Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I am administrator of an openSUSE linux server which is used by many people in our company. Today we find out that yesterday one of the users use too much of bandwidth and its important for management department to notice which user have done this.

I've searched in different website and forums etc the all I find was ifconfig or ifstat which are just show the whole network usage. and also I install a tool vnstatto start network monitoring and logging for any further problem might happen in future.

finally, I wonder is there any solution to find out network usage in a specific time in past per user. or is there a log file in linux responsible for traking network usage by users.

share|improve this question

marked as duplicate by mdpc, MadHatter, Michael Hampton Aug 6 at 23:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
@perror i don't want to limit the bandwidth, just want to find who used so much yesterday –  amir19 Aug 5 at 14:47
    
Sorry, I misread your question. Still, iptables can log a lot of information about network usage. It should also be the right way to go. But, is it for a future usage or just for this present case (because, you need to set-up the log before using it). –  perror Aug 5 at 14:49
    
actually it has not been logging in our policy, there isn't a way to find out about network usage per user ? –  amir19 Aug 5 at 14:50
    
The problem is that you need to establish a link between a network connection and a user while it is running. Once this has been done, this link is lost (at least, up to my knowledge). One way to keep this information could be follow what is explained in this question. –  perror Aug 5 at 14:57

3 Answers 3

up vote 4 down vote accepted

No, there is no such logfile.

You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user.

See e.g. this near-duplicate question or this one.

share|improve this answer
    
This seems to be a quite common question, in fact. We can find it in many stack-exchange websites. –  perror Aug 5 at 15:01
    
Superuser link is the answer. Can't vote to close when answered on another SE site...hmmph. –  Mark Wagner Aug 6 at 2:57

It is very simple: with iptables, you can track the users as well. Theoretically, you could block/delete/redirect their packets, but now currently you only want to measure them. It is very simple, because iptables by default tracks all of the data getting through their rules. An example code is here:

iptables -A OUTPUT -o eth0 -m owner --uid-owner 1001

After an iptables -L -v -n you will be able to see, how many data was sent by the user with uid 1001.

Of course it is not a full solution - maybe a much better alternative were, if you

  • created the uid tracker in a different chain in a script
  • and logged the counter of this with a tool.

Probably there are ready tools for that, although it weren't so complex to implement it by hand as well.

share|improve this answer

The problem is that you need to establish a link between a network connection and a user while it is running. Once this has been done, this link is lost (at least, up to my knowledge).

One way to keep this information could be follow what is explained in this question:

How to monitor network bandwidth per user on Ubuntu server?. (askUbuntu)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.