VNSTAT(1)

📦
version 2.14 · 5 versions
, in arch rolling

✨ vnstat(1) ✨

okay bestie, welcome to the User Manuals page for vnstat(1) — grab a lil snack, we're going in 🍓

🌸 NAME 🌸

vnstat — a console-based network traffic monitor 💖

🦋 SYNOPSIS 🦋

vnstat [-5bDedhlmqstvy?]  [--95th] [--add] [--alert output exit type
condition limit unit] [--begin date] [--config file] [--days [limit]]
[--db file] [--dbdir directory] [--dbiflist [mode]] [--debug] [--end
date] [--fiveminutes [limit]] [--help] [-hg] [--hours [limit]]
[--hoursgraph] [-i interface] [--iface interface] [--iflist [mode]]
[--json [mode] [limit]] [--limit limit] [--live [mode]] [--locale
locale] [--longhelp] [--merge source destination] [--months [limit]]
[--oneline [mode]] [--query [mode]] [--rateunit [mode]] [--remove]
[--rename name] [-ru [mode]] [--setalias alias] [--short] [--showconfig]
[--style number] [--top [limit]] [-tr [time]] [--traffic [time]]
[--version] [--xml [mode] [limit]] [--years [limit]] [interface]

🎀 DESCRIPTION 🎀

So like, vnstat is a console-based network traffic monitor. It keeps a log of 5 minute interval, hourly, daily, monthly and yearly network traffic for the selected interface(s). ✨

But — and this is important, bestie — it is not a packet sniffer. The traffic information is read from the proc(5) or sys filesystems, depending on availability, and that's literally why it uses such light system resources regardless of how hard your network traffic rate is going. It's giving low-effort-maintenance, high-effort-results 💅. That way vnstat can be used even without root permissions on most systems. no cap.

Functionality is divided into two commands, okay? The purpose of the vnstat command is to provide an interface for querying the traffic information stored in the database 🗂️, whereas the daemon vnstatd(8) is the one responsible for data retrieval, caching and storage. And even though the daemon process is constantly running as a service, it's actually spending most of its time sleeping between data updates 😴 — literally the dream work schedule, honestly.

💅 OPTIONS 💅

  • --95th — shows 95th percentile output for the ongoing month. This output uses the 5 minute resolution data of the ongoing month to calculate the 95th percentile traffic rate for received, transmitted and total. On top of that, the minimum, average and maximum traffic rates for received, transmitted and total are also shown. ⚠️ This output requires the 5MinuteHours configuration option to have a value of at least 744 for storing all the necessary data — otherwise 100% coverage isn't possible. so like, set it right or accept the consequences 🙈
  • --add — creates a database entry for the interface specified with -i or --iface. The daemon can totally be running during this operation, and it will automatically start monitoring the interface without a restart within SaveInterval minutes if configuration option RescanDatabaseOnSave is enabled. Otherwise? The daemon needs to be restarted in order for the added interface to be monitored. sad but true 😭
  • --alert output exit type condition limit unit — depending on the values of the given parameters, show alert, use a different exit status, or a combination of both when the configured situation is met. 🚨

The output parameter takes a number from 0 to 3 and controls when, if at all, the command will result in output: '0' never produces output, '1' always produces output, '2' shows output only when usage estimate exceeds limit, and '3' shows output only when limit is exceeded.

The exit parameter takes a number from 0 to 5 and controls the exit status of the command: '0' always uses exit status 0, '1' always uses exit status 1, '2' uses exit status 1 if usage estimate exceeds limit but otherwise exit status 0, and '3' uses exit status 1 if limit is exceeded but otherwise exit status 0. '4' and '5' are equivalents of '2' and '3' with the difference that exit status 2 is used instead of exit status 1 when the condition is met. This can help differentiate alerts from errors, since errors will always use exit status 1. 💡

The type parameter defines which time range type usage the limit is compared against. Available options: 'h', 'hour', 'hourly', 'd', 'day', 'daily', 'm', 'month', 'monthly', 'y', 'year', 'yearly', 'p', '95', '95%'.

The condition parameter defines if limit is compared to received (rx), transmitted (tx), total, or estimated usage of these three. Available options: 'rx', 'tx', 'total', 'rx_estimate', 'tx_estimate', 'total_estimate'. Estimate options aren't available for 95th percentile type. 🫶

limit is a greater than zero integer without decimals which defines the traffic usage limit using the unit defined with the unit parameter. unit accepts the following options: 'B', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'. For 95th percentile type the following options are available: 'B/s', 'KiB/s', 'MiB/s', 'GiB/s', 'TiB/s', 'PiB/s', 'EiB/s', 'kB/s', 'MB/s', 'GB/s', 'TB/s', 'PB/s', 'EB/s', 'bit/s', 'Kibit/s', 'Mibit/s', 'Gibit/s', 'Tibit/s', 'Pibit/s', 'Eibit/s', 'kbit/s', 'Mbit/s', 'Gbit/s', 'Tbit/s', 'Pbit/s', 'Ebit/s'.

