Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking to monitor how much bandwidth different users consume on a server.

Effectively, I'm looking for something like UserIPacct (http://ramses.smeyers.be/homepage/useripacct/), where I can get a print-out like:

    User       Sent       Received     Flags
    root       401364     401421
    news       2143       2210
    lf         221462     348287

Sadly, useripacct is not available for the 2.6 kernel series.

share|improve this question

4 Answers 4

I don't know of any pre-existing solutions, but you can do this with netfilter using the 'owner' match extension, although you'll probably have to play with conntrack a bit to catch and account for the inbound packets (and you'd miss the initial connection setup packets, as they're not managed by a userspace process). I'd imagine that a non-netfilter solution would also be possible (a la ntop and the like) but it'd almost certainly get ugly and CPU intensive very quickly.

Honestly, though, I have pretty serious doubts that you're solving the right problem. Accounting for traffic on a per-user basis is better done by analysing the server-level logs (Apache, MTA, POP/IMAP server, etc) and accounting/billing on that basis (with an appropriate overhead for the bits they don't catch, like DNS). Trying to tie everything back to a user almost certainly won't have the results you expect.

share|improve this answer
    
In my case, I'm allowing users to execute arbitrary code on my server, so I need a very general solution to track them. Following this image: jengelh.medozas.de/images/nf-packet- flow.png I modified the RAW table: Chain OUTPUT (policy ACCEPT) target prot opt source destination MARK tcp -- anywhere anywhere owner UID match emp1 MARK xset 0x64/0xffffffff Sadly, I'm not seeing any marks in conntrack -L (all have mark 0). Am I doing somethign wrong? –  Aaron Aug 15 '09 at 2:54
    
alright, I figured out what you meant.. (hence my answer). thanks –  Aaron Aug 15 '09 at 8:28

alright looks like this is the clear way to do this:

http://siphon9.net/loune/2009/07/pondering-per-user-accounting-in-linux/

share|improve this answer

It may not be exactly what you are looking for, but vnstat has some nice features and its totally free. It will display bandwidth in real time, days total, week total, month total, etc.

share|improve this answer
    
vnstat is a nice tool, but I need something that will give me bandwidth usage per-user (or at least per-process (+children)) –  Aaron Aug 15 '09 at 3:13
1  
It's crazy how many people don't read the question. –  niXar Aug 15 '09 at 10:47
    
read the question...offered my answered anyway....and leaving it put..here, I will list it again: It may not be exactly what you are looking for, but vnstat has some nice features and its totally free. It will display bandwidth in real time, days total, week total, month total, etc. –  cop1152 Aug 16 '09 at 13:14

For real-time monitoring you can use iftop. If your looking for a log and report solution, then you can use pmacct. Works very nicely and can give you 1/2 hour, daily, weekly, monthly and yearly roll-ups.

As an aside, we use it a work in association with RRD tool to produce nice 'real-time' graphs.

share|improve this answer
    
A nice tool, but it doesn't seem to be able to track linux uids. –  Aaron Aug 15 '09 at 7:00
    
Sam, keyword: "per user." –  niXar Aug 15 '09 at 10:46
    
Yes I realize that. But it has to be said, if the linux box is acting as a proxy server / gateway, then my interpritation is perfectly valid. –  Sam Aug 15 '09 at 11:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.