vnstat - Cheap VPS LLC


Section: User Manuals (1)
Updated: JUNE 2011
Return to Main Contents



vnStat – a console-based network traffic monitor





] [

] [


] [

] [

] [


] [

] [

] [

] [

] [

] [

] [


] [


] [

] [


] [


] [

] [

] [


] [

] [

] [

] [

] [

] [

] [

] [

] [

] [


] [

] [

] [

] [


] [


] [

] [

] [

] [





is a console-based network traffic monitor. It keeps a log of hourly,
daily and monthly network traffic for the selected interface(s). However,
it isn’t a packet sniffer. The traffic information is analyzed from the


filesystems depending on availability. That way vnStat can be used even
without root permissions on most systems.




Remove all top10 entries.

–config file


as config file instead of using normal config file search function.

-d, –days

Show traffic for days.

–dbdir directory


as database directory instead of using the directory specified in the configuration
file or the hardcoded default if no configuration file is available.

-D, –debug

Show additional debug output.


Delete the database for the selected interface and stop monitoring it.


Instead of showing the database with a formated output, this output will
dump the whole database in a format that should be easy to parse with most
script languages. Use this for example with PHP, Perl or Python to make a
custom webpage. The dump uses ; as field delimeter.

activity status

name for the interface

nick (if given)

creation date in Unix time

when the database was updated

all time total received MiB

all time total transmitted MiB

latest rx value in /proc

latest tx value in /proc

total rx KiB counter

total tx KiB counter

system boot time in Unix time

Then follows 30 lines like the following


where d = days, 0 = day number in database (0 is today), 1077314401 date in
Unix time, 559 = rx MiB, 7433 = tx MiB, 68 = rx KiB, 557 = tx KiB and 1 tells that
vnStat has filled this value and it is in use.




m = months, t = top10 and h = hours, all other fields are in the same order as in days
except hours that doesn’t have a separate KiB value. For hours the forth and fifth fields
have values in KiB.

–enable, –disable

Enable or disable updates for selected interface. Useful for
interfaces that aren’t always available, like ppp0. If the interface
goes down it should be disabled in order to avoid errors. Add something
vnstat -r –disable -i ppp0

to the script that’s executed when
the interface goes down and
vnstat –enable -i ppp0

to the up script. These two options aren’t needed when the daemon is used.

-h, –hours

Show traffic for the last 24 hours.

-i, –iface interface

Select one specific

and apply actions to only it.


Show list of currently available interfaces.

-l, –live mode

Display current transfer rate for the selected interface in real time
until interrupted. Statistics will be shown after interruption if the runtime
was more than 10 seconds. An optional

parameter can be used to select between the displaying of packets per
second (mode 0) and transfer counters (mode 1) during execution.

can also be used to affect the layout of the output.

–locale locale


instead of using the locale setting specified in the configuration file or the system
default if no configuration file is available.


Show complete options list.

-m, –months

Show traffic for months.

–nick nickname

Set the selected interfaces

as an alias the will be displayed in queries. Usage of

is required to save the change.


Show traffic summary for selected interface using one line with a parseable
format. The output contains 15 fields with ; used as field delimeter. The 1st
field contains the version information of the output that will be changed
in future versions of vnStat if the field structure changes. The following
fields in order 2) interface name, 3) timestamp for today, 4) rx for today,
5) tx for today, 6) total for today, 7) average traffic rate for today,
8) timestamp for current month, 9) rx for current month, 10) tx for current
month, 11) total for current month, 12) average traffic rate for today,
13) all time total rx, 14) all time total tx, 15) all time total traffic.

-q, –query

Force database query mode.

-r, –reset

Reset the internal counters in the database for the selected
interface. Use this if the interface goes down and back up,
otherwise that interface will get some extra traffic to its database.


Reset the total traffic counters and recount those using recorded months.

-ru, –rateunit

Swap the configured rate unit. If rate has been configured to be shown in
bytes then rate will be shown in bits if this option is present. In the same
way, if rate has been configured to be shown in bits then rate will be shown
in bytes when this option is present. Alternatively 0 or 1 can be given as
parameter for this option in order to select between bytes (0) and bits
(1) regardless of the configuration file setting.


Write the end result of a database merge to the file

that can then be used as a new database if renamed. Top10 traffic days
isn’t included in the merge and will start empty in the new database.

-s, –short

Use short output mode. This mode is also used if more than one
database is available.

–style number

Modify the content and style of outputs. Set

to 0 for a more narrow output, 1 for enabling bar column, 2
for same as previous but with average traffic rate visible in summary
and weekly outputs and 3 for enabling average traffic rate in all
outputs where it is supported. 4 disables the use of terminal control
characters in
-l / –live



Synchronize internal counters in the database with interface
counters for the selected interface. Use this if the system is
rebooted but interface counters aren’t reseted. Such can occur
when suspend to ram/disk is used.


Test if the kernel boot time information always stays the same like it should or
if it’s shifting.

-t, –top10

Show all time top10 traffic days.

-tr time

Calculate how much traffic goes through the selected interface during
the given

seconds. The

will be 5 seconds if a number parameter isn’t included.

-u, –update

Update all enabled databases or only the one specified with


-v, –version

Show current version.

-w, –weeks

Show traffic for 7 days, current and previous week.


Show database content for selected interface or all interfaces in xml format. All
traffic values in the output are in KiB.

-?, –help

Show a command summary.




This directory contains all databases the program uses. Files are
named according to the monitored interfaces.


Config file that will be used unless

exists. See

for more information.




Display traffic summary for the default interface.

vnstat -i eth0+eth1+eth3

Display traffic summary for a merge of interfaces eth0, eth1 and eth3.

vnstat -i eth2 –xml

Output all information about interface eth2 in xml format.

vnstat -u -i eth0

Force a database update for interface eth0 or create the database if it doesn’t
exist. This is usually the first command used after a fresh install.

vnstat -u -i eth0 –nick local

Give interface eth0 the nickname "local". That information will be later
later visible as a label when eth0 is queried. The database will also be updated
when this command is executed or created if the database doesn’t exist.

vnstat -i eth2 –delete

Delete database of interface eth2 and stop monitoring it.



Updates needs to be executed at least as often as it is possible for the interface
to generate enough traffic to wrap the kernel interface traffic counter. Otherwise
it is possible that some traffic won’t be seen. This isn’t an issue for 64 bit kernels
but at least one update every hour is always required in order to provide proper input.
With 32 bit kernels the maximum time between two updates depends on how fast the
interface can transfer 4 GiB. Calculated theoretical times are:

10 Mbit: 54 minutes
100 Mbit: 5 minutes
1000 Mbit: 30 seconds

However, for 1000 Mbit interfaces updating once every minute is usually still a
working option.

Estimated traffic values are likely to be somewhat inaccurate if daily
traffic is low because only the MiB counter is used to calculate the

Virtual and aliased interfaces cannot be monitored because the kernel doesn’t
provide traffic information for that type of interfaces. Such interfaces are
usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is the actual interface
being aliased.



Teemu Toivola <tst at iki dot fi>




















Back to Top

PayPal Logo┬ęCheap VPS LLC - Leader of affordable VPS Hosting Services