Install vnStat, start its vnstatd collector, select the correct network interface, and query the resulting database with vnstat. You get per-interface five-minute, hourly, daily, monthly, and yearly traffic totals without packet capture. Because the daemon samples kernel interface counters periodically, the figures are historical accounting rather than a live packet-by-packet view.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers installation from packages or source, systemd startup, interface verification, routine reports, units, configuration, machine-readable exports, database care, and the failure modes that commonly confuse a new installation.
As an Amazon Associate I earn from qualifying purchases.
What vnStat measures
vnStat is a console-based network traffic monitor. It reads byte counters exposed by Linux through the proc or sys filesystems, then stores periodic totals in a local database. The design is deliberately light: vnstatd retrieves counters, caches them, and writes updates, while vnstat reads that stored history for reports.
The database is organized into fixed time buckets. The available views are:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| View | What it shows | Useful for |
|---|---|---|
| Five-minute | Short intervals captured by the daemon | Recent activity and short troubleshooting sessions |
| Hourly | Traffic totals by hour | Finding busy periods during a day |
| Daily | Receive and transmit totals for each day | Daily allowance and trend checks |
| Monthly | Totals grouped by calendar month | Capacity planning and provider-limit tracking |
| Yearly | Totals grouped by year | Long-term history |
Receive and transmit are separate
vnStat reports RX (received) and TX (transmitted) traffic independently. On a server, RX usually represents data arriving through the selected interface and TX data leaving it, but the accounting is always relative to that interface. A host with several interfaces can therefore show very different totals for its public, private, bridge, VPN, or container interfaces.
What the tool does not inspect
vnStat is not a packet sniffer. It cannot identify individual connections, URLs, processes, applications, ports, or users. It also does not provide a centralized fleet view or an accuracy guarantee against a provider’s billing system. Use packet capture or flow analysis when you need per-connection detail, and use a central monitoring system when many hosts must be alerted and compared.
Install vnStat
Use your distribution’s package when available
Distribution packages are normally the simplest route because they integrate files, permissions, and service units with the operating system. Package names, daemon-unit names, and default configuration paths vary, so follow the current instructions for the Linux distribution and release running on the server. After installation, locate the supplied service and configuration file before changing paths or permissions.
Package installation does not by itself prove that collection is active. Check which executable and unit were installed, read the unit’s status, and note the path of the active vnstat.conf. Keeping the package’s layout is usually safer than copying files into a second location, which can leave the command and daemon using different databases.
Build from source
The upstream build requires a C compiler and make. SQLite development files are required; libgd is optional when you want image output through the companion tools. From an unpacked source release, the documented build sequence is:
./configure --prefix=/usr --sysconfdir=/etc && make && make installBuilding this way installs the executable under the selected prefix and places configuration under the selected system configuration directory. You must then install or copy the appropriate systemd service definition supplied with the release, because a source install does not necessarily register a unit automatically.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before starting a source-built daemon, verify that the service points to the same binary, configuration file, and database directory that your interactive vnstat command uses. Mixing a distribution binary with a source-installed configuration is a common reason for apparently empty or inconsistent reports.
Enable and start the collector with systemd
When a systemd unit is available, enable it so collection starts at boot and start it immediately:
systemctl enable vnstat
systemctl start vnstatThe exact unit name can differ in a distribution package. If the command reports that the unit is missing, list installed units and use the name supplied by your package or source release rather than creating a second service with a conflicting name.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
After starting, inspect the service status and journal for interface-discovery or permission errors. A clean start means the process launched; it does not guarantee that every desired interface was added or that the database path is writable.
Recommended Free Tools
Allow time for the first records
Do not judge the installation by an empty report immediately after startup. The daemon samples counters and updates the database periodically, so the first useful output can take several minutes. A successful service start confirms that collection is running; it does not mean that every report is populated yet.
How the collector and reports fit together
Think of vnStat as two cooperating programs with different jobs. The daemon synchronizes counters at startup, sleeps between update cycles, and saves cached values to the interface database. The command-line client reads those saved values for five-minute, hourly, daily, monthly, yearly, live-style, JSON, and XML views. Running a report does not force a packet scan or an immediate kernel-counter write.