Usage must exceed limit in order for the alarm to activate. Exactly the same usage as limit does not raise the alarm. 👀

Estimate calculation isn't limited to the estimate options in the condition parameter — you can also achieve it by using the estimate option in the output or exit parameters. Missing or invalid parameters, or a parameter combination that doesn't work, will result in --alert-specific help output being shown. 🎀

  • -b, --begin date — begins the list output with a specific date / time defined by date, instead of the begin being selected based on the number of entries to be shown. If date isn't available in the database, then the closest later date will be used. date supports the following formats: YYYY-MM-DD HH:MM, YYYY-MM-DD and "today". This option can only be used with --json, --xml and list outputs. 📅
  • --config file — use file as the configuration file instead of using the automatic configuration file search functionality. If --config is used multiple times, the configuration settings from files later on the command line will override configuration settings loaded from earlier files — but only if the settings defined in the files overlap. 🔍
  • -d, --days [limit] — show traffic statistics on a daily basis for the last days. The length of the list will be limited to 30 entries unless configured otherwise, or unless the optional limit parameter is used. All entries stored in the database will be shown if limit is set to 0. 🌈
  • --db file — use file as the database file instead of searching for a database from the directory specified in the configuration file, or the hardcoded default if no configuration file is available. This option overrides --dbdir. 💾
  • --dbdir directory — use directory as the database directory instead of using the directory specified in the configuration file, or the hardcoded default if no configuration file is available. This option is ignored if --db is also defined. 🗃️
  • --dbiflist [mode] — list interfaces currently in the database. If mode is not defined or is set to 0, then the output will use a one line verbose format. If mode is set to 1, then the output will contain one interface per line, and if mode is set to 2 then only the interface count will be shown as a single number. See also --iflist. 🧚
  • -D, --debug — show additional debug output. Can be used multiple times for increased verbosity, up to a maximum of 2. 🐛
  • -e, --end date — ends the list output with a specific date / time defined by date, instead of the latest date / time in the database. If date isn't available in the database, then the closest earlier date will be used. date supports the following formats: YYYY-MM-DD HH:MM and YYYY-MM-DD. This option can only be used with --json, --xml and list outputs. In list outputs the estimate line is replaced with a sum line, with values representing the sums of each column. The sum line is shown only if the output consists of more than one data line — and this is applicable even if the defined date is the same as the current date. The top list also requires --begin to be used at the same time with this option. 📆
  • -5, --fiveminutes [limit] — show traffic statistics with a 5 minute resolution for the last hours. The length of the list will be limited to 24 entries unless configured otherwise, or unless the optional limit parameter is used. All entries stored in the database will be shown if limit is set to 0. ⏱️
  • -h, --hours [limit] — show traffic statistics on a hourly basis. The length of the list will be limited to 24 entries unless configured otherwise, or unless the optional limit parameter is used. All entries stored in the database will be shown if the limit is set to 0. 🕐
  • -hg, --hoursgraph — show traffic statistics on a hourly basis for the last 24 hours using a bar graph followed by a table representing the numerical data. literally the icon of graphs, obsessed 📊
  • -i, --iface interface — select one specific interface and apply actions to only it. For database queries, it's possible to merge the information of two or more interfaces using the interface1+interface2+... syntax. All provided interfaces must be unique and must exist in the database when the merge syntax is used. Optionally, depending on the InterfaceMatchMethod configuration setting, interface can be replaced with an alias previously set using --setalias. Merge syntax isn't supported when an alias is used. The -i, --iface option is optional, and interface can be used as a parameter on the command line for selecting the used interface even without the option being explicitly used. 🔌
  • --iflist [mode] — list currently available interfaces. If mode is not defined or is set to 0, then the output will use a one line verbose format. If mode is set to 1, then the output will contain one interface per line, and if mode is set to 2 then only the interface count will be shown as a single number. See also --dbiflist. 👑
  • --json [mode] [limit] — okay bestie, this is the json dump era ✨ it shows database content for the selected interface or for all interfaces. Every traffic value in the output is in bytes unless the key name says otherwise. You can pass an optional mode parameter to limit the output to only selected info — by default, everything except the 95th percentile output is shown. Set mode to 's' for a summary containing the last 2 entries of 5 minute, hourly, daily, monthly and yearly resolution data; 'f' gives only 5 minute resolution entries; 'h' hours; 'd' days; 'm' months; 'y' years; 't' the top days; and 'p' the 95th percentile. Alternatively, or in combination with mode, an optional limit parameter can limit the number of entries in the output. The --json option can be used in combination with -l, --live and -tr options without mode or limit having any effect to the output. The jsonversion field in the output contains the API version information — it will be changed only when the names or structures of previously existing content gets changed. In comparison, the vnstatversion field exists only as extra information 💅
  • --limit limit — sets the maximum number of shown entries in list outputs to limit. Using --limit overrides the default list entry limit values and the optional limit parameter given directly for a list query. All entries stored in the database will be shown if limit is set to 0. --limit can also be used to control the length of --json and --xml outputs 🎀
  • -l, --live [mode] — displays the current transfer rate for the selected interface in real time until interrupted, like a little traffic heartbeat monitor 💓 statistics will be shown after interruption if the runtime was more than 10 seconds. An optional mode parameter can select between displaying packets per second (mode 0) and transfer counters (mode 1) during execution. --style can also be used to affect the layout of the output. The output will be in json format if used in combination with --json option.
  • --locale locale — use locale instead of using the locale setting specified in the configuration file or the system default if no configuration file is available 🌍
  • --longhelp — show complete options list. iconic, honestly ✨
  • --merge source destination — merge interface data from source database to destination database. Unless interfaces are specified, all interfaces from source will be merged to destination. A new database will be created if destination doesn't exist. If an interface of the same name doesn't exist in destination then a direct copy action for the data from source will be executed. If an interface of the same name already exists in destination then an additive merge action will be executed. The source database is always accessed as read-only and will never be modified by the merge actions. Changes to the destination database cannot be reversed as subtraction actions aren't supported 🫶 execution of the merge needs to be acknowledged with an additional parameter. If this additional parameter isn't provided then a preview of the actions with additional guidance will be shown.

