I have some shell users on a server with 300GB of monthly data transfer. How can I monitor bandwidth usage per user?
As root, you could at least measure the outgoing traffic on a per-user basis using the "owner" module of iptables. If all the users you want to monitor are in
/root/list-of-users.txt, you can do:
for login in $(cat /root/list-of-users.txt); do iptables -N out_user_$login iptables -A OUTPUT -m owner --uid-owner $(id -u $login) -j out_user_$login done
And then the packet and byte counts for each user's outbound traffic are visible:
iptables -L OUTPUT -n -v | grep out_
This could be extended further with CONNMARK to track the inbound side too.
I just came across NetHogs:
NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process.
This ought to let you track bandwidth by username. Might still need another couple tools to log the info and add it all up, but it's a good start without directly using iptables.
You can use Cacti
Cacti is a complete frontend to RRDTool, it stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven. Along with being able to maintain Graphs, Data Sources, and Round Robin Archives in a database, cacti handles the data gathering. There is also SNMP support for those used to creating traffic graphs with MRTG.
vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won't actually be sniffing any traffic and also ensures light use of system resources.
Both of them are great.
I looked a bit, and I haven't found a comprehensive gui package that does what you want. Hopefully one exists and someone will post about it here eventually.
I'm not really a networking guy, but from what I've read, among many other things
iptables are supposed to do for ip/host -based user accounting what the
acct tools did for system process accounting. This cyberciti.biz link might set you on your way to developing a system with these tools: