vnstat(1) User Manuals vnstat(1)
NAME
vnstat - a console-based network traffic monitor
SYNOPSIS
vnstat [-5bDedhlmqstvy?] [--95th] [--add] [--alert output exit type
condition limit unit] [--begin date] [--config file] [--days [limit]]
[--db file] [--dbdir directory] [--dbiflist [mode]] [--debug] [--end
date] [--fiveminutes [limit]] [--help] [-hg] [--hours [limit]]
[--hoursgraph] [-i interface] [--iface interface] [--iflist [mode]]
[--json [mode] [limit]] [--limit limit] [--live [mode]] [--locale
locale] [--longhelp] [--merge source destination] [--months [limit]]
[--oneline [mode]] [--query [mode]] [--rateunit [mode]] [--remove]
[--rename name] [-ru [mode]] [--setalias alias] [--short]
[--showconfig] [--style number] [--top [limit]] [-tr [time]] [--traffic
[time]] [--version] [--xml [mode] [limit]] [--years [limit]]
[interface]
DESCRIPTION
vnStat is a console-based network traffic monitor. It keeps a log of 5
minute interval, hourly, daily, monthly and yearly network traffic for
the selected interface(s). However, it isn't a packet sniffer. The
traffic information is read from the proc(5) or sys filesystems
depending on availability resulting in light use of system resources
regardless of network traffic rate. That way vnStat can be used even
without root permissions on most systems.
Functionality is divided into two commands. The purpose of the vnstat
command is to provide an interface for querying the traffic information
stored in the database whereas the daemon vnstatd(8) is responsible for
data retrieval, caching and storage. Although the daemon process is
constantly running as a service, it is actually spending most of its
time sleeping between data updates.
OPTIONS
--95th Show 95th percentile output for the ongoing month. This output
uses the 5 minute resolution data of the ongoing month to
calculate the 95th percentile traffic rate for received,
transmitted and total. In addition, the minimum, average and
maximum traffic rates for received, transmitted and total are
also shown. This output requires the 5MinuteHours configuration
option to have a value of at least 744 for storing all the
necessary data, otherwise 100% coverage isn't possible.
--add Create database entry for interface specified with -i or --iface
option. The daemon can be running during this operation and will
automatically start monitoring the interface without a restart
within SaveInterval minutes if configuration option
RescanDatabaseOnSave is enabled. Otherwise the daemon needs to
be restarted in order for the added interface to be monitored.
--alert output exit type condition limit unit
Depending on values of given parameters, show alert, use
different exit status or a combination of both when configured
situation is met.
output parameter takes a number from 0 to 3 and controls when,
if at all, the command will result in output. '0' never produces
output, '1' always produces output, '2' shows output only when
usage estimate exceeds limit and '3' shows output only when
limit is exceeded.
exit parameter takes a number from 0 to 5 and controls the exit
status of the command. '0' always uses exit status 0, '1' always
uses exit status 1, '2' uses exit status 1 if usage estimate
exceeds limit but otherwise exit status 0 and '3' uses exit
status 1 if limit is exceeded but otherwise exit status 0. '4'
and '5' are equivalents of '2' and '3' with the difference that
exit status 2 is used instead of exit status 1 when the
condition is met. This can help differentiate alerts from errors
as errors will always use exit status 1.
type parameter defines to which time range type usage the limit
is compared against. Available options: 'h', 'hour', 'hourly',
'd', 'day', 'daily', 'm', 'month', 'monthly', 'y', 'year',
'yearly', 'p', '95', '95%'.
condition parameter defines if limit is compared to received
(rx), transmitted (tx), total or estimated usage of these three.
Available options: 'rx', 'tx', 'total', 'rx_estimate',
'tx_estimate', 'total_estimate'. Estimate options aren't
available for 95th percentile type.
limit is a greater than zero integer without decimals which
defines the traffic usage limit using the unit defined with the
unit parameter. unit accepts the following options: 'B', 'KiB',
'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'KB', 'MB', 'GB', 'TB', 'PB',
'EB'. For 95th percentile type the following options are
available: 'B/s', 'KiB/s', 'MiB/s', 'GiB/s', 'TiB/s', 'PiB/s',
'EiB/s', 'kB/s', 'MB/s', 'GB/s', 'TB/s', 'PB/s', 'EB/s',
'bit/s', 'Kibit/s', 'Mibit/s', 'Gibit/s', 'Tibit/s', 'Pibit/s',
'Eibit/s', 'kbit/s', 'Mbit/s', 'Gbit/s', 'Tbit/s', 'Pbit/s',
'Ebit/s'. Usage must exceed limit in order for the alarm to
activate. Exactly the same usage as limit does not raise the
alarm.
Estimate calculation isn't limited to the estimate options in
condition parameter but can also be achieved by using the
estimate option in output or exit parameters. Missing or invalid
parameters or parameter combination will result in --alert
specific help output being shown.
-b, --begin date
Begin the list output with a specific date / time defined by
date instead of the begin being selected based on the number of
entries to be shown. If date isn't available in the database
then the closest later date will be used. date supports the
following formats: YYYY-MM-DD HH:MM, YYYY-MM-DD and "today".
This option can only be used with --json , --xml and list
outputs.
--config file
Use file as configuration file instead of using automatic
configuration file search functionality. If --config is used
multiple times, the configuration settings from files later on
the command line will override configuration settings loaded
from earlier files if the settings defined in the files overlap.
-d, --days [limit]
Show traffic statistics on a daily basis for the last days. The
length of the list will be limited to 30 entries unless
configured otherwise or unless the optional limit parameter is
used. All entries stored in the database will be shown if limit
is set to 0.
--db file
Use file as database file instead of searching for a database
from the directory specified in the configuration file or the
hardcoded default if no configuration file is available. This
option overrides --dbdir.
--dbdir directory
Use directory as database directory instead of using the
directory specified in the configuration file or the hardcoded
default if no configuration file is available. This option is
ignored if --db is also defined.
--dbiflist [mode]
List interfaces currently in the database. If mode is not
defined or is set to 0 then the output will use a one line
verbose format. If mode is set to 1 then the output will contain
one interface per line and if mode is set to 2 then only the
interface count will be shown as a single number. See also
--iflist.
-D, --debug
Show additional debug output.
-e, --end date
End the list output with a specific date / time defined by date
instead of the latest date / time in the database. If date isn't
available in the database then the closest earlier date will be
used. date supports the following formats: YYYY-MM-DD HH:MM and
YYYY-MM-DD. This option can only be used with --json , --xml
and list outputs. In list outputs the estimate line is replaced
with a sum line with values representing the sums of each
column. The sum line is shown only if the output consists of
more than one data line. This is applicable even if the defined
date is the same as the current date. The top list also requires
--begin to be used at the same time with this option.
-5, --fiveminutes [limit]
Show traffic statistics with a 5 minute resolution for the last
hours. The length of the list will be limited to 24 entries
unless configured otherwise or unless the optional limit
parameter is used. All entries stored in the database will be
shown if limit is set to 0.
-h, --hours [limit]
Show traffic statistics on a hourly basis. The length of the
list will be limited to 24 entries unless configured otherwise
or unless the optional limit parameter is used. All entries
store in the database will be shown if the limit is set to 0.
-hg, --hoursgraph
Show traffic statistics on a hourly basis for the last 24 hours
using a bar graph followed by a table representing the numerical
data.
-i, --iface interface
Select one specific interface and apply actions to only it. For
database queries, it is possible to merge the information of two
or more interfaces using the interface1+interface2+... syntax.
All provided interfaces must be unique and must exist in the
database when the merge syntax is used. Optionally, depending on
the InterfaceMatchMethod configuration setting, interface can be
replaced with alias previously set using --setalias. Merge
syntax isn't supported when alias is used. The -i, --iface
option is optional and interface can be used as parameter on the
command line for selecting the used interface even without the
option being explicitly used.
--iflist [mode]
List currently available interfaces. If mode is not defined or
is set to 0 then the output will use a one line verbose format.
If mode is set to 1 then the output will contain one interface
per line and if mode is set to 2 then only the interface count
will be shown as a single number. See also --dbiflist.
--json [mode] [limit]
Show database content for selected interface or all interfaces
in json format. All traffic values in the output are in bytes
unless otherwise indicated by the name of the key. An optional
mode parameter can be used for limiting the output to only
selected information. Everything except the 95th percentile
output is shown by default. Setting mode to 's' will output a
summary containing the last 2 entries of 5 minute, hourly,
daily, monthly and yearly resolution data, 'f' will output only
5 minute resolution entries, 'h' hours, 'd' days, 'm' months,
'y' years, 't' the top days and 'p' the 95th percentile.