Both source and destination can either refer directly to database files or use an alternative file:interface syntax where the database file is suffixed with : followed with an interface name. When used as source, the alternative syntax allows specifying one interface to be merged from source to destination instead of all interfaces being merged. Additionally, it's possible to use the alternative syntax in destination for specifying to which interface the data will be merged to.

  • -m, --months [limit] — show traffic statistics on a monthly basis for the last months 🌙 the length of the list will be limited to 12 entries unless configured otherwise or unless the optional limit parameter is used. All entries stored in the database will be shown if limit is set to 0.
  • --oneline [mode] — show traffic summary for the selected interface using one line with a parsable format. The output contains 15 fields with ; used as field delimiter. The 1st field contains the API version information of the output that will only be changed in future versions if the field content or structure changes. The following fields in order: 2) interface name, 3) timestamp for today, 4) rx for today, 5) tx for today, 6) total for today, 7) average traffic rate for today, 8) timestamp for current month, 9) rx for current month, 10) tx for current month, 11) total for current month, 12) average traffic rate for current month, 13) all time total rx, 14) all time total tx, 15) all time total traffic. An optional mode parameter can be used to force all fields to output in bytes without the unit itself shown 📏
  • -q, --query [mode] — force database query mode. An optional mode parameter can override the default query mode. 'a' results in short summary output being used when there are more than one interface in the database, otherwise regular summary output is used. 's' results in regular summary output being shown for one interface regardless of the number of interfaces in the database. When the optional mode parameter isn't defined, the configured QueryMode will be used instead 🔍
  • --remove — delete the database entry for the interface specified with -i or --iface and stop monitoring it. The daemon can be running during this operation and will automatically detect the change 💀
  • --rename name — rename the interface specified with -i or --iface in the database with new name name. The new name cannot already exist in the database. This operation doesn't cause any data loss. The daemon should not be running during this operation 🚫
  • -ru, --rateunit [mode] — swap the configured rate unit. If rate has been configured to be shown in bytes then rate will be shown in bits if this option is present. In the same way, if rate has been configured to be shown in bits then rate will be shown in bytes when this option is present. Alternatively, mode with either 0 or 1 can be used as parameter for this option in order to select between bytes (0) and bits (1) regardless of the configuration file setting ⚖️
  • --setalias alias — set alias as an alias for the selected interface to be shown in queries. The set alias can be removed by specifying an empty string for alias. The daemon can be running during this operation 🏷️
  • -s, --short — use short output mode. This mode is also used when more than one interface is available in the database and no specific interface is selected.
  • --showconfig — show current configuration using the same format as the configuration file itself uses 🧾
  • --style number — modify the content and style of outputs. Set number to 0 for a narrower output, 1 for enabling bar column, 2 for same as previous but with average traffic rate visible in summary output, and 3 for enabling average traffic rate in all outputs where it is supported. 4 disables the use of terminal control characters in -l, --live and -tr, --traffic modes 🎨
  • -t, --top [limit] — show all time top traffic days 👑 the length of the list will be limited to 10 entries unless configured otherwise or unless the optional limit parameter is used. All entries stored in the database will be shown if limit is set to 0. When used with --begin and optionally with --end, the list will be generated using the daily data instead of separate top entries. The availability of daily data defines the boundaries the date specific query can access.
  • -tr, --traffic [time] — calculate how much traffic goes through the selected interface during the given time seconds. The time will be 5 seconds if a number parameter isn't specified. The output will be in json format if used in combination with --json option. However, in that case, the countdown before results isn't shown. --style can also be used to affect the layout of the output ⏱️
  • -v, --version — show current version.
  • --xml [mode] [limit] — the xml sibling of the json dump, same energy with angle brackets 🦋 it shows database content for the selected interface or all interfaces in xml format. All traffic values in the output are in bytes unless otherwise indicated by the name of the key. An optional mode parameter can be used for limiting the output to only selected information — everything except the 95th percentile output is shown by default. Set mode to 's' for a summary containing the last 2 entries of 5 minute, hourly, daily, monthly and yearly resolution data; 'f' gives only 5 minute resolution entries; 'h' hours; 'd' days; 'm' months; 'y' years; 't' the top days; and 'p' the 95th percentile. Alternatively, or in combination with mode, an optional limit parameter can limit the number of entries in the output. The xmlversion field in the output contains the API version information — it will be changed only when the names or structures of previously existing content gets changed. In comparison, the vnstatversion field exists only as extra information.
  • -y, --years [limit] — show traffic statistics on a yearly basis for the last years 🗓️ the list will show all entries by default unless configured otherwise or unless the optional limit parameter is used. All entries stored in the database will also be shown if limit is set to 0.
  • -?, --help — show a command option summary. the little save-me icon of the options world 🙈

