How to monitor network bandwidth per user on Ubuntu server?

Question

I have some shell users on a server with 300GB of monthly data transfer. How can I monitor bandwidth usage per user?

Answer 1

As root, you could at least measure the outgoing traffic on a per-user basis using the "owner" module of iptables. If all the users you want to monitor are in /root/list-of-users.txt, you can do:

for login in $(cat /root/list-of-users.txt);
do
    iptables -N out_user_$login
    iptables -A OUTPUT -m owner --uid-owner $(id -u $login) -j out_user_$login
done

And then the packet and byte counts for each user's outbound traffic are visible:

iptables -L OUTPUT -n -v | grep out_

This could be extended further with CONNMARK to track the inbound side too.

Answer 2

I just came across NetHogs:

NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process.

This ought to let you track bandwidth by username. Might still need another couple tools to log the info and add it all up, but it's a good start without directly using iptables.

Answer 3

I looked a bit, and I haven't found a comprehensive gui package that does what you want. Hopefully one exists and someone will post about it here eventually.

I'm not really a networking guy, but from what I've read, among many other things netstat and iptables are supposed to do for ip/host -based user accounting what the acct tools did for system process accounting. This cyberciti.biz link might set you on your way to developing a system with these tools:

http://www.cyberciti.biz/faq/linux-configuring-ip-traffic-accounting/

Answer 4

You can use Cacti

Cacti is a complete frontend to RRDTool, it stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven. Along with being able to maintain Graphs, Data Sources, and Round Robin Archives in a database, cacti handles the data gathering. There is also SNMP support for those used to creating traffic graphs with MRTG.

Or vnStat

vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won't actually be sniffing any traffic and also ensures light use of system resources.

Both of them are great.