Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an attempt to make my life easier I want to log all bandwidth used on my server for a day, and then somehow export it. It doesn't matter much how it exports it because I can parse that stuff myself, but I need software to be able to accurately log traffic going in and out of eth0.

If anyone knows of such software, I'd be grateful if you could provide a link. I have already Googled for such things yet found nothing suitable.


share|improve this question
up vote 6 down vote accepted

My recommendation is vnStat:

vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s)

It works as advertised and seems like a good match for your needs.

To facilitate parsing you'd probably like to take a look at the --xml and --dumpdb switch in the vnstat documentation:

  • --xml : Show database content for selected interface or all interfaces in xml format. All traffic values in the output are in KiB.
  • --dumpdb : Instead of showing the database with a formatted output, this output will dump the whole database in a format that should be easy to parse with most script languages.

Feature list:

  • quick and simple to install and get running
  • gathered statistics persists through system reboots
  • can monitor multiple interfaces at the same time
  • several output options
  • summary, hourly, daily, monthly, weekly, top 10 days
  • optional png image output (using libgd)
  • months can be configured to follow billing period
  • light, minimal resource usage
  • same low cpu usage regardless of traffic
  • can be used without root permissions
share|improve this answer

When using logstash with kibana this is easy to setup

What we did is log the total traffic to a log file with the following bash script.


timestamp() {
  date +"%Y-%m-%dT%T.%N"

while ( sleep 60 ) ; do
#clear log file 
truncate -s 0 $LOGPATH

#log timstamp and type of log line
echo -n "$(timestamp) linux::systemstatus::network " >> $LOGPATH
#remove tabs and spaces from grep result
grep "eth" /proc/net/dev |head -n1|sed -e 's/^[ \t]*//'| sed -n 's/  \+/ /gp' >> $LOGPATH


Nxlog exports the log to logstash and kibana.

In logstash the string is parsed to individual values Kibana makes the traffic visible in a derivative histogram (this shows the difference from 1 value to the next)

This gives us a nice overal graph of the used bandwidth. On top of this we also log the CPU, Disk and Memory usage of the server.

Note: we parse the whole log line from /proc/net/dev into seperate values just in case we want to monitor on lost packeges or errors

share|improve this answer
Perfect, Thanks, I had to change last line to done from Done – squarebear Mar 12 '15 at 13:24

You could use munin:

Example graphs:

alt text alt text

Live Munin Example

share|improve this answer

Since you said eth0, I have to assume you must be running some Linux distribution. If so, please add a linux tag to your question.

If you're looking for a nice network traffic logger for Linux, consider ulogd. It can log very detailed data about IP packets into plain-text files and databases. You can control what you need to be logged by using -j ULOG in iptables rules.

share|improve this answer

Have you considered using SNMP to log this (and many, many other things) on your system? Lots of monitoring system should be able to get you the information, and if you already have one in place, you can probably use it without needing to deploy another solution.

share|improve this answer

you can try ntop or bandwidthd. depends on what type of services are you running.

those two are most often deployed on routers forwarding traffic to many computers, but should work on one machine as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.