🎀 FILES 🎀

  • /var/lib/vnstat/ — default database directory on Linux 🐧 on BSD systems the compile-time default is /var/db/vnstat unless overridden at build time.
  • Configuration file locations and search order are described in vnstat.conf(5) 📚

💫 EXAMPLES 💫

Okay bestie, this is the fun part — real commands you can literally copy-paste. Slay.

  • vnstat — just type it with no args and you get the traffic summary for the default interface. Or, if you're monitoring more than one, you get a summary for multiple interfaces. Lowkey the easiest flex.
vnstat
  • vnstat -i eth0+eth1+eth3 — this one is giving combo energy ✨ it shows the traffic summary for a merge of interfaces eth0, eth1 and eth3.
vnstat -i eth0+eth1+eth3
  • vnstat -i eth2 --xml — wants everything about interface eth2 but in xml format? Obsessed. Outputs all information about eth2 in xml.
vnstat -i eth2 --xml
  • vnstat --json — no interface specified, so it dumps all information about all monitored interfaces in json format. Main character behavior fr fr.
vnstat --json
  • vnstat -i eth0 --setalias local — giving interface eth0 the alias "local". The way that this info will later show up as a label when eth0 is queried? Iconic. 🎀
vnstat -i eth0 --setalias local
  • vnstat -i eth2 --remove — bye bestie 👋 deletes the database entries for interface eth2 and stops monitoring it.
vnstat -i eth2 --remove

🚧 RESTRICTIONS 🚧

Okay so this part is the vibe check you actually need to pay attention to, ngl.

  • Updates need to be executed at least as often as it is possible for the interface to generate enough traffic to overflow the kernel interface traffic counter. If you don't? It's possible that some traffic won't be seen. 💀 Like, literally lost to the void.
  • With 32-bit interface traffic counters, the maximum time between two updates depends on how fast the interface can transfer 4 GiB.
⚠️ And heads up — there is no guarantee that a 64-bit kernel has 64-bit interface traffic counters for all interfaces. Don't assume, bestie.

The calculated theoretical times are:

10 Mbit:        54 minutes
100 Mbit:        5 minutes
1000 Mbit:      30 seconds
  • Virtual and aliased interfaces cannot be monitored, because the kernel doesn't provide traffic information for that type of interface. 😭 Such interfaces are usually named eth0:0, eth0:1, eth0:2 etc., where eth0 is the actual interface being aliased.
  • Using long date output formats may cause misalignment in the shown columns if the length of the date exceeds the fixed size allocation. So like… aesthetic risk, basically. 🙈

👑 AUTHOR 👑

Teemu Toivola <tst at iki dot fi> — the mastermind, the moment, the legend. 🫶

🌈 SEE ALSO 🌈

Go read these next, iykyk:

That's the whole page, bestie — you made it to the end 🎉💖 This masterpiece is version 2.14, dated OCTOBER 2026. Go forth and monitor your traffic, you absolute icon. 🦋✨

📦 where this page comes from