jow- / nlbwmon

Simple conntrack based traffic accounting
ISC License
150 stars 34 forks source link

How can I view "20170710.db" that was created? #3

Closed hub2git closed 7 years ago

hub2git commented 7 years ago

Hi guys,

I'm a newbie with a WD MyNet 750 router running LEDE Reboot 17.01.2 r3435-65eec8bd5f. I have a 256MB USB thumbdrive plugged into the back of the router. It's formatted as fat32.

I need to see, in every billing cycle, how much bandwidth I'm using. The billing cycle begins on the 10th of every month. I want to keep a record of all my months forever (In other words, I don't want to lose my stats for the July billing cycle when the August billing cycle is complete).

@hnyman suggested that I use nlbwmon (and luci-app-nlbwmon) to accomplish this goal.

My Netlink Bandwidth Monitor - Configuration > Advanced Settings looks like this: http://i.imgur.com/vQtku88.png

Maximum entries: 0 (I changed it from 10000 for now. With a 256MB USB thumbdrive, I'm not worried about storage space) Stored periods: 0 (coz I wanna keep databases forever. Maybe later, I'll change this. But since I have a huge storage space -- a 256MB thumbdrive -- I can afford "forever") Commit Interval: 60s (at least for now, as I make sure everything is working. Later on, after I verify smooth operations, I'll dial it back to maybe 10 minutes) Refresh Interval: 30s (the default setting) Database directory: "/mnt/sda1/" (this is my 256MB USB thumbdrive)

Some questions:

  1. nlbwmon can accomplish my goal(s), right?
  2. How can I view the logs?
jow- commented 7 years ago

Use nlbw -c list to list databases and nlbw -t <timestamp> -c show to dump the contents of a given interval. Alternatively use -c csv for a CSV export.

Example:

# nlbw -c list
2017-08-01
2017-07-01
2017-06-01
# nlbw -t 2017-06-01 -c csv -s';'
"family";"proto";"port";"mac";"ip";"conns";"rx_bytes";"rx_pkts";"tx_bytes";"tx_pkts";"layer7"
4;"TCP";80;"cc:2d:8c:00:00:00";"10.11.12.2";4226;32081203598;8411661;292102853;5177792;"HTTP"
4;"TCP";443;"00:24:d7:00:00:00";"10.11.12.19";8446;1229874472;552024;86235000;685566;"HTTPS"
...
hub2git commented 7 years ago

Hi, @jow-

Thank you for your reply. I did as you suggested and got this:

root@LEDE:/mnt/sda1# nlbw -t 2017-07-10 -c csv

"family"    "proto" "port"  "mac"   "ip"    "conns" "rx_bytes"  "rx_pkts"   "tx_bytes"  "tx_pkts"   "layer7"
4   "TCP"   443 "14:91:82:70:1d:26" "192.168.1.120" 9919    2163848329  1786339 78226075    984095  "HTTPS"
4   "IP"    0   "14:91:82:70:1d:26" "192.168.1.120" 3103    293834222   815947  54246994    241373  
4   "TCP"   443 "c0:bd:d1:1c:01:21" "192.168.1.102" 3215    88523054    106074  12530053    79855   "HTTPS"
4   "TCP"   80  "14:91:82:70:1d:26" "192.168.1.120" 2982    54052078    65860   5706440 48694   "HTTP"
4   "TCP"   443 "68:a3:c4:5c:1a:41" "192.168.1.186" 1015    32384972    71153   11452745    61504   "HTTPS"
4   "IP"    0   "c0:bd:d1:1c:01:21" "192.168.1.102" 75  16538544    13978   851971  7894    
4   "TCP"   80  "c0:bd:d1:1c:01:21" "192.168.1.102" 192 11342015    8806    368274  5665    "HTTP"
4   "TCP"   80  "68:a3:c4:5c:1a:41" "192.168.1.186" 180 8657049 8726    440060  6724    "HTTP"
4   "IP"    0   "68:a3:c4:5c:1a:41" "192.168.1.186" 888 1013754 4165    343639  3933    
4   "UDP"   53  "00:00:00:00:00:00" "192.168.0.1"   9701    784388  11467   1756092 9706    "DNS"
4   "UDP"   53  "14:91:82:70:1d:26" "192.168.1.120" 240 37440   240 14340   239 "DNS"
4   "IP"    0   "00:00:00:00:00:00" "192.168.254.102"   19  9468    89  0   0   
4   "ICMP"  0   "c0:bd:d1:1c:01:21" "192.168.1.102" 21  6636    79  6636    79  "ICMP"
4   "IP"    0   "00:00:00:00:00:00" "192.168.254.101"   9   5292    47  0   0   
4   "TCP"   53  "00:00:00:00:00:00" "192.168.0.1"   15  900 15  600 15  "DNS"
4   "UDP"   137 "14:91:82:70:1d:26" "192.168.1.120" 5   0   0   1170    15  "NetBIOS"
6   "IP"    0   "00:00:00:00:00:00" "fd9d:c63f:7525::6db"   2   0   0   256 4   
6   "IP"    0   "00:00:00:00:00:00" "fd9d:c63f:7525::5596:5824:9331:60d2"   2   0   0   0   0   
6   "IP"    0   "68:a3:c4:5c:1a:41" "fd9d:c63f:7525::5596:5824:9331:60d2"   2   0   0   256 4   
6   "IP"    0   "68:a3:c4:5c:1a:41" "fd9d:c63f:7525::97fd:8d7f:3540:d48c"   4   0   0   512 8   
6   "TCP"   53  "00:00:00:00:00:00" "fd9d:c63f:7525::1" 2   0   0   1120    14  "DNS"
6   "UDP"   53  "00:00:00:00:00:00" "fd9d:c63f:7525::1" 477 0   0   47132   531 "DNS"

In the 3rd-to-last and 4th-to-last rows, there is some text that are so long that the rest of the cells in the row are moved out of their column. Just wanted to share with you, in case it's a bug. :)

Here is the file: 20170710.db.gz

jow- commented 7 years ago

No, its tab separated data, it is fine that values are shifted in some cases.