This separation explains two otherwise surprising behaviors. First, a query can trail the counter shown by an operating-system utility until the next daemon update. Second, restarting or interrupting the daemon at the wrong moment can leave recent cached values unwritten. When coordinating a maintenance window or backup, use the daemon’s documented SIGHUP behavior to write cached data, rescan the database directory, and reload configuration, then verify the files before copying them.
Identify and select the correct interface
Always determine the interface name from the operating system instead of assuming it is eth0. Modern systems often use predictable names such as ens3, enp1s0, or a provider-specific virtual name.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- List interfaces and their state with
ip link. Note the interface carrying the traffic you intend to measure. - Check which interfaces vnStat already knows with
vnstat --iflist. - If the intended interface is absent, use vnStat’s documented interface-add option for your installed version, then verify it appears in the database list.
- Query explicitly while testing:
vnstat -i eth0. Replaceeth0with the real interface name.
On a single-interface host, an unqualified vnstat command may use the configured default. On a multi-interface host, scripts and operational notes should include -i interface-name so a later change in the default cannot silently redirect accounting.
Be especially deliberate on hosts with physical, public, private, bridge, VPN, or container interfaces. A transfer can appear on more than one logical layer, so adding reports from several interfaces may double-count it. Decide whether your question concerns traffic crossing one device or traffic visible across a particular network boundary, and use that definition consistently.
Everyday vnStat commands
Human-readable period reports are convenient over SSH. The following commands assume an interface named eth0; substitute the name found with ip link.
| Command | Purpose |
|---|---|
vnstat -i eth0 |
Show the standard summary for one interface. |
vnstat -d -i eth0 |
Display daily totals. |
vnstat -m -i eth0 |
Display monthly totals. |
vnstat -y -i eth0 |
Display yearly totals. |
vnstat -h -i eth0 |
Display hourly traffic. |
vnstat -5 -i eth0 |
Display five-minute intervals. |
vnstat -l -i eth0 |
Show a live-style view while the command runs. |
vnstat --iflist |
List interfaces known to the database. |
vnstat --json -i eth0 |
Export stored data as JSON. |
vnstat --xml -i eth0 |
Export stored data as XML. |
Use vnstat --help on the installed version to confirm option spellings when packaging differs. The period switches query data already saved by the daemon; they do not force an immediate read of the kernel counter. The command documentation also includes database-listing and database-dump-oriented modes, which can help inventory interfaces or move data; use the exact syntax shown by your installed version rather than assuming options from another release.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Read a report without mixing interfaces
A summary normally presents RX, TX, and a combined total. Check the interface name printed in the report before comparing two hosts. A bridge, tunnel, or virtual interface can represent traffic that is also visible on a physical interface, so adding several interface reports may count the same transfer more than once.
Keep units consistent
Rates can be represented in bytes or bits. The Debian command documentation provides a rate-unit setting, and vnstat.conf contains the shared unit configuration used by the command-line tools and daemon. Pick one representation for a dashboard or script and set it explicitly; otherwise a display in megabits can be mistaken for one in megabytes. Totals and rates should be labelled with their unit in exported dashboards.
Configure vnStat deliberately
Understand vnstat.conf
vnstat.conf is shared by vnstat, vnstati, and vnstatd. It can define the database directory, default interface, disk-space checks, update behavior, output preferences, and other common settings. Read the comments in the configuration installed by your package before editing; option names and defaults are version-dependent.
After changing configuration, make sure both the daemon and reporting command reload the same file. A configuration edited in one location while the service starts with another can make a setting appear ineffective. A clean restart or the documented SIGHUP path provides a controlled reload; check the service journal afterward.
Database location
The documented Linux default database directory is /var/lib/vnstat, unless DatabaseDir is changed. Each monitored interface has database state there. If you customize the directory, record the setting in your server documentation and ensure the daemon, interactive users, and backup process all refer to the same path.
