -s /etc/nginx/sites-available/vnstat.conf /etc/nginx/sites-enabled/vnstat.conf
systemctl restart nginx

If you did everything correctly, you should be able to access vnstat at your domain.

Extra things you could do
Since I only allow Cloudflare IPs to access my ports 80 and 443, I can limit based upon firewall rules in Cloudflare like so:

You could also password protect this page with NGINX and a passwd file.

Quick N Easy Traffic Monitoring
If you need to monitor a network interface on a Linux server, using vnStat and vnStat-PHP is a one-two punch that makes the process incredibly easy.