Alternatively or in combination with mode an optional limit
parameter can be used to limit the number of entries in the
output. The --json option can be used in combination with -l,
--live and -tr options without mode or limit having any effect
to the output. The jsonversion field in the output contains the
API version information. It will be changed only when the names
or structures of previously existing content gets changed. In
comparison, the vnstatversion field exists only as extra
information.
--limit limit
Set the maximum number of shown entries in list outputs to
limit. Usage of --limit overrides the default list entry limit
values and the optional limit parameter given directly for a
list query. All entries stored in the database will be shown if
limit is set to 0. --limit can also be used to control the
length of --json and --xml outputs.
-l, --live [mode]
Display current transfer rate for the selected interface in real
time until interrupted. Statistics will be shown after
interruption if the runtime was more than 10 seconds. An
optional mode parameter can be used to select between the
displaying of packets per second (mode 0) and transfer counters
(mode 1) during execution. --style can also be used to affect
the layout of the output. The output will be in json format if
used in combination with --json option.
--locale locale
Use locale instead of using the locale setting specified in the
configuration file or the system default if no configuration
file is available.
--longhelp
Show complete options list.
--merge source destination
Merge interface data from source database to destination
database. Unless interfaces are specified, all interfaces from
source will be merged to destination. A new database will be
created if destination doesn't exist. If an interface of the
same name doesn't exist in destination then a direct copy action
for the data from source will be executed. If an interface of
the same name already exists in destination then an additive
merge action will be executed. The source database is always
accessed as read-only and will never be modified by the merge
actions. Changes to the destination database cannot be reversed
as subtraction actions aren't supported. Execution of the merge
needs to be acknowledged with an additional parameter. If this
additional parameter isn't provided then a preview of the
actions with additional guidance will be shown.
Both source and destination can either refer directly to
database files or use an alternative file:interface syntax where
the database file is suffixed with : followed with an interface
name. When used as source, the alternative syntax allows
specifying one interface to be merged from source to destination
instead of all interfaces being merged. Additionally, it's
possible to use the alternative syntax in destination for
specifying to which interface the data will be merged to.
-m, --months [limit]
Show traffic statistics on a monthly basis for the last months.
The length of the list will be limited to 12 entries unless
configured otherwise or unless the optional limit parameter is
used. All entries stored in the database will be shown if limit
is set to 0.
--oneline [mode]
Show traffic summary for selected interface using one line with
a parsable format. The output contains 15 fields with ; used as
field delimiter. The 1st field contains the API version
information of the output that will only be changed in future
versions if the field content or structure changes. The
following fields in order 2) interface name, 3) timestamp for
today, 4) rx for today, 5) tx for today, 6) total for today, 7)
average traffic rate for today, 8) timestamp for current month,
9) rx for current month, 10) tx for current month, 11) total for
current month, 12) average traffic rate for current month, 13)
all time total rx, 14) all time total tx, 15) all time total
traffic. An optional mode parameter can be used to force all
fields to output in bytes without the unit itself shown.
-q, --query [mode]
Force database query mode. An optional mode parameter can be
used to override the default query mode. 'a' results in short
summary output being used when there are more than one interface
in the database, otherwise regular summary output is used. 's'
results in regular summary output being shown for one interface
regardless of the number of interfaces in the database. When the
optional mode parameter isn't defined, the configured QueryMode
will be used instead.
--remove
Delete the database entry for the interface specified with -i or
--iface and stop monitoring it. The daemon can be running during
this operation and will automatically detect the change.
--rename name
Rename the interface specified with -i or --iface in the
database with new name name. The new name cannot already exist
in the database. This operation doesn't cause any data loss. The
daemon should not be running during this operation.
-ru, --rateunit [mode]
Swap the configured rate unit. If rate has been configured to be
shown in bytes then rate will be shown in bits if this option is
present. In the same way, if rate has been configured to be
shown in bits then rate will be shown in bytes when this option
is present. Alternatively, mode with either 0 or 1 can be used
as parameter for this option in order to select between bytes
(0) and bits (1) regardless of the configuration file setting.
--setalias alias
Set alias as an alias for the selected interface to be shown in
queries. The set alias can be removed by specifying an empty
string for alias. The daemon can be running during this
operation.