Storage and retention decisions
The configuration and manuals describe collection and storage mechanics, but they do not promise a universal retention period or accuracy percentage. Decide how long history is valuable to your operation, monitor available disk space, and test what your package does when old records or a full filesystem are encountered. Keep permissions restrictive enough to protect operational data while allowing the service account to update its files.
Export data for scripts and dashboards
Prefer JSON or XML over screen scraping
Use --json or --xml for automation. These formats preserve named fields for dates, RX, TX, totals, and the selected time periods, avoiding brittle parsing of column spacing in a human report. Include the interface option in every export command:
vnstat --json -i eth0 > /var/tmp/eth0-bandwidth.json
vnstat --xml -i eth0 > /var/tmp/eth0-bandwidth.xmlFor a production collector, write to a temporary file and rename it after a successful command so a dashboard never reads a partially written document. Validate that the interface exists and that the returned document contains the expected period before publishing it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Store the interface name and unit alongside the exported document. If a host later gains a second network device, an unlabeled total is difficult to interpret. Also record the query time and remember that the newest bucket may still be changing while the daemon completes its next save cycle.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Account for daemon caching
A query can lag the live kernel counter because vnstatd sleeps between updates and writes cached values at its save interval. That delay is normal. Do not treat a small difference between ip-level counters and a vnStat export as data loss unless it persists beyond several update cycles.
Flush cached data when coordinating a handoff
The daemon documents SIGHUP handling for writing cached data, rescanning the database directory, and reloading configuration. If you need to move or back up the database at a known point, send SIGHUP according to the service-management method used by your distribution, then verify that the files have been updated before copying them. Avoid killing the process abruptly while it holds unsaved counters.
Back up and migrate history safely
- Read the active
DatabaseDirfrom the configuration and identify the interface database files there. - Ask the running daemon to flush cached values using its documented SIGHUP handling, or stop it cleanly through the service manager when your maintenance procedure requires a full stop.
- Copy the database directory while preserving file ownership, permissions, and names.
- On the destination, install a compatible vnStat version, set the intended database directory, and restore the files before starting collection.
- Start the daemon, list known interfaces, and compare a daily or monthly report with the original host.
An empty database directory on the new server looks exactly like lost history from the command line. Confirm the path first, then investigate interface-name changes or permission problems. Keep a record of custom paths because a package upgrade can otherwise leave backups looking complete while the service reads a different directory.
Troubleshoot common problems
The report is empty
- Confirm the daemon is running with your systemd service status command.
- Check that the intended interface appears in
vnstat --iflist. - Wait through the first update cycle; initial data is not instantaneous.
- Verify that the configured database directory exists and is writable by the daemon.
If the service is active but no records appear after several cycles, inspect its journal for configuration, permission, or interface errors and confirm that the interface itself is carrying traffic.
The wrong interface is displayed
Run ip link and compare its names with vnstat --iflist. Select the intended interface with -i for immediate checks and add it through vnStat’s interface-management option if it is not present. Do not delete an existing database merely because the default interface changed; first identify which history belongs to which device.
Values look stale
Check the daemon’s update and save behavior, then allow another interval to pass. A cached report is expected between writes. If you have just changed configuration, use the documented SIGHUP behavior or restart the service cleanly, and make sure the command and daemon read the same vnstat.conf.
History disappeared after a migration
Compare the old and new DatabaseDir settings. Restore the interface database files into the directory actually used by the new installation, preserve ownership and permissions, and verify the interface names have not changed. A fresh empty directory produces apparently missing history even when the original files are intact elsewhere.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Commands require privileges or fail to write
vnStat reads counters from proc or sys filesystems and is designed to operate without root permissions on most systems. Writing configuration, installing a service, changing the database directory, and managing systemd still require the privileges appropriate to those operations. If a normal query fails, inspect file permissions and the selected database path before running the entire monitor as root.
Know when vnStat is the right tool
| Need | vnStat’s fit | Use another class of tool when… |
|---|---|---|
| Per-host aggregate totals | Strong fit; it records interface counters locally. | You need packet payloads or connection-level records. |
| Historical daily or monthly views | Strong fit after the database has accumulated data. | You require an immediate, packet-by-packet incident view. |
| Low overhead and ordinary user queries | Good fit because it samples kernel counters rather than sniffing traffic. | You need deep protocol or application attribution. |
| Machine-readable output | JSON and XML are available. | You need built-in alert routing, fleet aggregation, or long-term remote storage. |
| Provider billing reconciliation | Useful as a local reference. | Your provider’s billing counter is the contractual source of truth. |
The important comparison is architectural, not a benchmark claim. vnStat is local and historical, based on aggregate counters, with ordinary-user queries and lightweight collection. Packet and flow analyzers trade more overhead for connection detail, while centralized systems add remote retention, alerting, and fleet-wide views. Choose according to the question you need answered rather than expecting one tool to provide all three layers.
For a single Linux server, vnStat offers a simple way to answer “how much traffic crossed this interface?” without deploying a full monitoring stack. For many servers, combine local collection with a central system that handles authentication, retention, alerting, and cross-host views.
Operational checklist
- Install vnStat using the distribution package or the documented source build.
- Enable and start the
vnstatdsystemd service. - Identify the traffic-bearing interface with
ip link. - Confirm it is present in
vnstat --iflist; add it if necessary. - Run
vnstat -i interface-nameafter the first update cycle. - Use daily, monthly, yearly, hourly, five-minute, or live views for the question at hand.
- Set a consistent byte-or-bit unit for people and scripts.
- Export JSON or XML instead of parsing screen formatting.
- Document any custom
DatabaseDirand include the database in backup decisions. - Remember that the result is aggregate interface history, not packet or application analysis.
Frequently Asked Questions
Does vnStat show traffic immediately after installation?
Usually not. vnstatd updates its database periodically, and the upstream guide notes that useful output can take several minutes. Confirm the service is running, then wait through at least one update cycle before diagnosing an empty report.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteShould I monitor a physical or virtual interface?
Monitor the interface that matches the question you are asking. Public, private, bridge, VPN, and container interfaces can each have different counters, and the same transfer may be visible at more than one layer. Select one explicitly with -i and avoid adding overlapping totals.
Can vnStat identify which process used the bandwidth?
No. vnStat stores aggregate RX and TX counters for an interface. It does not inspect packets or attribute traffic to applications, ports, URLs, users, or individual connections. Use packet capture, flow analysis, or application metrics for that level of detail.
Why does vnStat disagree with a live interface counter?
The daemon caches counters and writes them at its update and save intervals. A small, temporary difference is expected. Compare again after several cycles; persistent differences warrant checking the selected interface, configuration path, permissions, and daemon logs.
What format should a script consume?
Use vnstat --json or vnstat --xml with an explicit interface. These formats provide named fields and avoid parsing human-readable column spacing. Label the unit and interface in the consuming system, and publish files atomically so readers never see partial output.
Where is vnStat history stored?
The documented Linux default is /var/lib/vnstat, unless DatabaseDir in vnstat.conf changes it. Verify the active setting before backing up or migrating, preserve ownership and permissions, and ensure the daemon and query command use the same directory.
Can I rely on vnStat for provider billing?
Use it as a local reference, not as a contractual replacement for the provider’s counter. Interface scope, update timing, and provider accounting rules may differ. Reconcile definitions and units before treating a local total as a billing dispute measurement.
Does querying vnStat require root?
The monitor reads counters from proc or sys filesystems and is designed to work without root permissions on most systems. Installation, systemd management, configuration changes, and writing to protected database directories still require the privileges appropriate to those operations.
The Bottom Line
vnStat is a practical, low-overhead way to keep per-interface bandwidth history on a Linux server. Install and start vnstatd, verify the real interface name, wait for the first collection cycles, and query with an explicit -i option. Use JSON or XML for automation, keep bytes and bits consistent, and back up the configured database directory when history matters. Remember that vnStat reports aggregate counters, not packet-level or application-level activity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