-s, --short
Use short output mode. This mode is also used when more than one
interface is available in the database and no specific interface
is selected.
--showconfig
Show current configuration using the same format as the
configuration file itself uses.
--style number
Modify the content and style of outputs. Set number to 0 for a
narrower output, 1 for enabling bar column, 2 for same as
previous but with average traffic rate visible in summary output
and 3 for enabling average traffic rate in all outputs where it
is supported. 4 disables the use of terminal control characters
in -l, --live and -tr, --traffic modes.
-t, --top [limit]
Show all time top traffic days. The length of the list will be
limited to 10 entries unless configured otherwise or unless the
optional limit parameter is used. All entries stored in the
database will be shown if limit is set to 0. When used with
--begin and optionally with --end, the list will be generated
using the daily data instead of separate top entries. The
availability of daily data defines the boundaries the date
specific query can access.
-tr, --traffic [time]
Calculate how much traffic goes through the selected interface
during the given time seconds. The time will be 5 seconds if a
number parameter isn't specified. The output will be in json
format if used in combination with --json option. However, in
that case, the countdown before results isn't shown. --style
can also be used to affect the layout of the output.
-v, --version
Show current version.
--xml [mode] [limit]
Show database content for selected interface or all interfaces
in xml format. All traffic values in the output are in bytes
unless otherwise indicated by the name of the key. An optional
mode parameter can be used for limiting the output to only
selected information. Everything except the 95th percentile
output is shown by default. Setting mode to 's' will output a
summary containing the last 2 entries of 5 minute, hourly,
daily, monthly and yearly resolution data, 'f' will output only
5 minute resolution entries, 'h' hours, 'd' days, 'm' months,
'y' years, 't' the top days and 'p' the 95th percentile.
Alternatively or in combination with mode an optional limit
parameter can be used to limit the number of entries in the
output. The xmlversion field in the output contains the API
version information. It will be changed only when the names or
structures of previously existing content gets changed. In
comparison, the vnstatversion field exists only as extra
information.
-y, --years [limit]
Show traffic statistics on a yearly basis for the last years.
The list will show all entries by default unless configured
otherwise or unless the optional limit parameter is used. All
entries stored in the database will also be shown if limit is
set to 0.
-?, --help
Show a command option summary.
FILES
/opt/local/var/db/vnstat/
Default database directory.
/opt/local/etc/vnstat.conf
Config file that will be used unless $HOME/.vnstatrc exists. See
vnstat.conf(5) for more information.
EXAMPLES
vnstat Display traffic summary for the default interface or multiple
interfaces when more than one is monitored.
vnstat -i eth0+eth1+eth3
Display traffic summary for a merge of interfaces eth0, eth1 and
eth3.
vnstat -i eth2 --xml
Output all information about interface eth2 in xml format.
vnstat --json
Output all information of all monitored interfaces in json
format.
vnstat -i eth0 --setalias local
Give interface eth0 the alias "local". That information will be
later visible as a label when eth0 is queried.
vnstat -i eth2 --remove
Delete database entries for interface eth2 and stop monitoring
it.
RESTRICTIONS
Updates need to be executed at least as often as it is possible for the
interface to generate enough traffic to overflow the kernel interface
traffic counter. Otherwise, it is possible that some traffic won't be
seen. With 32-bit interface traffic counters, the maximum time between
two updates depends on how fast the interface can transfer 4 GiB. Note
that there is no guarantee that a 64-bit kernel has 64-bit interface
traffic counters for all interfaces. Calculated theoretical times are:
10 Mbit: 54 minutes
100 Mbit: 5 minutes
1000 Mbit: 30 seconds
Virtual and aliased interfaces cannot be monitored because the kernel
doesn't provide traffic information for that type of interfaces. Such
interfaces are usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is
the actual interface being aliased.
Using long date output formats may cause misalignment in shown columns
if the length of the date exceeds the fixed size allocation.
AUTHOR
Teemu Toivola <tst at iki dot fi>
SEE ALSO
vnstatd(8), vnstati(1), vnstat.conf(5), proc(5), ifconfig(8), units(7)
version 2.13 FEBRUARY 2025 vnstat(1)
vnstat 2.13 - Generated Thu Feb 20 18:16:10 CST 2025